Security certifications for Apple Applications

This article contains references for key product certifications, cryptographic validations, and security guidance for Apple native applications provided as part of an operating system.

In addition to the general certificates listed here, other certificates may have been issued in order to demonstrate specific security requirements for some markets.

Contact us at security-certifications@apple.com if you have any questions.

The following documents can be useful in context with these certifications and validations:

• Apple Platform Security

For information on public certifications related to Apple Internet Services, see:

• Apple Internet Services Certifications

For information on public certifications related to Apple applications, see:

• Security certifications for Apple applications

For information on public certifications related to Apple operating systems, see:

• Product security certifications for iOS

• Product security certifications for iPadOS

• Product security certifications for macOS

• Product security certifications for watchOS

• Product security certifications for tvOS

For information on public certifications related to hardware and associated firmware components, see:

• Security certifications for SEP (Secure Key Store)

• Security certifications for T2 and its firmware

Cryptographic module validations

All Apple FIPS 140-2/-3 Conformance Validation Certificates are on the CMVP web site. Apple actively engages in the validation of the CoreCrypto User and CoreCrypto Kernel modules for each major release of an operating system. Validation of conformance can only be performed against a final module release version and formally submitted upon OS public release.

The CMVP maintains the validation status of cryptographic modules under four separate lists depending on their current status. The modules might begin in the Implementation Under Test List and then proceed to the Modules in Process List. Once validated, they appear on the validated cryptographic modules list, and after five years are moved to the "historical" list.

In 2020, the CMVP adopt the international standard, ISO/IEC 19790, as the basis for FIPS 140-3.

For more information about FIPS 140-2/-3 validations, see Apple Platform Security.

Apple’s native applications invoke the cryptographic modules that have been validated as part of the underlying platform. These are shown in the table below.

Common Criteria (CC) certifications

NIAP typically maintain evaluations on the Product Compliant List for two years, after which they are reviewed for conformance with the current assurance maintenance policy. The CC Portal may maintain products on the certified product list for five years.

The Common Criteria Portal lists certifications that can be mutually recognized under the Common Criteria Recognition Arrangement (CCRA).

For more information about Common Criteria certifications, see Apple Platform Security.

In 2018, Apple initiated application security evaluations for key applications running on iOS 11 with the Safari browser and Contacts applications. Apple continued these evaluations on applications running on iOS 12 in 2019 and iOS 13 in 2020.

Apple will pursue further security evaluations of key applications on future operating system releases.