You can see the standard here [1]. Of note are the Security Assurance Requirements (SAR) seen here [2] which discuss the certification process. The Security F

You can see the standard here [1]. Of note are the Security Assurance Requirements (SAR) seen here [2] which discuss the certification process. The Security Functional Requirements (SFR) seen here [3] are more focused on what you are certifying and the sorts of problems you are certifying to solve. As seen in the SAR document [4], AVA_VAN.1 is "basic" with a public vulnerability search. AVA_VAN.2 is the same, but they do a independent pentest. AVA_VAN.3 is "enhanced basic", AVA_VAN.4 is "moderate", AVA_VAN.5 is "high". The EAL levels are listed here [5] and echo the same things I stated about their corresponding AVA_VAN assurance requirements. Historically, EAL4 (the highest level ever achieved by Microsoft for any product in any configuration) said something like: "protects against casual and inadvertent" attackers, so that should probably help you calibrate what "enhanced-basic" means. As for what constitutes "high". You can see a OS certified against the SKPP [6] here [7] at EAL6+. A EAL6+ certification requires AVA_VAN.5 or equivalent. For the SKPP they use a equivalent, AVA_VLA_EXP.4, which requires the NSA to certify that it protects against the NSA (with full source code) as a proxy for a "high attack potential" actor. Yes, that is a certification by the NSA certifying that the NSA can not hack the OS even with full source. This is the OS used on the F-35 and the certification was done to determine if it was acceptable to bet the entire US Air Force on the OS, so the NSA was not playing pretend in this case. That is what constitutes a "high attack potential" actor. So the gap here is: "protects against casual and inadvertent attacks" vs. the literal NSA. The funniest part is that literally everybody says they are being attacked by "nation-state" actors. If they really are being attacked by "nation-state" actors, then they should be using systems that have been proven and certified to protect against them, not systems proven and certified to protect against your roommate in college. [1] https://www.commoncriteriaportal.org/cc/ https://www.commoncriteriaportal.org/cc/ [2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... [3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... [4] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 184 [5] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3.1R5.pdf https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3... Page 33 [6] https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf https://www.niap-ccevs.org/MMO/PP/pp_skpp_hr_v1.03.pdf [7] https://www.commoncriteriaportal.org/files/epfiles/st_vid10119-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid101...