Interpretations

The Common Criteria Interpretation Management Board is tasked with providing interpretations and associated updates to the Common Criteria and its associated methodology. These interpretations are derived from Requests for Interpretations (RIs) that are submitted to the CCIMB.

In response to RIs, the CCIMB may issue a statement, which is a brief response on the proposal set forth in the RI. Alternatively, the CCIMB may issue a Draft Interpretation available for public review and comment. When the comments have been considered, the CCIMB issues a Final Interpretations, which has the effect of changing the criteria/methodology.

The Common Criteria Portal houses all Draft and Final Interpretations.

The following statements provide preliminary feedback on the RIs. Their purpose is to provide an initial response to a question. In cases where the RI arises from a National Interpretation, its purpose is to provide guidance on the direction that the National Interpretation is taking.

• Interim Statement 020 - "SOF for cryptographic algorithms" (see the original RI)
• Interim Statement 054 - "Which environmental security objecties are non-IT?" (see the original RI)
• Interim Statement 099 - "Configuration Items in the Absence of Explicit Scope" (see the original RI)
• Interim Statement 105 - "Evaluation of the TOE Summary Specification" (see the original RI)
• Interim Statement 114 - "Content of PP Claims Rationale " (see the original RI)
• Interim Statement 152 - "Iteration on Assurance Components" (see the original RI)
• Interim Statement 205 - "EAL1 ST" (see the original RI)
• Interim Statement 238 - "CM Systems May Have Varying Degrees Of Rigor And Function" (see the original RI)

The following statements provide final responses to the RIs that will not be progressed to Interpretations.

• Closed Statement 101 - "Method of Audit Prevention May Be Site-Configurable" (see the original RI)
• Closed Statement 102 - "User Attributes to be Bound Should be Specified" (see the original RI)
• Closed Statement 108 - "Application Notes in Protection Profiles are Informative Only" (see the original RI)
• Closed Statement 109 - "Clarification of Audit Records" (see the original RI)
• Closed Statement 110 - "FPT_SEP.2 and FPT_SEP.3 are not Hierarchical" (see the original RI)
• Closed Statement 115 - "Identification of Standards" (see the original RI)
• Closed Statement 139 - "American English is an acceptable refinement" (see the original RI)
• Closed Statement 142 - "Integrated Circuit Assurance" (see the original RI)
• Closed Statement 149 - "Recovery to a Known State" (see the original RI)
• Closed Statement 153 - "Automated or Manual Recovery is Acceptable" (see the original RI)
• Closed Statement 154 - "CC is more than evaluation" (see the original RI)
• Closed Statement 163 - "Use of National Interpretation" (see the original RI)
• Closed Statement 200 - "Empty selections or assignment" (see the original RI)
• Closed Statement 206 - "Point of Clarification" (see the original RI)
• Closed Statement 234 - "The minimum number of each type of security attribute" (see the original RI)
• Closed Statement 237 - "Including Sensitive Information In Audit Records" (see the original RI)
• Closed Statement 248 - "List Of Subjects And Objects Refers To Types Thereof" (see the original RI)