atsec.com

What is atsec?

atsec is an independent, privately owned information security company that provides laboratory testing, evaluation, validation and training services. Its work centers on formal certification and assurance schemes rather than general IT consulting: the homepage highlights Common Criteria, FIPS 140-3, EUCC, NESAS and PCI, and its payment security line covers PCI assessments, Swift CSP assessments and EMVCo SBMP evaluations.

Who it is for

• Hardware and software vendors that need a product evaluated or certified before selling into government, enterprise or regulated markets.
• Payment companies and financial institutions working through PCI, Swift CSP or EMVCo requirements.
• Teams that need training or a laboratory partner for cryptographic module and Common Criteria work.

What makes it distinctive

atsec is not just a lab; it is deeply embedded in the standards community. It founded the International Cryptographic Module Conference (ICMC) in 2013 and remains its permanent Platinum Sponsor, created the Crypto Module User Forum (CMUF) in 2014, and helped create the Common Criteria User Forum (CCUF), where it has served on the management board since inception. It also contributes to technical communities behind Protection Profiles such as ND cPP, DSC cPP, DBMS cPP and GPOS PP, and was an active ISO editor for Common Criteria until the ISO/IEC 15408:2022 publication.

It operates from Austin, Texas; Munich, Rome and Stockholm in Europe; and Beijing in Asia, and runs events including FIPS 'n' Chips in Austin and an ICCC presence in Rome.

Practical next step

If you are planning a certification, start from the scheme your target market demands — FIPS 140-3 for cryptographic modules, Common Criteria or EUCC for product assurance, PCI or Swift CSP for payments — then check whether atsec's locations and event schedule line up with your timeline. For a neutral benchmark, compare against other accredited labs such as NIAP recognized facilities or Common Criteria Portal listed evaluation labs.

What types of information security certifications and assessments does atsec offer?

atsec is an independent security lab that focuses on formal testing, evaluation and certification work, rather than general IT consulting. Its service lines cluster around standards-based validation: Common Criteria (CC), FIPS 140-3, EUCC, NESAS and payment-security schemes such as PCI, Swift CSP and EMVCo SBMP. The site's own framing — "Common Criteria, FIPS 140-3, EUCC, NESAS, PCI and more" — is a fair summary of where its expertise sits: regulated, evidence-heavy assurance for products and payment environments.

H3 What each area is for

• Common Criteria (CC) — evaluation of IT products against ISO/IEC 15408, typically for government, defence and enterprise procurement schemes that require a certified protection profile (ND cPP, DSC cPP, DBMS cPP, GPOS PP, application software PPs and similar). Relevant if a customer or tender explicitly demands a CC certificate.
• FIPS 140-3 — validation of cryptographic modules for the U.S. and Canadian government markets, and widely referenced by vendors selling into regulated sectors. This is a specialised, document-intensive process rather than a one-off test.
• EUCC — the European cybersecurity certification scheme, relevant to vendors targeting EU public-sector and critical-infrastructure buyers.
• NESAS — assessment aimed at mobile-network equipment and vendor development processes, used in telecom procurement.
• Payment security — PCI security assessments and consulting, Swift CSP assessment, and EMVCo SBMP evaluation. These suit acquirers, processors, payment terminals, card issuers and anyone in the card or interbank messaging chain who must satisfy a scheme's mandatory audit.

H3 Who tends to need which

H3 Practical next step

Match the scheme to the customer requirement, not the other way round: ask the buyer which certificate or assessment report they will actually accept, then confirm the target version and protection profile before scoping. atsec's own work in user forums and protection-profile development means it can usually tell you early whether your product fits an existing profile or needs a bespoke approach — that conversation is worth having before you commit to a timeline. For background on the crypto-module side of the industry, the International Cryptographic Module Conference and the Crypto Module User Forum that atsec founded are useful neutral resources; see atsec for its service pages and event listings.

How can a payment processor or merchant use atsec's PCI security assessments to meet compliance requirements?

A payment processor or merchant uses atsec's PCI security assessments to have an independent lab test and validate its card-data environment against PCI standards, then use the resulting evidence to demonstrate compliance to acquirers, card brands and business partners. atsec is an independent, privately-owned information security lab offering testing, evaluation, validation and training, and its payment security practice covers PCI assessments and consulting alongside related schemes such as Swift CSP and EMVCo SBMP evaluation atsec.

What the engagement typically involves

• Scoping: identify systems that store, process or transmit cardholder data, plus connected systems, so the assessment covers the right boundary.
• Gap assessment or readiness review: compare current controls against the applicable PCI requirements before a formal assessment, so remediation happens early.
• Formal assessment: the lab tests controls and produces the report or attestation your acquirer or card brand expects.
• Remediation support: fix findings, then re-test where required.
• Ongoing compliance: repeat assessments on the cycle your card brand requires, since PCI compliance is continuous rather than one-time.

How different organizations use it

H3. A concrete scenario A mid-size e-commerce merchant preparing for its annual validation first asks atsec for a readiness review. The lab maps where card data flows, flags missing controls such as encryption or access review, and the merchant fixes those gaps. The formal assessment then runs against a cleaner environment, which usually shortens remediation and avoids a failed report close to a contractual deadline.

Decision criteria

• Confirm which PCI validation you actually need and who will receive the report.
• Ask whether the lab can also cover adjacent schemes you may need, since atsec lists PCI, Swift CSP and EMVCo SBMP under payment security atsec.
• Check the assessor's independence and accreditation for the specific scheme, and whether it works in your region.

Next step: define your cardholder data environment and required validation type, then contact atsec to confirm scope, timeline and the deliverable your acquirer or card brand will accept.

What is the process for getting a cryptographic module validated under FIPS 140-3 or Common Criteria through atsec?

atsec acts as a testing laboratory, so the practical answer is that you engage them as your lab, prepare your module and documentation, and they test and validate it against the relevant standard. The two schemes differ in what they certify and who issues the certificate.

Under FIPS 140-3, atsec performs laboratory testing of a cryptographic module, and the resulting validation is granted through the CMVP (a NIST/CCCS program), not by atsec itself. Under Common Criteria, atsec evaluates a product against a Protection Profile or Security Target, and the certificate is issued by a national scheme. atsec's page evidence lists both, along with EUCC, NESAS and PCI services, and notes its role in developing Protection Profiles such as ND cPP, DSC cPP and DBMS cPP — relevant because CC work is usually scoped to a PP.

A practical sequence

1. Scoping. Decide the standard and the exact product boundary. For FIPS 140-3 this means the module's cryptographic boundary, interfaces and algorithms. For CC it means the target of evaluation and the applicable PP.
2. Gap assessment. Have the lab review your design and evidence against the standard before formal testing, so you fix issues early.
3. Documentation. Prepare the security policy, design documentation and test evidence. FIPS 140-3 requires a module security policy; CC requires a Security Target.
4. Testing and evaluation. The lab runs the required tests and produces the report.
5. Validation or certification. The CMVP or the national scheme reviews and issues the result.

Choosing between them

Next step: contact atsec with your module's cryptographic boundary, target algorithms and intended market, and ask for a gap assessment before committing to full testing. If your buyers are US or Canadian agencies, start with FIPS 140-3; if you need international recognition against a defined Protection Profile, start with CC. For payment-related work, atsec also lists PCI assessments, Swift CSP and EMVCo SBMP evaluation.

atsec is an independent, privately-owned lab with offices in Austin, Munich, Rome, Stockholm and Beijing, and is the founder of the ICMC and the CMUF, which is a useful signal of standing in the crypto module community. For context on the standards bodies involved, see NIST and Common Criteria Portal.

How does atsec's role in organizing the ICMC and CMUF benefit vendors seeking crypto module validation?

atsec's convening role gives vendors a shortcut to the people who actually interpret the rules: labs, scheme agencies, and other vendors who have already been through validation.

What the page shows atsec does

• It founded and named the International Cryptographic Module Conference (ICMC) in 2013, still chairs it, and remains an exclusive permanent Platinum Sponsor; production is handled by an event media partner.
• It created the Crypto Module User Forum (CMUF) in 2014 as a companion to ICMC, hosts the forum portal, and Amazon provides the cloud platform; membership is over 800 and growing.
• It serves as liaison officer between the CMUF and ISO/IEC JTC1/SC27 WG3, the group developing international cryptographic module validation standards.

Why that matters to a vendor

FIPS 140-3 and related validations stall on interpretation, not effort: how a boundary is drawn, what counts as a self-test, how documentation must read. A vendor with no channel to the labs and agencies absorbs that uncertainty as rework. Through ICMC and CMUF, atsec puts vendors in the same room and forum as the evaluators and scheme representatives, and its WG3 liaison role means practitioner questions reach the standards discussion rather than stopping at a help desk.

A practical next step

If you are scoping a first FIPS 140-3 submission, use the conference for orientation and the forum for the specific technical question you cannot resolve internally, then decide whether you need a formal lab engagement. If you are already mid-validation, the forum is more useful for narrow interpretation questions than for general education.

Decision criterion

Choose this route when your bottleneck is regulatory interpretation or finding qualified counterparts. If your bottleneck is simply executing tests you already understand, a direct lab engagement is the faster path. Note that ICMC and CMUF are community venues, not certification bodies; attendance does not substitute for an assessment, and the page describes atsec's convening and liaison work rather than any guaranteed outcome for participants. For the assessment side, see atsec and its payment security services.

What training or bootcamp programs does atsec provide for information security professionals?

atsec's training offerings are closely tied to the certification and validation work it performs as a laboratory. Its bootcamps and events center on cryptographic module validation, Common Criteria evaluation, and payment security standards, rather than broad "intro to cybersecurity" courses.

Likely fit for you if:

• You work on FIPS 140-3 or Common Criteria submissions and want hands-on, standard-specific preparation.
• You are a vendor engineer, lab evaluator, or certification-body staffer who needs practical detail on validation requirements.
• You are in payment security (PCI assessments, Swift CSP, EMVCo) and want training that matches those schemes.

Where it is probably not the right choice:

• You want general security awareness, ethical hacking, or SOC analyst training.
• You need a self-paced online curriculum with broad topic coverage.

The Concrete next step: check atsec's events and services pages for the current bootcamp schedule and prerequisites, then confirm whether a session targets your specific standard (FIPS 140-3, EUCC, or PCI) before registering. If your goal is Common Criteria, the CCUF workshop is a discussion forum rather than a training course — useful for context and contacts, but not a substitute for formal evaluation training.

For comparison, other organizations run related training: NIST publishes the standards themselves and hosts the CMVP program, while Common Criteria Portal lists recognized schemes and labs. Neither replaces atsec's practitioner-oriented bootcamps, but both help you judge whether a given course matches your certification target.