A document that stipulates the security functionality that must be included in Common Criteria evaluation to meet a range of defined threats.

Protection Profiles also define the activities to be taken to assess the security function of an evaluated product.