A professional network encryptor must at minimum hold recognized encryption certifications such as Common Criteria and FIPS 140-2. These certifications prove that a device has been independently tested and meets established security standards. For organizations handling sensitive or business-critical data, this is not a luxury but a baseline requirement. Below, we answer the most frequently asked questions about network encryptor certifications, so you know exactly what to look for when choosing an encryption solution.

Which bodies issue certifications for network encryptors?

Certifications for network encryptors are issued by independent government and standards bodies. The most well-known are the American NIST (National Institute of Standards and Technology) for FIPS certifications, and the international Common Criteria Recognition Arrangement (CCRA) for Common Criteria evaluations. In Europe, ANSSI (France), BSI (Germany), and the Dutch NLNCSA also play a role in national approvals.

These bodies do not act as testing laboratories themselves, but accredit independent evaluation laboratories that carry out the actual assessment. A manufacturer submits its product to such a laboratory, which then tests the device against the applicable standards. Only after a successful evaluation does the product receive an official certificate from the competent authority.

When it comes to network security certifications, it is important to understand that certifications are product-specific. A certificate applies to a specific firmware version and configuration. An update without recertification technically means the certified product has been modified. Professional manufacturers take this into account and communicate transparently about the certified versions of their products.

What is the difference between Common Criteria and FIPS 140-2?

Common Criteria and FIPS 140-2 are both international standards for network encryption, but they measure different things. Common Criteria evaluates the overall security functionality and development process of a product. FIPS 140-2 focuses specifically on the correctness and robustness of the cryptographic implementation. For a professional network encryptor, both certifications are relevant and complement each other.

Common Criteria: security as a whole

Common Criteria (ISO/IEC 15408) is an international framework that evaluates how well a product meets its security objectives. The evaluation examines the design, documentation, test procedures, and development process of the manufacturer. The result is an Evaluation Assurance Level (EAL), a number from 1 to 7 that indicates how thoroughly the evaluation was conducted. The higher the EAL, the more in-depth the assessment.

FIPS 140-2: cryptographic correctness

FIPS 140-2 (and its successor FIPS 140-3) is an American federal standard that specifically evaluates the cryptographic module of a device. It tests whether the encryption algorithms have been correctly implemented, how keys are managed, and how the device responds to physical attacks. There are four levels, with level 1 requiring the lowest and level 4 the highest degree of physical security. For professional network encryption, level 2 or higher is the common requirement.

What assurance level (EAL) is required for critical infrastructure?

For critical infrastructure, a minimum of EAL 4 and in many cases EAL 4+ (augmented) applies in practice. This level requires methodical design, thorough testing, and an independent vulnerability analysis. Government bodies and sector regulators, such as those in the energy, transportation, and healthcare sectors, are increasingly specifying this level explicitly in their procurement requirements and security guidelines.

EAL 4 is the highest level that is economically feasible without requiring the manufacturer to completely redesign the product from a security perspective. Higher levels such as EAL 5 through 7 are used almost exclusively for military applications or systems involving classified government information. For most professional environments including data centers, hospitals, and government institutions, EAL 4+ strikes the right balance between assurance and practical feasibility.

When evaluating a layer 2 encryption certification, also pay attention to the Protection Profile on which the evaluation is based. A Protection Profile describes the specific security requirements for a category of products, such as Ethernet encryptors. A product evaluated against a relevant Protection Profile provides greater assurance than a generic EAL score alone.

Does an encryptor also need to meet national approvals?

Yes, in many sectors and countries a national approval is mandatory in addition to international certifications. In the Netherlands, the NLNCSA (Netherlands National Communications Security Agency) evaluates products used to protect classified information or deployed by vital service providers. In Germany, the BSI fulfills a comparable role; in France, it is the ANSSI. International certifications such as Common Criteria are often a prerequisite, but not always sufficient on their own.

For organizations subject to the NIS2 Directive, the Network and Information Systems Security Act, or sector-specific regulations such as NEN 7510 in healthcare, it is advisable to verify the specific approval requirements for each sector. National approvals may impose additional requirements regarding key management, configuration, or the location where key material is stored.

In practical terms, this means that when purchasing an encryption solution, you should not only ask for the Common Criteria certificate, but also inquire about any national approvals relevant to your sector and country. A manufacturer that is serious about the professional market will be able to provide this overview.

How do certifications influence the choice between encryptors?

Certifications are an objective selection criterion that replaces subjective manufacturer claims with independently verified facts. When choosing between encryptors, certifications help you filter quickly: products without relevant network encryption standards are immediately disqualified for serious applications. From there, you look at which EAL level has been achieved, which Protection Profile was used, and whether national approvals are available for your region or sector.

Beyond the existence of a certificate, its currency also matters. Check which firmware version the certificate applies to and whether the manufacturer maintains an active recertification policy. An outdated certificate on a significantly modified product offers less assurance than a recently certified version.

Also consider the following practical criteria:

• Scope: Was the certificate obtained for the specific use case, such as Ethernet encryption at layer 2?
• Algorithms: Are only approved algorithms used, such as AES-256 and ECDH for key exchange?
• Key management: How are keys generated, stored, and destroyed? Is this part of the evaluation?
• Latency and throughput: Certification says nothing about performance; assess this separately against your network requirements.
• Support and lifecycle: Does the vendor offer long-term support and timely security updates?

Certifications provide assurance about what has been tested, but they do not replace a conversation with a technical specialist who understands your specific environment. Explore the full range of networking products to find solutions that combine certified security with the performance your infrastructure demands.

How we help you choose certified network encryption

At Netways Europe, we guide organizations in selecting and implementing certified encryption solutions that align with their specific security requirements, sector, and infrastructure. Our approach is vendor-independent: we start by examining your situation and translate that into the right solution.

Here is what we do for you in concrete terms:

• Analyze which certification requirements apply to your sector and use case
• Advise on the right combination of Common Criteria, FIPS 140-2, and any applicable national approvals
• Select certified encryptors that fit your network architecture, from layer 1 to layer 2
• Support implementation and key management, including quantum-safe techniques for future-proof security
• Provide guidance throughout the full product lifecycle, including updates and recertification

Want to find out which encryption solution is right for your organization? Get in touch with us and we will be happy to think it through with you.

Related Articles

• What is the difference between enterprise and hyperscale data centers?