· CYBSER · 2 min read
LINCE 2.1: changes to evaluation effort and timelines
The updated CCN-STIC 2001 and 2002 guides change how evaluation effort and duration are calculated. Here is what changes when planning your evaluation.
The LINCE guides have been updated, with a change to evaluation timelines. The October 2026 version 2.1 updates to CCN-STIC 2001 and 2002 move away from the general limit of 25 days of effort and 8 weeks. If you are preparing for certification, planning now starts with what will be evaluated and how much work your product needs.
Where the 25-day reference still applies
The calculation starts with the baseline specified in the applicable taxonomy (CCN-STIC 140). Where the taxonomy does not set one, the reference is 25 person-days. A person-day means one day of work by one person. It does not necessarily mean one calendar day.
The calculation is set out in the Security Target (ST) and includes adjustments and optional modules, with a reference of 5 person-days per module. A different amount may be proposed for these modules with justification.
The laboratory reviews the calculation, and planning requires authorisation by the Certification Body.
How the maximum duration is calculated
The new rule is 3 calendar days for each proposed person-day of effort. An evaluation of 25 person-days has a maximum duration of 75 calendar days. One of 35 has a maximum of 105. Your project will not necessarily take that long: these are the maximum durations set by the guide.
The period starts on the date agreed with the Certification Body. If the evaluation is interrupted by an applicant delay, such as late delivery of evidence, the period may be paused after prior notification.
This change aligns with the new editions of the taxonomies, which specify different levels of effort depending on the product type and evaluation scope. For example, in the new edition of the E.5 TLS VPN taxonomy, the basic module specifies 25 days for the client, 35 for the server and 60 when both are included in the evaluation. Our article on the 2026 CPSTIC taxonomy requirements covers further examples.
If you are considering certification, we help you identify the product family, agree the scope and define and justify the effort required. From there, we prepare the ST and plan your LINCE evaluation.
See our guides to CCN-STIC 2001 and CCN-STIC 2002 for more detail.
You can read the changes in the official guides, updated in October 2026:
- Official CCN-STIC 2001, section 4.6.2.
- Official CCN-STIC 2002, sections 3.1, 4.1 and 6.