Composition means building a system from certified, modular components – a secure base platform combined with trusted add-on modules – while retaining the high assurance of the whole. This modularity allows each element to be designed, certified, and updated independently without compromising overall system trust. By applying composition and modularity together, organizations can reuse certification evidence, isolate changes, and accelerate their time-to-market.  

In the smart card world, this model has enabled multiple applications to coexist securely on a single chip under separate evaluations, as seen with eUICC profiles in telecom and EMV payment applications in banking. 

In the telecom sector, the GSMA’s eUICC Protection Profile explicitly allows a composite evaluation where the secure hardware and Java Card operating system are certified once, and applications such as USIM or ISIM are evaluated independently on top. This enables multiple operators or profiles to coexist securely on the same chip.  

In the payment world, the EMVCo model separates platform certification from application certification: card manufacturers certify the chip and operating system through the Chip & Platform approval process, while banks and payment networks certify their EMV or Common Payment Applications separately.  

Both examples illustrate true composite certification in practice – different trusted applications, developed and certified by different entities, running on a shared certified platform without re-starting the entire evaluation.