A security appliance used in a cloud deployment carries a Common Criteria certification. A manager concludes that the appliance is therefore secure in any configuration the team chooses to deploy. What is the correct interpretation of the certification?

Common Criteria, standardized as ISO/IEC 15408, evaluates a product against a security target or protection profile. The evaluation covers a defined target of evaluation, meaning specific product versions, components and an evaluated configuration, and it is performed to a stated evaluation assurance level that indicates how rigorously the claims were examined. Assurance therefore applies only when the product is deployed in the evaluated configuration, typically described in the vendor's guidance documents; changes to features, versions or settings can take the deployment outside what was evaluated. Claiming the certification proves no exploitable vulnerabilities in any configuration overstates it; evaluation provides confidence in stated security functions, not a guarantee, and it is bound to the evaluated configuration. Common Criteria certifies products, not organizations or entire product lines, so it does not cover the vendor's whole business. Evaluating cryptographic modules specifically is the purpose of FIPS 140 validation, not Common Criteria, which covers the security functions defined in the security target. Exam caveat: the outline lists Common Criteria and FIPS 140 together as system and subsystem product certifications, and they answer different questions. Operational check: compare the deployed version and settings against the certified security target and the vendor's evaluated configuration guide.