Evaluation Assurance Level (EAL) is associated with which security evaluation framework?

Evaluation Assurance Level (EAL) is associated with which security evaluation framework?

• A. Common Criteria
• B. FIPS 140-2
• C. ISO 27001
• D. ISA/IEC 62443

Answer: (A)

Evaluation Assurance Levels (EALs) measure how thoroughly a security evaluation has been conducted, expressing the depth of independent testing and analysis a product has undergone. This concept is defined within the Common Criteria for Information Technology Security Evaluation, which uses EALs from lower to higher levels (EAL1 to EAL7) along with Security Targets and Protection Profiles to describe and verify security claims. Other standards like FIPS 140-2 focus on cryptographic module security, ISO 27001 certifies an information security management system, and ISA/IEC 62443 targets industrial control systems—none of which use Evaluation Assurance Levels. So, the framework associated with EAL is the Common Criteria.

Evaluation Assurance Levels (EALs) measure how thoroughly a security evaluation has been conducted, expressing the depth of independent testing and analysis a product has undergone. This concept is defined within the Common Criteria for Information Technology Security Evaluation, which uses EALs from lower to higher levels (EAL1 to EAL7) along with Security Targets and Protection Profiles to describe and verify security claims. Other standards like FIPS 140-2 focus on cryptographic module security, ISO 27001 certifies an information security management system, and ISA/IEC 62443 targets industrial control systems—none of which use Evaluation Assurance Levels. So, the framework associated with EAL is the Common Criteria.