CCN-STIC 2002 sets out the LINCE evaluation methodology: minimum evidence, evaluation stages, effort limits and how non-conformities are handled during the process.
It is the guide that defines how a LINCE evaluation is actually carried out. It sets out the minimum evidence, the evaluator's activities and the order in which the work is performed.
It governs the practical evaluation work: minimum evidence, test environment, optional modules, non-conformities, verdict and results.
The methodology also defines 25 days of effort and a maximum 8-week timeline from the start of the evaluation.
What it is
The CCN guide that explains how a LINCE evaluation is carried out in practice.
Who should read it
Manufacturers and technical teams preparing documentation, evidence and the evaluation environment.
What it helps clarify
Minimum evidence, evaluation stages, handling of non-conformities and remediation verification.
When it becomes relevant
Before starting the evaluation process, to make sure the methodology is clearly understood.
The guide itself defines LINCE as a basic security evaluation with bounded scope and effort. It is intended for products seeking entry into the ENS medium category.
The work is not limited to running tests. The evaluation needs enough documentation to make scope, configuration and security functionality assessable without ambiguity or over-reliance on verbal context from the team.
When that documentary baseline is weak, the process becomes slower.
This is a normal part of the process. Identified vulnerabilities are reported as non-conformities so the manufacturer can resolve them. We then verify against the corrected version that the issues have been resolved.
1. Route confirmed
Confirm that LINCE is the correct route and the product should not follow CICLON.
2. Scope locked
Define the exact version, features and limits of the evaluation.
3. Evidence ready
Have the baseline documentation and environment available for the evaluation.
4. Remediation capacity
Make sure the team can react quickly when non-conformities appear.
We prepare the Security Target, review the documentation, carry out the evaluation, report non-conformities and verify remediation before closing the report for the Certification Body.
We handle the full process so your team can stay focused on the product.
If you need the full text or want to verify a specific point in the methodology, you can consult the CCN guide here.
View CCN-STIC 2002 →We analyse scope, documentation and technical readiness before the LINCE evaluation begins.
