PD-0082: PP compliance with portion of TOE SFR in Environment

This decision represents a long-term technical decision based on an OD, and may not be the same as the final results of the source OD. With respect to published criteria documentation and scheme documents, it provides suggested guidance on evaluation direction, but is not authoritative. Authoritative decisions are provided through the published criteria documents and published scheme and international interpretations thereof. With respect to published PPs, PDs are authoritative corrections to the PP, based on input from the PP author (if available), that are in force until the publication of the next revision of that PP.

Issue

When claiming compliance with a Protection Profile, what portion of an SFR identified in the PP for the TOE can the ST allocate to the environment?

Resolution

If PP compliance is desired, an ST must use the specific TOE/environment delineation called out in the PP. This is true even if other delineations will accomplish the overall security goals of the PP.

Support

This resolution does not speak to the viability of a particular TOE/environment combination in solving real-world needs, nor to the internal correctness of the ST apart from PP claims. Instead, this speaks to the validity of claiming compliance with a Protection Profile that defines a different TOE/environment delineation from that called out in the PP.

To comply with a PP, all SFRs identified in the PP for the TOE must be substantially accomplished by mechanisms within the TOE of the ST. It is, however, acceptable for general support to be provided by the environment; for example, the environment may provide necessary physical protections or may provide an execution space in which the software mechanisms of the TOE run.

Modification History:

2003-01-15

Modified to delete the original second paragaraph of the resolution that permitted exceptions, and to delete the original last paragraph of rationale, which spoke about SOF. (January 2003 ODRB Agenda Item 4.b.i)

2004-08-12

Updated effective date to reflect the date the PD was issued. (August 2004 NIB 6.c.xiv)

References:

• CEM v1.0 Part 2 ASE_REQ.1-16
• CC v2.1 Part 3 ASE_REQ.1.10C
• CEM v1.0 Part 2 ASE_REQ.1-17
• CC v2.1 Part 3 ASE_REQ.1.11C
• CEM v1.0 Part 2 ASE_TSS.1-10
• CC v2.1 Part 3 ASE_TSS.1.9C
• CEM v1.0 Part 2 ASE_TSS.1-11
• CC v2.1 Part 3 ASE_TSS.1.10C
• CEM v1.0 Part 2 Appendix B.8

Related NIs:

• None

Related CCIMB-INTERPs:

• None

Source OD: 0205