Eurosmart’s Security IC Protection Profiles certified under EUCC at assurance level “high”

12 Nov 2026 Eurosmart’s Security IC Protection Profiles certified under EUCC at assurance level “high”

Eurosmart welcomes the publication on ENISA’s cybersecurity certification website of the EUCC certificates for its Security IC Platform Protection Profile including Functional Packages (PP-0084 V2) and Security IC Platform Multi-assurance PP-Configurations (PP-0125).

Both were certified by the German Federal Office for Information Security (BSI) on 23 September 2026, at EUCC assurance level “high”, with AVA_VAN.5. These are the same versions of the two Protection Profiles that were certified under SOG-IS in February 2026. They therefore hold both SOG-IS and EUCC certifications. These Eurosmart PPs are the only Protection Profiles certified under EUCC at this assurance level.

For Eurosmart, this achievement serves a clear objective: making robust cybersecurity evaluation and regulatory compliance more accessible and scalable for Europe’s cybersecurity industry.

A shared framework for trusted Security IC platforms

PP-0084 V2 – Security IC Platform Protection Profile including Functional Packages, Version 2.0 establishes a common security baseline for tamper-resistant integrated circuits. Its scope includes processors, security-relevant hardware, memory, contact and contactless interfaces, and dedicated software supplied by the IC manufacturer.

The profile combines core security requirements with five optional functional packages covering Security IC authentication, loading in secured environments, loading restricted to authorised users, cryptographic services and address-based access control.

Aligned with Common Criteria CC:2022 Revision 1, it specifies EAL4 augmented with ALC_DVS.2, ALC_FLR.2 and AVA_VAN.5, addressing development security, flaw reporting procedures and resistance to attacks through advanced methodical vulnerability analysis.

Read more: BSI – PP-0084 V2 · ENISA – EUCC certificate

PP-0125 – Security IC Platform Multi-assurance PP-Configurations, Version 1.0 complements the PP-0084 V2 baseline with PP-Modules covering authentication, the two loading mechanisms, address-based access control and limited test features.

Its multi-assurance approach enables additional assurance to be applied to selected security functions. The global baseline remains EAL4 augmented with ALC_DVS.2, ALC_FLR.2 and AVA_VAN.5, while functions covered by the PP-Modules additionally require ADV_SPM.1 – formal security policy modelling. This adds targeted assurance through formal modelling of selected security functions, while retaining the stated global EAL4 augmented baseline.

Read more: BSI – PP-0125

Turning industry expertise into practical support for compliance

Security IC platforms support products and services across the EU digital market and beyond. Shared certification requirements at component level can benefit the wider ecosystem, including semiconductor manufacturers, device manufacturers, solution providers, evaluation laboratories and certification bodies.

Eurosmart’s next priority is to finalise PP-0084 V3 and align the Protection Profiles with the Cyber Resilience Act’s essential requirements. The objective is to help the industry prepare for CRA conformity assessment through clear, technically robust requirements.

A collective industry achievement

Eurosmart warmly thanks Infineon Technologies AG, NXP Semiconductors, STMicroelectronics and Thales for developing and sponsoring the technical work, and Internet of Trust for its contribution as technical editor.

We also thank the Austrian team at SGS Digital Trust Services GmbH for conducting the evaluations, BSI for its certification work, and ENISA’s Cybersecurity Certification Unit for publishing the certificates. This milestone reflects the sustained commitment of the experts contributing through Eurosmart’s IT and Security Committee (ITSC).

Eurosmart will continue to bring industry expertise into European certification and standardisation efforts, with the ambition of facilitating compliance across Europe’s cybersecurity industry while maintaining demanding security requirements.