A professional network encryptor must at minimum hold recognized encryption certifications such as Common Criteria and FIPS 140-2. These certifications prove that a device has been independently tested and meets established security standards. For organizations handling sensitive or business-critical data, this is not a luxury but a baseline requirement. Below, we answer the most frequently asked questions about network encryptor certifications, so you know exactly what to look for when choosing an encryption solution.<\/p>\n\n\n\n
Certifications for network encryptors are issued by independent government and standards bodies. The most well-known are the American NIST (National Institute of Standards and Technology) for FIPS certifications, and the international Common Criteria Recognition Arrangement (CCRA) for Common Criteria evaluations. In Europe, ANSSI (France), BSI (Germany), and the Dutch NLNCSA also play a role in national approvals.<\/p>\n\n\n\n
These bodies do not act as testing laboratories themselves, but accredit independent evaluation laboratories that carry out the actual assessment. A manufacturer submits its product to such a laboratory, which then tests the device against the applicable standards. Only after a successful evaluation does the product receive an official certificate from the competent authority.<\/p>\n\n\n\n
When it comes to network security certifications<\/a>, it is important to understand that certifications are product-specific. A certificate applies to a specific firmware version and configuration. An update without recertification technically means the certified product has been modified. Professional manufacturers take this into account and communicate transparently about the certified versions of their products.<\/p>\n\n\n\n Common Criteria and FIPS 140-2 are both international standards for network encryption, but they measure different things. Common Criteria evaluates the overall security functionality and development process of a product. FIPS 140-2 focuses specifically on the correctness and robustness of the cryptographic implementation. For a professional network encryptor, both certifications are relevant and complement each other.<\/p>\n\n\n\n Common Criteria (ISO\/IEC 15408) is an international framework that evaluates how well a product meets its security objectives. The evaluation examines the design, documentation, test procedures, and development process of the manufacturer. The result is an Evaluation Assurance Level (EAL), a number from 1 to 7 that indicates how thoroughly the evaluation was conducted. The higher the EAL, the more in-depth the assessment.<\/p>\n\n\n\n FIPS 140-2 (and its successor FIPS 140-3) is an American federal standard that specifically evaluates the cryptographic module of a device. It tests whether the encryption algorithms have been correctly implemented, how keys are managed, and how the device responds to physical attacks. There are four levels, with level 1 requiring the lowest and level 4 the highest degree of physical security. For professional network encryption, level 2 or higher is the common requirement.<\/p>\n\n\n\n For critical infrastructure, a minimum of EAL 4 and in many cases EAL 4+ (augmented) applies in practice. This level requires methodical design, thorough testing, and an independent vulnerability analysis. Government bodies and sector regulators, such as those in the energy, transportation, and healthcare sectors, are increasingly specifying this level explicitly in their procurement requirements and security guidelines.<\/p>\n\n\n\n EAL 4 is the highest level that is economically feasible without requiring the manufacturer to completely redesign the product from a security perspective. Higher levels such as EAL 5 through 7 are used almost exclusively for military applications or systems involving classified government information. For most professional environments including data centers, hospitals, and government institutions, EAL 4+ strikes the right balance between assurance and practical feasibility.<\/p>\n\n\n\n When evaluating a layer 2 encryption certification, also pay attention to the Protection Profile on which the evaluation is based. A Protection Profile describes the specific security requirements for a category of products, such as Ethernet encryptors. A product evaluated against a relevant Protection Profile provides greater assurance than a generic EAL score alone.<\/p>\n\n\n\n Ready for the next step?<\/p>\n Explore our solutions or get in touch with one of our experts directly.<\/p>\n Yes, in many sectors and countries a national approval is mandatory in addition to international certifications. In the Netherlands, the NLNCSA (Netherlands National Communications Security Agency) evaluates products used to protect classified information or deployed by vital service providers. In Germany, the BSI fulfills a comparable role; in France, it is the ANSSI. International certifications such as Common Criteria are often a prerequisite, but not always sufficient on their own.<\/p>\n\n\n\n For organizations subject to the NIS2 Directive, the Network and Information Systems Security Act, or sector-specific regulations such as NEN 7510 in healthcare, it is advisable to verify the specific approval requirements for each sector. National approvals may impose additional requirements regarding key management, configuration, or the location where key material is stored.<\/p>\n\n\n\n In practical terms, this means that when purchasing an encryption solution<\/a>, you should not only ask for the Common Criteria certificate, but also inquire about any national approvals relevant to your sector and country. A manufacturer that is serious about the professional market will be able to provide this overview.<\/p>\n\n\n\n Certifications are an objective selection criterion that replaces subjective manufacturer claims with independently verified facts. When choosing between encryptors, certifications help you filter quickly: products without relevant network encryption standards are immediately disqualified for serious applications. From there, you look at which EAL level has been achieved, which Protection Profile was used, and whether national approvals are available for your region or sector.<\/p>\n\n\n\n Beyond the existence of a certificate, its currency also matters. Check which firmware version the certificate applies to and whether the manufacturer maintains an active recertification policy. An outdated certificate on a significantly modified product offers less assurance than a recently certified version.<\/p>\n\n\n\n Also consider the following practical criteria:<\/p>\n\n\n\n Certifications provide assurance about what has been tested, but they do not replace a conversation with a technical specialist who understands your specific environment. Explore the full range of networking products<\/a> to find solutions that combine certified security with the performance your infrastructure demands.<\/p>\n\n\n\n At Netways Europe, we guide organizations in selecting and implementing certified encryption solutions that align with their specific security requirements, sector, and infrastructure. Our approach is vendor-independent: we start by examining your situation and translate that into the right solution.<\/p>\n\n\n\n Here is what we do for you in concrete terms:<\/p>\n\n\n\n Want to find out which encryption solution is right for your organization? Get in touch with us<\/a> and we will be happy to think it through with you.<\/p>\n\n\n\n Ready for the next step?<\/p>\n Explore our solutions or get in touch with one of our experts directly.<\/p>\n Common Criteria, FIPS 140-2, and national approvals: find out which certifications your network encryptor truly needs.<\/p>\n","protected":false},"author":6,"featured_media":3632,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,55],"tags":[],"class_list":["post-4501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kennisbank","category-security"],"yoast_head":"\nWhat is the difference between Common Criteria and FIPS 140-2?<\/h2>\n\n\n\n
Common Criteria: security as a whole<\/h3>\n\n\n\n
FIPS 140-2: cryptographic correctness<\/h3>\n\n\n\n
What assurance level (EAL) is required for critical infrastructure?<\/h2>\n\n\n\n
Does an encryptor also need to meet national approvals?<\/h2>\n\n\n\n
How do certifications influence the choice between encryptors?<\/h2>\n\n\n\n
\n
How we help you choose certified network encryption<\/h2>\n\n\n\n
\n