The Ivanti Endpoint Manager Mobile (EPMM) System is a distributed TOE and includes two software builds: the Ivanti MDM Server and the Ivanti MDM Client. An EPMM implementation supports one instance of the MDM Server and one or more instances of the MDM Agent.
\r\nIvanti Endpoint Manager Mobile (EPMM) is mobile management software that enables Administrators to set policies for mobile devices, applications, and content. EPMM enables mobile device management, mobile application management, and mobile content management capabilities and includes the following tools:
\r\nEPMM enables administrators to securely manage the lifecycle of mobile devices and mobile applications, from registering a device with Ivanti EPMM, to retiring the device from EPMM management. Users of an Ivanti EPMM managed device can securely access corporate data, email, and mobile apps that are controlled and distributed using Ivanti EPMM.
","evaluation_configuration":"The following two figures depict the two TOE components in their operational environment. They provide a rough diagram of the software TOE and identify the security enforcing software modules. The TOE is depicted in turquoise (hash and solid). The figures include a capital letter identifying each of the communication paths.
\r\n
Figure 1: The TOE and the MDM Server’s Operational Environment
Figure 2: The TOE and the MDM Agent’s Operational Environment
The following table identifies the servers, workstations, and hardware required for the EPMM MDM Server and MDM Agent components of the TOE.
\r\nTable 2: The Ivanti EPMM Device/Host/Server Operational Environment
\r\n| \r\n Components \r\n | \r\n\r\n Mandatory \r\n/Optional \r\n | \r\n\r\n TOE Components \r\n | \r\n\r\n Description \r\n | \r\n
| \r\n CRL Servers \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Both \r\n | \r\n\r\n A Certificate Revocation List (CRL) Server used to validate X.509 certificates. Communication is via an unprotected channel. \r\n | \r\n
| \r\n DNS Server(s) \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Both \r\n | \r\n\r\n A Domain Name System (DNS) Server used to resolve Fully Qualified Domain Names (FQDNs) to IP addresses for certificate validation. A DNS Server is required in both TOE environments. The TOE components communicate with DNS Servers on an unprotected path. \r\n | \r\n
| \r\n MDM Agent Host \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n MDM Agent \r\n | \r\n\r\n The device hosting the MDM Agent component of the TOE. The host is a Galaxy S22 Ultra 5G device running Android 13 OS or a Galaxy S23 Ultra 5G device running Android 14 OS. The MDM Agent software component of the TOE must be installed on the host and configured in the CC evaluated configuration. Refer to Section 1.6.1.3 for specific details of the MDM Agent Host. \r\n | \r\n
| \r\n MDM Server Host \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n MDM Server \r\n | \r\n\r\n The device hosting the MDM Server software component of the TOE. The host is a Dell PowerEdge R640 Server with hypervisor VMware ESXi 7.02 running Oracle Linux 8.9 Operating System. The MDM Server software component of the TOE must be installed on the host and configured in the CC evaluated configuration. Refer to Section 1.6.1.2 for specific details of the MDM Server Host. \r\n | \r\n
| \r\n MDM Server Remote Workstation(s) \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n MDM Server \r\n | \r\n\r\n The MDM Server component of the TOE supports two GUI interfaces that enable Administrators to manage and monitor the TOE. Administrators access these interfaces via remote workstations using HTTP over TLS (HTTPS). \r\nThe OE requires one or more remote workstations connecting to the MDM Server’s Admin Portal administrator interface and the MDM Server’s System Manager administrator interface. \r\n | \r\n
| \r\n OCSP Servers \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Both \r\n | \r\n\r\n An Online Certificate Status Protocol (OCSP) Server used to validate X.509 certificates. Communication is via an unprotected channel. \r\n | \r\n
| \r\n SMTP Server \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n Both \r\n | \r\n\r\n The MDM Server supports sending Alerts if a specific event occurs. One type of Alerts is an email message. Therefore, both TOE components must have access to a Simple Mail Transfer Protocol Server (SMTP). Communication is via an unprotected channel. \r\n | \r\n
| \r\n Audit Server \r\n | \r\n\r\n Mandatory \r\n | \r\n\r\n MDM Server \r\n | \r\n\r\n A Audit Server is required by the MDM Server to enable the MDM Server to transfer audit Events. Communication is via mutual authenticated TLS. \r\nThe Audit Server must support Syslog and HTTPS. \r\n | \r\n
","security_evaluation_summary":"
The evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Endpoint Manager Mobile (EPMM) System 12 Target of Evaluation (TOE) was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the \"Ivanti Endpoint Manager Mobile (EPMM) System 12 Common Criteria Administrative Guidance\", satisfies all of the security functional requirements stated in the Endpoint Manager Mobile (EPMM) System 12 Security Target. The project underwent CCEVS Validator review. The evaluation was completed in October 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The MDM Server has the capability to create and retain audit logs for significant security incidents in real-time. These logs are securely stored by the MDM Server and can be accessed for review by authorized administrators. Additionally, the MDM Server exports these audit logs to an Audit Server.
\r\nThe MDM Agent possesses the capability to produce audit logs for events pertaining to security and can signal when it has been registered and when policies are effectively implemented onto it.
\r\nBoth the MDM Server and MDM Agent incorporate cryptographic modules equipped with certified algorithms to perform cryptographic operations. These operations encompass asymmetric key generation and exchange, encryption/decryption, cryptographic hashing, and keyed-hash message authentication. To support these functions adequate mechanisms for random bit generation, the destruction of keys and protected data are provided.
\r\nThe cryptographic functionality is used to implement security communication protocols: TLS and HTTPS used for communication between the MDM Server and the MDM Agent, the Audit Server, as well as between the MDM Server and a trusted, remote administrator.
\r\nThe MDM Server requires that users, whether administrators or mobile device users (MD users), to be authenticated before any security related functionality is allowed. MD Users are required to enroll their device with the MDM Server using an MDM Agent.
\r\nBoth the MDM Server and the MDM Agent are required to utilize X.509 certificates which includes the validation check of the certificate in relation with the TLS connection in order to create a secure connection with the MDM Server and MDM Agent. This will also occur with connections between the MDM Server and administrators that have remote access via the web interface and the Audit Server.
\r\nThe MDM Server allows for two distinct roles: that of the Administrator and the mobile device user (MD User). The Administrator interacts with the MDM Server and MD User interacts with a device that hosts the MDM Agent. The MDM Server also supports user access to management functions by defining their role and the capabilities each role is allowed.
\r\nThe MDM Server presents all functionality needed to manage its own security functions as well as to manage the mobile device policies that are transmitted to MDM Agents. This ensures that security management functions are only allowed use by authorized administrators. MD Users are only allowed necessary functions such as their enrolling in the MDM Server.
\r\nThe MDM Agent holds functionality needed to create a secure connection with and enrollment in the MDM Server, implement any policies received from an appropriately enrolled MDM Server, and be able to account the results of applying such policies.
\r\nThe MDM Server and Agent act together in order to ensure all security related interactions between their components are protected from modification and disclosure by any undesirable entities.
\r\nThe MDM Server contains the ability to perform self-tests to make sure that appropriate functionality is taking place and is maintained. The MDM Server is able to verify cryptographically during start-up that its executable image has not been tampered with or corrupted.
\r\nThe MDM Server and MDM Agents utilize digital signatures to verify trusted updates which mitigate the risk of malicious changes to the TOE.
\r\nThe MDM Server supports two GUI administrator interfaces that support two Administrator interfaces.
\r\nThe MDM Server uses TLS/HTTPS to create a secure communication channel between itself and remote administrators. It uses TLS to communicate with an Audit Server. The MDM Server also uses TLS to connect with MD Users over a protected channel via their MDM Agent on their mobile device.