The NIT has issued a technical decision for clarification on developer disclosure of software components as part of AVA_VAN.

The third paragraph of chapter 5.6.1.1 Evaluation Activity (Documentation) in ND SDv2.1/2.2 (i.e. para 672 in ND SDv2.1; para 674 in ND SDv2.2) shall be replaced with:

The developer shall provide documentation identifying the list of software and hardware components that compose the TOE. Hardware components should identify at a minimum the processors used by the TOE. Software components include applications, the operating system and other major components that are independently identifiable and reusable (outside of the TOE), for example a web server, protocol or cryptographic libraries, (independently identifiable and reusable components are not limited to the list provided in the example). This additional documentation is merely a list of the name and version number of the components and will be used by the evaluators in formulating vulnerability hypotheses during their analysis.

For further information, please see the NIT interpretation at: https://www.niap-ccevs.org/Documents_and_Guidance/ccevs/NITDecisionRfI202002.pdf

See issue description