Evaluation Assurance Level (EAL)

What is an Evaluation Assurance Level?

An Evaluation Assurance Level (EAL) is a category ranking assigned to an IT product or system after a Common Criteria security evaluation. The level indicates to what extent the product or system was tested.

A product or system must meet specific assurance requirements to achieve a particular EAL. Requirements involve design documentation, analysis, and functional or penetration testing. There are seven EALs. The highest level provides the highest guarantee that the system's principal security features are reliably applied.

Although assurance requirements for each product and system are the same, functional requirements differ. Functional features are created in the Security Target document, which is specifically tailored for each product's evaluation. A higher EAL does not indicate a higher level of security than a lower EAL because they may have different functional features in the Security Targets.