Services
From scoping to certificate maintenance — expert support across Common Criteria, SESIP, CSPN, GlobalPlatform, PCI, FITCEM and FIDO.
Introduction
Security evaluation and certification are no longer optional differentiators — they are opposable requirements in payments, identity, mobile, automotive and critical infrastructure. Yet skilled certification talent is scarce, and every misstep multiplies lab cycles and time-to-market.
Internet of Trust accompanies developers, manufacturers and service providers from basic to the highest assurance levels, adapting to V, Agile or hybrid development models across the schemes below.
This page details our four-phase delivery method, the four engagement modes available, deliverables across Security Targets, audit reports and certification documentation, and how to anticipate scheme convergence under the EU Cybersecurity Act.
Common Criteria EAL4+ → EAL7
SESIP
CSPN
GlobalPlatform
PCI
FITCEM
FIDO
Process
Activities are tailored to applicable regulations and to the customer’s code of practice. Every phase is anchored in measurable certification milestones — from scoping decisions to post-issuance assurance continuity.
01
Workshop to define the Target of Evaluation, scheme and assurance level, security requirements, certification body and laboratory.
02
Gap analysis against the target EAL or scheme level; concrete action plan covering time, resources, reuse strategy and long-term certification roadmap.
03
Joint delivery with the customer: write missing evidences (Security Target, traceability), interface with the lab and certification body up to certificate issuance.
04
Assurance continuity: Change Impact Analysis Reports, updated evidences, re-submission management, follow-up of corrective action plans.
Delivery plan
Deliverables are tailored to customer milestones — from executive overviews to traceable engineering artefacts ready for evaluation labs and certification bodies.
CC, CSPN and scheme-specific STs aligned to the chosen Protection Profile and EAL.
Targeted enablement on CC, Protection Profiles, EAL specifics and lab interaction.
Site Security Audit reports with alternative measures and tracked remediation.
Functional/design specs, test plans, user manuals, cryptographic analyses (AES-GCM, ML-KEM, ECDSA).
Requirements traceability, security rationales, evaluation evidence packs.
Cadence, RAID, lab interface protocols, milestone dashboards.
Engagement modes
Four engagement shapes, selected by scope, assurance target and life-cycle stage.
Mode 01
Define project, resources and stakeholders. Select scheme, security requirements and assurance level for single- or multi-purpose products.
Mode 02
Whole life-cycle accompaniment across one or more certifications — project management, lab/certifier interface, technical documentation. Typical for vendors moving from EAL4+/EAL5+ to EAL6/EAL7.
Mode 03
Targeted intervention at a specific moment of preparation or evaluation — typically Security Target writing or evaluation project management.
Mode 04
Study of development / manufacturing / integration/ personalization sites against applicable regulations, optionally followed by on-site inspection ahead of formal third-party audit.
Field record
Recent engagements include Common Criteria EAL5+/EAL6 evaluations for secure elements and TEEs, SESIP Level 3 preparation for IoT platforms, CSPN security targets for connected industrial gateways, FITCEM and PCI evaluation strategies for payment acceptance terminals, and pre-audits for GSMA SAS and ANSSI site qualification.
We’ll send you access by email.
