What Is EAL? Security Definition

Think of EAL like a restaurant health inspection rating. A restaurant with a rating of A has been inspected and meets basic cleanliness standards. A restaurant with a rating of 100 out of 100 has been examined in much greater detail, every ingredient is checked, every surface is tested for bacteria, and every employee's hygiene is verified. You would trust the 100-rated restaurant more for a high-risk meal, but it also cost much more to get that rating.

EAL works the same way for security products like firewalls, encryption software, or operating systems. The Common Criteria standard, which is an international agreement on how to evaluate security, defines seven levels of assurance. EAL1 means the product was tested just enough to show it works as advertised. EAL7 means the product was designed, built, and tested using formal mathematical proofs and extreme scrutiny.

Most commercial products you buy are evaluated at EAL2, EAL3, or EAL4. Government and military systems often require EAL5 or higher. The key point is that a higher EAL does not necessarily mean the product is more secure in practice, it means the product has been more thoroughly verified to meet its security claims. A simple padlock that is EAL4 certified is still not as secure as a bank vault, but you know exactly how well it resists picking and cutting because of the testing.

In the IT world, when you see a product advertised as "EAL4+ certified," it means that the product has passed a structured set of tests conducted by an accredited laboratory. The testing covers things like how the product handles user authentication, how it protects data, and how it recovers from failures. The EAL rating helps you compare products, but you must also check what specific security features were actually tested, because two products with the same EAL may have been evaluated against completely different security requirements.

The Evaluation Assurance Level (EAL) is a category ranking defined within the Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408). It provides an increasingly rigorous set of assurance requirements that a product, known as a Target of Evaluation (TOE), must satisfy to claim a specific level. The levels range from EAL1 (functionally tested) to EAL7 (formally verified design and tested).

Each EAL corresponds to a specific package of assurance requirements drawn from Part 3 of the Common Criteria standard. These requirements include areas such as configuration management, delivery and operation, development, guidance documents, life-cycle support, security testing, vulnerability analysis, and assurance maintenance. A product does not simply "pass" an EAL, it must undergo evaluation by a licensed Common Criteria Testing Laboratory (CCTL) against a Security Target (ST) document that describes the product's security functionality and the claimed EAL.

The actual evaluation process involves several phases. First, the vendor develops the product and writes the Security Target. Then, the CCTL reviews the design documentation, source code, and functional tests. The lab performs its own independent testing to confirm that the product behaves as described. For higher EALs (EAL5 and above), formal models and semiformal or formal design representations are required. The entire process can take months or years and cost hundreds of thousands of dollars.

It is critical to understand that EAL does not measure the absolute security of a product. Rather, it measures the rigor of the evaluation process. A product evaluated at EAL4 may actually be more secure than an EAL6 product if the EAL6 product's Security Target specifies only a narrow set of security functions. The specific Security Target and the Protection Profile (a set of security requirements for a type of product) define what was tested. For example, an EAL4+ operating system might have passed testing for user authentication and access control, while an EAL5 firewall might only have been tested for packet filtering rules.

In practice, most enterprise security products are evaluated at EAL2, EAL3, or EAL4. EAL4 is often the highest level that is economically feasible for commercial products, because EAL5 and above require significant design formality and cost. Government agencies, especially in defense and intelligence, often mandate EAL5 or EAL6 for systems handling classified information. The Common Criteria Recognition Arrangement (CCRA) allows evaluations performed in one participating country to be recognized by others, which simplifies international procurement.

Common criteria evaluations also involve the concept of an Evaluation Assurance Level augmented, often written as EALx+, where the plus indicates additional assurance requirements beyond the base level. For example, EAL4+ might include added vulnerability analysis or penetration testing. Security professionals evaluating products for procurement should always review the actual Security Target and the evaluation report, not just the EAL number, to understand exactly what was tested and what was not.

EAL matters because it provides a standardized way to evaluate and compare the security of IT products. Without EAL, every vendor could claim their product is "secure" using different, often meaningless, metrics. EAL gives security professionals a common language to discuss assurance. When you are responsible for selecting firewalls, operating systems, or encryption modules for an organization, knowing the EAL rating helps you make informed procurement decisions.

In practical IT contexts, EAL ratings are especially important for regulated industries. Government agencies, financial institutions, and healthcare organizations often have compliance requirements that mandate certain EAL levels for specific systems. For example, the U.S. Department of Defense might require that any operating system used on classified networks be evaluated at EAL4 or higher. A company bidding on a government contract must ensure their products carry the correct EAL certification, otherwise they cannot be used.

EAL also matters because the evaluation process itself improves product quality. The rigorous documentation and testing required for even EAL2 forces vendors to fix security issues they might have otherwise overlooked. The vulnerability analysis phase of evaluation often uncovers flaws that the vendor then patches. So even if a product is never sold into a market that requires EAL certification, the development discipline from preparing for evaluation can benefit all users.

EAL is a key part of the risk management process. A security architect evaluating a product for an enterprise network can look at the EAL rating as one factor in the overall risk assessment. A product with EAL4 gives higher assurance than one with EAL2, which might justify a lower level of additional compensating controls. However, it is important to remember that EAL is not a guarantee of security, it is a measure of assurance. A product can earn a high EAL and still have devastating vulnerabilities if those vulnerabilities were not covered by the Security Target.

EAL questions on the CISSP exam often take the form of scenario-based questions where you must select the appropriate EAL level for a given situation. For example, a question might describe a company that needs to select a firewall for a low-risk internal network. The correct answer would be EAL2 or EAL3, because those levels provide adequate assurance for a low-risk environment without excessive cost. Another question might describe a military system handling classified data, and the correct answer would be EAL5 or higher.

Another common pattern is the "what is wrong with this situation" question. The exam might present a scenario where an organization selects an EAL7 product believing it is inherently more secure than an EAL4 product from a different vendor. The question will ask you to identify the flaw in this reasoning. The correct answer is that the EAL rating depends on the specific Security Target, and the EAL7 product may have been evaluated against a much narrower set of requirements, making it potentially less secure in practice than the EAL4 product with a broader Security Target.

Questions may also ask you to interpret the meaning of a product's certification. For example, a product might be listed as "EAL4+ certified." The exam may ask what the "+" means. The answer is that it indicates the product meets additional assurance requirements beyond the base EAL4 package, such as added vulnerability analysis. You might also see questions about the Common Criteria Recognition Arrangement (CCRA) and which countries recognize each other's evaluations.

There are also questions about the evaluation process itself. You might be asked which party performs the evaluation (an accredited independent laboratory), who defines the Security Target (the vendor), and who develops the Protection Profile (often a consortium or government agency). These questions test your understanding of the roles and responsibilities in the Common Criteria framework.

Finally, some questions test your knowledge of the specific EAL levels. You might need to know that EAL1 involves only functional testing, EAL2 includes vulnerability analysis, EAL3 adds environmental controls, EAL4 requires structured design, EAL5 requires semiformal design, EAL6 requires semiformal verification, and EAL7 requires formal verification. However, you will not need to memorize these in extreme detail, focus on the high-level progression and the key differences between the lower (1-4) and higher (5-7) levels.

The Evaluation Assurance Level is a cornerstone of security product procurement and risk management. As a security professional, you will often be asked to evaluate whether a product's EAL certification meets your organization's security requirements. The first step is to locate the product's certificate and read the associated Security Target (ST). The ST is usually available on the vendor's website or through the Common Criteria portal. Do not rely solely on the EAL number; you must understand the scope.

When reviewing an ST, look for the Security Functional Requirements (SFRs) that were evaluated. For example, if you need a firewall that enforces access control lists and logs traffic, ensure those SFRs are listed in the ST. If the ST only covers packet filtering but not logging, the EAL rating does not guarantee the logging works correctly. Also check the assurance requirements to see what level of vulnerability analysis was performed. For EAL2, the vulnerability analysis is basic. For EAL4, it includes a systematic search for vulnerabilities. For EAL6, it includes a thorough analysis with formal methods.

In practice, many product vendors list an EAL rating but do not make the ST easily accessible. This is a red flag. A legitimate evaluation always produces a public certification report and ST. You can search the Common Criteria portal (commoncriteriaportal.org) to verify the certification. If a product claims EAL4 but you cannot find the certificate, do not trust the claim.

When deploying an evaluated product, it is critical to use it in the exact configuration that was evaluated. The evaluation covers specific hardware, firmware, software versions, and configurations. If you change any setting or apply a patch, the assurance may no longer be valid. The product's security guidance documentation (another evaluation deliverable) will describe the evaluated configuration. Always follow that guidance.

One common pitfall is that the evaluation only covers a specific version. If the vendor releases a major update, the new version may not be certified. You must track the certification status of each version you deploy. Some organizations require that all security products maintain valid certifications, so they will only purchase products with current certificates. Security professionals should work with procurement and legal teams to include certification requirements in vendor contracts.

Finally, remember that EAL is just one factor. Combine it with other assurance measures like penetration testing, vulnerability scanning, and vendor reputation. A product that is EAL4 certified but has known unpatched vulnerabilities in its core functionality is still a risk. Use EAL as part of a holistic security assessment, not as a shortcut to skip other evaluation steps.