I-0436: Compliance Claims Against A Flawed PP

TYPE:                 Guidance
NUMBER:               I-0436
STATUS:               Sent to CCEVS Management and CCIMB for Review

TITLE:                Compliance Claims Against A Flawed PP

FIRST POST:            [cc-cmt 00559]

SOURCE REFERENCE:     CC v2.1 Part 3 Subclause 5.5 ASE_PPC
                      CEM v1.0 Part 2 Subclause 4.4.5 ASE_PPC.1
RELATED TO:           <None>
CCIMB ENTRY:          CCIMB-INTERP-0249

ISSUE:

What should be done when an ST claims compliance to a PP that the evaluation team determines to be flawed?

STATEMENT

When the PP underlying an ST is determined to be flawed, the ST should be appropriately corrected so that it (a) will pass evaluation, and (b) is consistent with the objective and intent of the underlying PP. The PP Compliance Claim should provide justification provided that the corrections are consistent with the PP. The method of determining the appropriate correction should be based on the procedures of the scheme that issued the PP.

SPECIFIC INTERPRETATION

As the ASE criteria are still in flux, a specific change is not provided. However, the basic notion is to add something to the PP compliance requirements along the lines of:

Each PP claim shall identify any new errors identified in the underlying PP, how they were corrected, and how the correction does not violate the intent of the PP.

SUPPORT:

The basic notion underlying this guidance is that a flawed PP should not hinder the evaluation of STs. Thus, when such a problem is identified, it should be corrected in such a manner as to maintain the intent of the PP while fixing the flawed words.

For PPs issued or evaluated under the CCEVS evaluation scheme, such problems should result in an Observation Report that is submitted to CCEVS. CCEVS will consult with the authors of the PP (if possible) and/or the PP Review Board to determine the original intent, and will issue a decision on how to correct the problematic requirements in the context of the ST's evaluation. Such an OR then serves as justification that the PP compliance claim is still valid even with the change.