Got this response back from Cisco, looks like CSR1000v running IOS XE 3.16.3 will be the release to aim for deployment to meet CC assurance. Expected some time toward the end of the year (though not sure of that is calendar or fiscal.
"Common Criteria for the “VPN Client EP (CSfC)” function is in process for XE 3.16.1.
More General CC support is planned for XE 3.16.3."