The Target of Evaluation (TOE) is Pure Storage, Inc.'s (Pure Storage) FlashArray//CR3, //CR4, //XL, //XR3 and //XR4 Appliances running Purity 6.5. The TOE is an enterprise Network Attached Storage solution that includes a Linux-based operating system, SAN (Storage Area Network) protocols and interfaces (iSCSI, Fiber Channel, SAS), and custom software to provide network storage with high performance, reliability, usability, and efficiency.
","evaluation_configuration":"The TOE consists of the following FlashArray hardware models:
\r\n\r\n
| \r\n Flash Array//X R3 Family \r\n | \r\n\r\n Flash Array//X R4 Family \r\n | \r\n\r\n FlashArray//C R3 Family \r\n | \r\n\r\n FlashArray//C R4 Family \r\n | \r\n\r\n FlashArray//XL Family \r\n | \r\n
| \r\n Flash Array X10 R3 \r\n | \r\n\r\n Flash Array X20 R4 \r\n | \r\n\r\n FlashArray C60 R3 \r\n | \r\n\r\n FlashArray C20 R4 \r\n | \r\n\r\n FlashArray XL130 \r\n | \r\n
| \r\n Flash Array X20 R3 \r\n | \r\n\r\n Flash Array X50 R4 \r\n | \r\n\r\n FlashArray C40 R3 \r\n | \r\n\r\n FlashArray C50 R4 \r\n | \r\n\r\n FlashArray XL170 \r\n | \r\n
| \r\n Flash Array X50 R3 \r\n | \r\n\r\n Flash Array X70 R4 \r\n | \r\n\r\n \r\n | \r\n\r\n FlashArray C70 R4 \r\n | \r\n\r\n \r\n | \r\n
| \r\n Flash Array X70 R3 \r\n | \r\n\r\n Flash Array X90 R4 \r\n | \r\n\r\n \r\n | \r\n\r\n FlashArray C90 R4 \r\n | \r\n\r\n \r\n | \r\n
| \r\n Flash Array X90 R3 \r\n | \r\n\r\n \r\n | \r\n\r\n \r\n | \r\n\r\n \r\n | \r\n\r\n \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) requirements and guidance. The evaluation demonstrated that the TOE meets the security requirements contained in the Security Target. Pure Storage FlashArray//CR3, //CR4, //XL, //XR3, and //XR4 Appliances Running Purity 6.5 was evaluated against the criteria contained in the Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5, April 2017. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 Revision 5, April 2017. The TOE, when installed and configured per the instructions provided in the preparative and administrative guidance, satisfies all the security functional requirements stated in the Pure Storage FlashArray//CR3, //CR4, //XL, //XR3, and //XR4 Appliances Running Purity 6.5 Security Target. The evaluation underwent CCEVS Validator review. The evaluation was completed in March 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report (report number CCEVS-VR-VID11525-2025) prepared by CCEVS.
","environmental_strengths":"The logical scope of the TOE includes those security functions implemented exclusively by the TOE. Each security function is summarized below.
\r\n\r\n