ACME makes a product that is used in some security-sensitive applications. There are no particular security regulations or industry standards in the domain of this product. ACME's business arm would like to claim that “we're 150% more secure than our competitors”. ACME's customers would be more prone to believing that if the claim was backed by some kind of independent assessment. ACME's ethical arm would appreciate if such an independent assessment did in fact validate something about ACME's product's security.
It seems that the answer is to have ACME's product undergo some form of certification, the most obvious candidate being a Common Criteria certification. This looks like a daunting process; there isn't even an existing protection profile to hang onto, and CC certification introduces a large delay between the time a product version is finalized and the time it can be released. Also CC seems to validate methodology more than security. Are these somewhat uninformed opinions of CC founded? Are there alternatives to CC?
The French government has recently introduced a “first-level security certification” (CSPN), which is based on a lighter approach than CC: roughly speaking, a government-approved evaluator spends a predefined number of man-days doing gray-box attacks with respect to a PP. This would seem like an ideal solution, except that CSPN is completely unknown outside France. Is there a more internationally recognized certification that is analogous to CSPN?