I am often asked to explain the Common Criteria certification process. If you dig below the surface a bit you will find that Common Criteria certification is very Un-Common. The name originated in the multilateral agreement that established the process in 2000: Arrangement on the Recognition of Common Criteria Certificates in the field of Information Technology Security. The certification is called ‘Common’ criteria because the ‘Arrangement’ was initially agreed to, in common, by the nations of Australia, Canada, Finland, France, Germany, Greece, Italy, The Netherlands, New Zealand, Norway, Spain, the United Kingdom, and the United States of America. It just so happens that these countries often cooperate on global security issues, more so than, for example, with China or the Russian Federation. The value of the certification is the assurance to manufacturers that the product certificate will be accepted by signatories to the Arrangement. In many cases a project engineer or architect may look first to the list of certified products rather than marketing collaterals when designing a secure system. So, if vendors expect to sell into a secure environment, the applicability of Common Criteria certification should be a consideration early in the product roadmap.