The Security Evaluation Standard for IoT Platforms took Common Criteria's methodology, scoped it for connected-device platforms, and became a European standard: EN 17927. Its real product is reuse — one platform certificate that every device built on it can cite.
At a glance
Owner
Standardised by CEN/CENELEC as EN 17927
Type
Derived from CC (ISO/IEC 15408), optimised for IoT platforms
Levels
From self-assessment-based to CC AVA_VAN.5-equivalent depth
Key mechanism
Platform claims consumed by device evaluations — RED, CRA, labels
Ecosystem
PSA rides SESIP logic for Arm-based platforms; multiple CBs operate schemes
Regulatory hooks
Certified platforms shorten every downstream conformity argument
What it is
SESIP evaluates IoT platforms — MCUs, secure enclaves, RTOS/OS layers, connectivity stacks — against a catalogue of reusable security functional requirements (“verification of platform identity”, “secure update”, “protection of data at rest”) at five assurance levels. The methodology descends from Common Criteria and keeps its discipline, but replaces open-ended evaluation with a scoped, platform-appropriate exercise that labs can price and schedule like engineering.
The design goal is composition. A device maker building on a SESIP-certified platform doesn’t re-prove the platform’s claims; their evaluation consumes the certificate and covers only what they added. That is how one chip vendor’s investment propagates through module makers to device brands — and why SESIP claims are written as discrete, machine-readable-ish statements rather than monolithic targets. CEN/CENELEC adoption as EN 17927 gave the methodology a European legal identity that schemes and regulations can reference; PSA Certified applies the same logic with an Arm-flavoured requirement profile and its own branding tiers.
In the CRA era the composition mechanism becomes commercially decisive: with thousands of device makers needing conformity evidence by December 2027, “built on a certified platform” is the shortest credible sentence in any technical file — provided the platform certificate’s claims and composition rationale were written to be consumed, not just displayed.
When it's the right tool
Chips, modules, RoT firmware, RTOS — SESIP is how platform security becomes a checkable purchase criterion, and increasingly a design-in requirement.
Demand SESIP/PSA certificates from suppliers and design your device evaluation to consume them. It is the cheapest assurance you will ever acquire.
SESIP 2–3 covers most device-maker needs; level 5 is for security-core components. An impressive level nobody’s evaluation consumes is marketing spend.
Finished devices point to RED/CRA routes and consumer labels; smartcard-class trust anchors still speak full CC/EUCC. SESIP is the layer between.
Where it matters
SESIP levels, attack-potential ratings and the composition interface that makes certified silicon a purchase criterion.
How platform certificates flow into RED files, CRA conformity and EN 303 645 label evidence through composite evaluation.
SESIP’s path from GlobalPlatform specification to EN 17927 is the reference trajectory for private schemes seeking regulatory convergence.
Industrial devices increasingly anchor 62443-4-2 hardware requirements on SESIP-evaluated platforms.
Expert notes
A SESIP certificate’s value is measured at the consumer’s desk: can a device evaluator map your claims onto their requirements without interpretation meetings? That demands precise claim wording, an explicit composition rationale (what the platform guarantees, under which configuration, with which user obligations), and guidance documentation that survives contact with a customer’s security team. Certificates written for the press release fail this test quietly and expensively.
Our position: we draft SESIP targets starting from the downstream evaluation that will consume them. If we can’t write the consuming evaluator’s paragraph, the claim isn’t ready.
The three overlap by design — SESIP maps to CC assurance components, PSA Certified maps onto SESIP levels for its evaluations, and attack-potential calculations at SESIP 3+ import JIL-style rigor. The lane choice is commercial: PSA where the Arm ecosystem’s brand recognition sells, SESIP where European standardisation and scheme flexibility matter, full CC/EUCC where the product is a regulated trust anchor or the customer’s scheme demands it. Migration between lanes is possible but never free; the evidence architecture should anticipate the second lane on day one.
Our position: decide the lane by asking whose evaluation consumes yours in two years — a device CB, a wallet scheme, an EUCC composite. Work backwards from that consumer; the rest is logistics.
Level selection, claim drafting, composition strategy, lab and CB choice — thirty minutes to a plan.
We’ll send you access by email.
