Which framework is associated with evaluating IT products using EALs?

Which framework is associated with evaluating IT products using EALs?

• A. Cloud Security Alliance STAR
• B. NIST CSF
• C. Common Criteria (CC)
• D. COPPA

Answer: (C)

Evaluation Assurance Levels are part of the Common Criteria framework, the international standard for validating the security properties of IT products. In this system, products are evaluated against a defined Security Target and, if applicable, Protection Profiles, and are given an assurance level from EAL1 to EAL7. Each higher level represents more rigorous evidence and testing, with EAL1 being a basic functional test and EAL7 involving formal analysis and extensive validation of development processes. The result is an independently assessed guarantee about how well the product meets its declared security requirements. Other frameworks like Cloud Security Alliance STAR or NIST CSF focus on different aspects of security assessment and governance, while COPPA addresses privacy for children.