®

 

Federal Office
for Information Security °C C {>}
‘Common Criteria

CYBERSECURITY CERTIFICATION

 

    

 

 

 

EIN
uct-3067.2026-0011,

EUCC-3087-2026-0011(*)
‚Administration ID BSI-DSZ-CC-0976-V5-2026 Common Criteria

eHealth: Smart Cards

 

STARCOS 3.7 COS HBA-SMC
Holder of the Certificate: Giesecke+Devrient ePayments GmbH
Prinzregentenstraße 161
81677 München
Evaluation Facility: SRC Security Research & Consulting GmbH
Emil-Nolde-Straße 7 .
53113 Bonn Common Criteria
Deutschland Recognition Arrangement
recognition for components up to EAL 2
Assurance Level: EUCC High with component AVA_VAN.5 and ALC_FLR only
Assurance Package: EAL 4
Assurance Augmentation: ALC_DVS.2, ATE_DPT.2, AVA_VAN.5 and
ALC_FLR.1
PP Conformance: Card Operating System Generation 2 (PP (( D AKKS |
COS G2), Version 2.1, 10 July 2019, BSI-CC- Adkredierungsstelie
PP-0082-V4-2019 one
valid until: 16 June 2031

The ICT Product identified in this certificate and its attached certification report
has been evaluated at the above mentioned notified evaluation facility using the
Common Methodology for IT Security Evaluation (CEM) in application of
relevant state-of-the-art documents for the AVA_VAN components 4 and 5, as
well as application notes and interpretations on advice by the Certification Body
in the versions published at the time the conformity assessment was carried out.
The CC and CEM used for the evaluation of the above mentioned ICT product
are published as ISO/IEC 15408 and ISO/IEC 18045 or as CC:2022 and
CEM:2022.

(*) This certificate applies only to the specific version and release of the ICT
product in its evaluated configuration and in conjunction with the complete
Certification Report and Notification. For details see Certification Report part A
chapter 5.

The evaluation has been conducted in accordance with the provisions of
Commission Implementing Regulation (EU) 2024/482 of 31 January 2024 laying
down rules for the application of Regulation (EU) 2019/881 of the European
Parliament and of the Council as regards the adoption of the European
Common Criteria-based cybersecurity certification scheme (EUCC) and the
conclusions of the evaluation facility in the evaluation technical report are
consistent with the evidence adduced.

Bonn, 17 June 2026
For the Federal Office for Informe ion Security

/ (i
foun fete
Fabian Hodouschek
Head of Certification

   

Godesberger À u D-53175 Bonn - Postfach 20 03 63 - D-53133 Bonn
Phone +49 (0)228 99 9582-0 - Fax +49 (0)228 9582-5477 - Infoline +49 (0)228 99 9582-111
This certificate is not an endorsement of the IT Product by the Federal Office for Information Security or any
other organisation that recognises or gives effect to this certificate, and no warranty of the IT Product by the
Federal Office for Information Security or any other organisation that recognises or gives effect to this
Certificate, is either expressed or implied.

This certificate and its holder are both subject to obligations and monitoring activities as specified in
Commission Implementing Regulation (EU) 2024/482. This certificate, its holder and its issuer are
furthermore subject to compliance rules and supervision by the National Cybersecurity Certification
Authority as established at Federal Office for Information Security, Division S 14, Freital, Email:

vio CC-Zert-304 EUCC-V5.5