A security certificate names one build. A fleet runs a stream of them.

There is a date on the certificate. Nobody in the room reads it.

What they read is the assurance level, printed larger, on the same page, and meaning something considerably narrower than the meeting assumes. Underneath it, in the small type, sits the thing that decides whether any of this is useful to you: a product name followed by a version string. That build was current on the day the laboratory finished. It has been superseded. Possibly twice.

The verdict, since you are deciding rather than browsing. A Common Criteria certificate is real evidence and I would score it. It says that somebody outside the vendor spent months attacking a named build under a written scope and wrote down what they found. That is more than almost anything else in a tender response can claim. It is also not a statement about the software your fleet will be running in month nine, and nowhere in it — not in the certificate, not in the report, not in the annexes — does anybody promise to keep patching the thing.

What the certificate asserts, and it is three things

A named build. A defined configuration, which the scheme calls the Target of Evaluation: the specific product, with specific components switched on, in a specific deployment. And an assurance level, which describes how hard the evaluators were required to look, not how much they found.

Three things, and none of them is "this product is secure". The scope of the examination lives in a document called the Security Target, and the Security Target is drafted by the vendor and reviewed by the laboratory. This is not a scandal. It is how the scheme is built, it is stated openly, and there is no sensible alternative — somebody has to say what is being evaluated. But it has a consequence that procurement almost never draws.

Two products at the same assurance level sat two different exams, and only one of them had to answer the question you care about.

An assurance level is a location, not a score. It tells you where to look, which is the Security Target, and the Security Target tells you what was actually in scope. Put a bare "EAL4" in a scoring matrix as a number and you have compared grades from unrelated papers. Read the two Security Targets side by side and you will usually find that the interesting subsystem — the management agent, the cloud enrolment path, the update channel — was out of scope in at least one of them.

The version problem, which is the entire problem

A fleet does not run a build. It runs a sequence of builds, at a cadence set by somebody else, and every one of them is a change to the thing that was certified.

Schemes know this and have machinery for it: a way for a vendor to ship a fix without the certificate immediately ceasing to describe reality. I have not read the current provisions and I am not going to characterise them from memory, so here is the honest position — the mechanism exists, it is the most decision-relevant paragraph in the whole framework, and I cannot tell you today how quickly it moves or who signs off a patch.

Which makes it the question for the vendor call rather than for me. Ask it in three parts: which version is certified, what happens to the certificate when you ship an out-of-cycle security fix, and how long the gap runs. The third part is the one that produces the pause.

What I can tell you is that the answer matters more than the level on the front page, and that I have never once seen it asked in a tender.

What is not in the document

The support horizon. There is no sentence in a certificate committing the vendor to issue security updates for any period at all. The horizon is the specification — on a five-year purchase it decides whether year four is survivable — and it lives in a different document, usually a lifecycle page the vendor can edit on a Tuesday without telling anybody.

Time to fix. Nothing in an evaluation says how long the vendor takes to ship a patch for something found after the certificate was issued, which is when everything is found.

Your deployment. The evaluated configuration is a clean one. Yours has the EDR hook, the VPN client, the management agent, the thing finance needed in 2023, and a policy set written by three people who have since left. None of that was in scope, and the certificate does not pretend otherwise. The pretending happens later, in a slide.

More is absent — nothing about the supply chain behind the build, nothing about the vendor's own breach history — but three is what a board member carries out of the room, and those three bite.

It is also not new, and the scheme is voluntary

Common Criteria has been issuing certificates since the 1990s and has an ISO number. The European framework changes who administers the scheme and how a certificate travels between member states. It does not change what a certificate asserts, which is the same narrow, honest, badly-read thing it has always asserted. If a vendor's briefing implies that European certification makes their endpoint agent newly trustworthy, the vendor is describing an administrative reorganisation as a security improvement.

And nobody is obliged to hold one. Absence of a certificate is not a finding. It is frequently just a company that priced the evaluation and spent the money on engineers.

What I would actually ask for

The certification report, not the certificate. The certificate is a cover sheet; the report is where the evaluators say what they excluded and why, and it is public. Then the version string, checked against the build in the quote. Then the support horizon, in the contract rather than on the website, with a date on it.

I have handled nothing for this piece and evaluated nothing, and there are no years, article numbers or scheme dates in it for that reason. What I have is the shape of the document, available to anyone who opens one, and the observation that most people quoting it in tenders have read the first page.

The unanswered question is what a certificate is worth on the morning it stops matching the build in the field. Put it to the vendor with the procurement lead in the room. Time the silence.