The latest meeting of the member countries of the Common Criteria Recognition Arrangement (CCRA), held in Rome, Italy, in late September, focused on IT product security, international evaluation criteria, and European certification approaches.

An expert from the State Scientific and Research Institute of Cybersecurity Technologies and Information Protection (ICTIP) participated in meetings of the Development Board, Executive Subcommittee and Management Committee. The Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale) hosted the event.

Participants reviewed the results of the past six months and discussed amendments to the documents of the Agreement, as well as the rules for interacting with the European Cybersecurity Certification Scheme on Common Criteria (EUCC) and future areas of activity. Representatives of the European Union Agency for Cybersecurity (ENISA) joined the Development Board in light of changes in European legislation.

Particular focus was given to the release of new versions of the ISO/IEC 15408 and 18045 standards in 2026, the development of functional requirements for cryptography and its evaluation, and the preparation of training materials for specialists in assessing trust levels and security profiles. Participants also discussed the development of standards for evaluating artificial intelligence technologies, particularly deep learning systems, as well as the formation of relevant working groups.

A key issue for Ukraine was the discussion about including its representatives in the working group on mutual recognition with the EUCC.

Participation in the CCRA is essential for Ukraine to achieve its strategic goal of establishing a unified national community for evaluating and ensuring the cybersecurity of IT products. This would bring together government agencies, certification bodies, testing laboratories, developers, manufacturers, researchers, and users, uniting them around the internationally recognised Common Criteria. This will help to build trust in IT solutions, develop the national certification system, and integrate it into the CCRA framework.