AVA_VAN.2

euce-3100-2026-000001-R-01

## EUCC certificate

### Brightsight Certification Body

| Certificate ID                          | EUCC-3100-2026-7001701-1                                                                                                                                                                                                      |
|-----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Enisa Website Certificate ID            | EUCC-3100-2026-000001-R-01                                                                                                                                                                                                    |
| Date 1 st issue                         | 25/08/2026                                                                                                                                                                                                                    |
| Valid until                             | 24/08/2031                                                                                                                                                                                                                    |
| Certified product                       | MF0AES(H)x0, NT2H2xy1G and NT2H2xy1S, release B0                                                                                                                                                                              |
| TOE type                                | Smart Cards and Similar Devices                                                                                                                                                                                               |
| Certification Report Regulation         | [26-CB-050] EUCC-3100-2026-7001701-1 v4.0 Commission Implementing Regulation (EU) 2024/482 including its amendments                                                                                                           |
| Responsible NCCA Standard               | The Dutch Authority for Digital Infrastructure (RDI) ISO/IEC 15408, Common Criteria for Information Technology Security Evaluation (CC), CC:2022 R1 and ISO/IEC 18045, Common Criteria Evaluation Methodology for Information |
| Assurance level                         | Security Evaluation (CEM), CEM:2022 R1 Substantial, AVA.VAN.2                                                                                                                                                                 |
| Assurance package                       | EAL3 augmented with ALC_FLR.2                                                                                                                                                                                                 |
| Protection Profile conformance          | N/A                                                                                                                                                                                                                           |
| Certificate holder                      | NXP Semiconductors Germany GmbH Beiersdorfstraße 12, 22529 Hamburg, Germany cybersecurity.certification@nxp.com                                                                                                               |
| Supplementary cybersecurity information | https://www.nxp.com/products/nxp-product-information/eucc-certified- products:EUCC-CERTIFIED                                                                                                                                  |
| Evaluation facility                     | SGS Brightsight BV, Delft, The Netherlands                                                                                                                                                                                    |
| Signature                               | Rob Kemper, Director Certification Body                                                                                                                                                                                       |

This certificate applies only to the specific version and release of the product in its evaluated configuration and in conjunction with the complete Certification Report.

The evaluation has been conducted in accordance with the provisions of (EU) 2024/482, the European Common Criteria-based cybersecurity certification scheme (EUCC) and the conclusions of the evaluation facility in the evaluation technical report are consistent with the evidence adduced.

This certificate is not an endorsement of the product by Brightsight CB or any other organisation that recognises or gives effect to this certificate, and no warranty of the product by Brightsight CB or any other organisation that recognises or gives effect to this certificate, is either expressed or implied.

Building digital trust

Brightsight Certification Body, Brassersplein 2, 2612 CT Delft, +31 15 269 2500