EAL meaning

In legal and procurement practice, EAL (evaluation Assurance Level) describes the depth and rigour of independent security evaluation applied to an IT product under the international Common Criteria (ISO/IEC 15408). Levels range from EAL1 (functionally tested) to EAL7 (formally verified and tested). EAL is used in contracts, tender specifications and supplier due diligence to evidence information security assurance for products (for example, firewalls, operating systems, smartcards and cryptographic devices). It is a standards-based term, not one defined in UK or Irish legislation or case law, but it is widely recognised across England & Wales, Scotland, Northern Ireland and Ireland and internationally through the Common Criteria Recognition Arrangement (CCRA). An EAL rating indicates the assurance of the evaluation process and development controls, not a general “security classification” of a system or a guarantee of legal compliance. Its effect is limited to the certified scope (the Target of Evaluation) and any applicable Protection Profile or Security Target. Typical drafting may require a minimum EAL (e.g., EAL2+ or EAL4+) or an equivalent recognised assurance scheme. Practitioners should verify certificate validity, issuing scheme, augmentation, scope and alignment with the contract’s risk profile and regulatory duties (e.g., UK GDPR, NIS).