On June 22, 2026, the White House issued Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks,” signaling a major acceleration in the federal government’s transition to post-quantum cryptography (PQC). The Executive Order recognizes a growing national security concern: adversaries can collect encrypted data today and potentially decrypt it in the future once large-scale quantum computers become operational, a threat commonly referred to as “harvest now, decrypt later.”

While the Order is directed primarily at federal agencies, the implications extend far beyond government networks. For technology vendors that sell into the federal market, the message is clear: quantum readiness is becoming a compliance and procurement issue, not just a technical roadmap discussion.

A Faster Federal Timeline for Post-Quantum Security

Why FIPS 140-3 Matters More Than Ever

The Growing Connection to Common Criteria and NIAP

What About DoD STIGs?

Compliance Is Becoming a Competitive Advantage

To help organizations navigate PQC requirements and FiPS 140-3, Corsec is setting calls with product vendors to outline security roadmaps.

Connect With Us:

Stay up to date with Corsec as we bring you all the most recent updates to the standards, certifications, and requirements – Subscribe

For organizations that have already achieved Common Criteria certification, there can be a sense that the hardest work is behind them. Once a product earns certification and gains visibility on the Common Criteria Portal, it becomes eligible for procurement opportunities and market access that require independently validated security assurance.

But what happens when that listing is no longer active?

A common misconception is that once a product has been certified, its market access remains unchanged—even if the product is no longer listed as valid. In reality, removal from active listings can significantly affect procurement eligibility, customer confidence, and long-term market viability.

This post is the fourth installment in our series, Deconstructing Common Criteria: 5 Myths and Realities, which examines the assumptions that influence how organizations plan, achieve, and maintain Common Criteria certification. While each post stands independently, together they highlight the decisions that shape certification success—not only at the start of evaluation, but throughout the product’s lifecycle and continued market presence.

Myth #4: If my product is no longer listed on the Common Criteria Portal, I can still access the same markets.

At first glance, it may seem reasonable to assume that once a product achieves Common Criteria certification, its market eligibility remains intact—even if the product is no longer actively listed. After all, certification represents a significant investment of time and resources, and organizations often view it as a long-term credential tied to the product’s history.

However, certification status is not simply about past achievement—it reflects a product’s current standing within the certification ecosystem. Active listings serve as the primary method by which customers, procurement officials, and regulatory stakeholders verify that a product continues to meet recognized security assurance requirements.

When a product transitions from an active listing to an archived status, the implications extend beyond visibility. It can affect how buyers interpret risk, how procurement teams verify compliance, and how organizations position themselves in regulated markets.

Reality: Active Listing Status Plays a Direct Role in Market Access

While previously certified products retain historical value, active listing status on the Common Criteria Portal is often what determines whether a product remains eligible for procurement and trusted by customers.

Many government and regulated-sector procurements require verification of current certification status through the official Common Criteria listings. If a product is no longer actively listed, organizations may face new barriers—even if the product was successfully certified in the past.

In practice, this means that allowing a certification to lapse or transition to archived status can introduce:

• Reduced eligibility for procurements tied to active certification requirements
• Increased scrutiny during vendor evaluations
• Loss of competitive positioning against actively listed products
• Additional effort to re-establish certification standing

Maintaining an active listing is not simply an administrative milestone—it is a strategic component of sustaining market access and customer confidence. Organizations that proactively manage certification timelines and plan for maintenance or re-certification activities are better positioned to preserve continuity in regulated markets and avoid unexpected disruptions.

Planning & Certification Lifecycle Management

Common Criteria certifications are not permanent. Certificates are issued with defined validity periods, and when those periods end, products typically transition from active listings to archived records unless maintenance or renewal actions are completed.

While archived certifications remain accessible for historical reference, they no longer represent an actively validated product. This distinction is important because many stakeholders rely on active listings as confirmation that a product continues to meet recognized assurance expectations.

Organizations that monitor certification timelines and understand expiration cycles are better equipped to maintain continuity and avoid unexpected changes to their listing status, viewing certification as an ongoing lifecycle rather than a one-time milestone.

Planning ahead for maintenance activities, updates, and renewal timelines helps reduce the risk of certification gaps. Rather than reacting to expiration deadlines, proactive teams align certification planning with product development and release cycles.

This forward-looking approach supports consistent market presence and helps ensure certification status remains aligned with long-term business goals.

When Re-Certification or Maintenance Becomes Necessary

If a product listing is approaching expiration—or has already transitioned to archived status—there are still viable paths forward. Depending on the product and scheme requirements, organizations may pursue:

• Assurance maintenance activities
• Re-certification of updated product versions
• Transition to updated Protection Profiles
• Strategic roadmap alignment to maintain listing continuity

The key is recognizing that certification status is dynamic. Market access tied to Common Criteria is often directly linked to whether a product remains actively listed—not simply whether it was once certified.

Learn more about Certification Maintenance or speak directly to an expert.

Achieving Common Criteria certification is a significant milestone—but maintaining that certification is what sustains long-term market success.

Active listing status on the Common Criteria Portal is not just an administrative detail—it is a visible signal to customers, regulators, and partners that a product continues to meet recognized security assurance standards.

Understanding the lifecycle of certification—and planning accordingly—helps ensure that market access remains stable, predictable, and aligned with organizational goals.

When organizations begin exploring Common Criteria, one of the first questions they face is whether their product aligns with an existing requirements framework – a Protection Profile. In environments where certification pathways appear structured around predefined requirements, products that fall outside those boundaries can seem difficult to analyze for evaluation.

This uncertainty frequently shapes early planning decisions. Teams may hesitate to initiate certification discussions if they believe their product does not align to an existing Protection Profile, assuming that evaluation pathways are limited to predefined product categories. In reality, Common Criteria was designed to support a wide range of technologies, including those that introduce new functionality or operate in evolving technical spaces.

This post is the third segment in our series, Deconstructing Common Criteria: 5 Myths and Realities, which examines the assumptions that most often shape how organizations approach Common Criteria certification. While each post is designed to stand on its own, together they provide a clearer view into the decisions that influence certification success across product, engineering, and leadership teams.

Myth 3: “My product does not align to a Protection Profile, so evaluation is not possible.”

Among the myths explored in this series, this assumption often emerges during early practicality discussions. When teams review Protection Profiles and fail to identify a direct match, certification can appear out of reach. This perception can lead organizations to postpone planning efforts or dismiss certification altogether, even when viable pathways exist.

Reality: Protection Profile alignment is not the only path to evaluation.

While Protection Profiles provide structured, widely recognized sets of security requirements for specific product types, they are only one component of the Common Criteria ecosystem. Products that do not align directly to an existing Protection Profile may still be evaluated using alternative approaches, most commonly through the development of a custom Security Target that defines the product’s security functionality and evaluation scope. This approach is evaluated against an Evaluation Assurance Level or EAL.

EAL evaluations allow organizations to describe their product’s intended security capabilities in a structured and testable manner. Rather than forcing alignment to predefined requirements, this approach enables evaluation based on the product’s actual design and implementation. In many cases, emerging technologies, specialized platforms, or products with unique architectural features are evaluated successfully through an EAL evaluation.

In addition, Protection Profiles themselves continue to evolve. As technology landscapes shift, new profiles are developed to address emerging product categories and security needs. Organizations participating in modern development cycles may find that today’s gap between their product and existing Protection Profiles becomes tomorrow’s standard alignment.

Early engagement in certification discussions can help teams understand whether alignment, adaptation or alternative evaluation strategies are possible. Learn more about identifying the right evaluation path with a with a Common Criteria Assessment. and start the conversation early to significantly improve program predictability and learn how structured planning can help define a clear evaluation path while supporting successful market entry.

Scope definition plays a critical role in evaluation feasibility.

When products appear misaligned with existing Protection Profiles, the underlying issue is often related to scope rather than eligibility. The defined Target of Evaluation (TOE)—which establishes the boundaries of what is included in the evaluation—can significantly influence how closely a product aligns with available requirements. Carefully defining system boundaries, security functionality, and operational context often reveals alignment opportunities that are not immediately obvious during initial reviews.

Modular architectures and clearly defined security components can also support flexible evaluation strategies. By isolating security-relevant functionality, organizations may be able to evaluate a portion of the system that aligns with known requirements, while maintaining flexibility for the broader product ecosystem. This approach can reduce complexity and create pathways to certification even when full-system alignment appears challenging.

Early planning reduces uncertainty around alignment.

Much like cost and scheduling considerations, alignment challenges are most manageable when addressed early in the development lifecycle. Organizations that engage in structured planning—reviewing product architecture, identifying security features, and assessing potential evaluation pathways are often better positioned to determine whether Protection Profile alignment is achievable or whether alternative strategies like an EAL evaluation are available.

Delaying these discussions can create downstream complications, particularly if architectural decisions are finalized without considering certification requirements. Early evaluation readiness assessments help clarify pathways, identify potential risks, and establish realistic expectations for scope, documentation, and timeline development.

For many organizations, the perception that evaluation is not possible reflects uncertainty rather than limitation. When teams gain visibility into the available certification approaches, they are better equipped to make informed decisions about product design, market positioning, and long-term certification strategy.

Organizations that engage experienced guidance early are often better positioned to navigate alignment decisions and maintain forward progress. From evaluating potential Protection Profile matches to developing custom Security Targets, structured planning helps transform uncertainty into actionable certification strategy.

Following this discussion, the series continues with additional misconceptions that frequently influence certification planning and long-term product strategy. Each reflects a different stage in the certification lifecycle and highlights how technical, operational, and regulatory assumptions can shape both timing and market readiness.

Continue to follow along as we examine the remaining two myths that continue to influence certification strategy:

Myth 4: If my product is no longer listed on the Common Criteria Portal, I can still access the same markets.
Myth 5: European Union Common Criteria (EUCC) is a completely new certification framework.

These assumptions often stem from practical challenges. A closer examination shows that they can instead highlight opportunities for more structured planning, clearer expectations, and stronger certification outcomes.

For organizations building products intended for government, defense, and regulated industries, Common Criteria remains one of the most widely recognized pathways to demonstrate product security assurance. Yet despite its longevity and global adoption, Common Criteria is often misunderstood—sometimes in ways that delay market entry, increase cost, or create false confidence in compliance readiness.

These misconceptions are not limited to a single function. Product managers may question applicability, engineers may underestimate documentation rigor, and sales teams may assume market access is unaffected by certification status. The result is a fragmented understanding of what Common Criteria actually requires and what it enables.

As the European Union continues to reshape its cybersecurity regulatory landscape, product vendors face a growing need for clarity, alignment, and practical guidance. Corsec is pleased to announce our attendance at the 7th International Conference on the EU Cyber Security and Resilience Acts, taking place March 24–26 in Brussels.

Key Tracks & Sessions Corsec Will Be Following

Throughout the conference, Corsec will be actively engaging across several tracks that are particularly relevant to manufacturers:

• The EU Cybersecurity Agenda 2025–2029: What It Means for Industry
  This track provides a strategic view of the Commission’s priorities for the next legislative cycle, including CRA implementation, NIS 2 enforcement, and the future direction of certification schemes. For vendors, these discussions shape long‑term product and compliance planning.
• From Regulation to Reality: How the EC Is Supporting CRA Implementation Across Europe
  Sessions focused on how the European Commission is supporting harmonized CRA adoption offer insight into what “compliance” will look like in practice—and where flexibility or risk remains for manufacturers preparing today.
• Certification in Practice: From EUCC to CRA Conformity
  These discussions explore how EUCC, EUCS, and other schemes relate to CRA obligations. Understanding this mapping is essential for vendors deciding where certification adds value versus where it introduces unnecessary cost or duplication.
• Designing for Lifecycle Security and Post‑Market Responsibility
  CRA Articles addressing vulnerability reporting, patch delivery, and supply‑chain assurance are a major shift for many organizations. This track highlights what continuous compliance means beyond initial market entry.
• Panel Discussion: AI Act Cybersecurity—Real-World Risks, Requirements, and What Comes Next
  “The EU’s AI Act introduces sweeping new cybersecurity expectations—along with plenty of uncertainty. In this panel discussion, experts will break down how the rules reshape AI deployment, what “compliance” actually requires in practice, and where the biggest technical and organizational challenges lie. Panelists will provide a clear view of the security measures regulators expect, how to implement them without blowing up existing workflows, and what these obligations mean for your company’s risk landscape.”
• The Cost of Compliance: New Realities for Testing, Assessment, and Post-Market Obligations
  As assessment, testing, and post‑market obligations expand, vendors must budget realistically for long‑term compliance. This track addresses the emerging cost structures and tradeoffs organizations will face.
• What Market Surveillance Authorities Expect from Manufacturers under the CRA
  “What manufacturers need to provide under the CRA, information and supporting evidence to enable verification of compliance and assurance of requirements.”
• Too Much Already, Supply Chain Security? A Sensible Approach to Rating True Potential Vulnerabilities Is Needed
  “Threat modeling and product-context analysis to cut through the ~140 daily EUVD CVE filings and distinguish real, exploitable vulnerabilities from inflated worst-case assessments.”
• Vulnerability Management in Consumer IoT: Why No IoT Manufacturer Is Ready for CRA Vulnerability Management (And How to Fix It)
  With increasing scrutiny from Market Surveillance Authorities, manufacturers must be prepared to demonstrate not only secure design, but effective vulnerability monitoring, reporting, and remediation over time.
• Panel Discussion: Navigating Fragmented Global Cyber Regulations
  With overlapping global frameworks—from CRA and EUCC to international standards—this panel addresses whether meaningful harmonization is achievable and what manufacturers can do in the meantime.