Yup. Want to have a laugh? Here is the Apple iOS certification report [1]. On PDF page 26 (document page 21) they describe the rigorous AVA_VAN.1 vulnerability

Yup. Want to have a laugh? Here is the Apple iOS certification report [1]. On PDF page 26 (document page 21) they describe the rigorous AVA_VAN.1 vulnerability analysis certification process they faced. The evaluation team basically typed in: "ios vulnerabilities" into Google and then typed in "ios iphone" into the NVD and verified that all of the search results were fixed. AVA_VAN.1 certification please. To explain why, AVA_VAN.1 does not require a independent security analysis, it only requires a survey of the public domain for known vulnerabilities [2]. You need AVA_VAN.2 (which is only required in EAL2 and EAL3) before they actually attempt to look at for vulnerabilities themselves. [1] https://www.commoncriteriaportal.org/files/epfiles/st_vid11237-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid112... [2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 154