FAQ Manufacturers

To qualify for the HIGH category, and in the case of a product, a Common Criteria Certification is required.

To qualify for the MEDIUM category, a LINCE certification is required.

If other types of certifications are provided, they will be reviewed to determine their validity for inclusion in the CPSTIC.

The objective of this continuous qualification strategy is to keep the product/service included in the CPSTIC up to date.

The DAR is a document detailing the changes between the qualified product and the software version/hardware model to be included in the Catalog, analyzing whether or not they affect the product's security functions. The DRA must be signed by the manufacturer, ensuring that the information included is accurate and complete.

Yes. If a product is already in the catalog, a new version or new hardware models can be included, as long as the changes are minor and do not affect its security features. To do so, you must send us a Differential Analysis Report (DAR).

The first thing you should analyze is whether the product/service provides security features. Once analyzed, it's possible that no family exists, but it could be included in the CPSTIC. In the corresponding inclusion request form, you must select "Other tools" and submit a Security Declaration proposal tailored to the functionalities offered by your product/service.

Sometimes, the certification provided does not cover all the requirements demanded by the family or families being certified. To resolve this situation, so-called Complementary STIC Assessments are used. They are based on the LINCE methodology and serve to verify whether the candidate product meets the required safety requirements that were not included in the initial certification.

Yes. The Safety Declaration associated with said certification must be attached to the initial documentation. If inclusion in the CPSTIC is positively evaluated, it will become effective once certification is obtained. No product may be included in the Catalog before obtaining certification.

The validity period of the qualification will be determined based on whether it is a product or a service.

If it's a product, the validity period will be two (2) years, and it can be extended up to five (5) years, counting from the date the certificate is issued.

For example, if I include my product with a 2021 CC, I can have it in the CPSTIC until 2026 at the latest.

If it's a service, the validity period will be two years, and requalification will be required once the corresponding validity period has expired.

Of course, we'll answer any questions you may have at