NIAP: U.S. Government Approved Protection Profile - Protection Profile for Enterprise Security Management - Identity and Credential...

Short Name: pp_esm_icm_v2.1

Technology Type: Enterprise Security Management

CC Version: 3.1

Date: 21 November 2013

Preceded By: pp_esm_icm_v1.0

Conformance Claim: None



This protection profile focuses on the aspect of ESM that is responsible for enforcing identity and credential management. Identity and Credential Management products will generate and issue credentials for subjects that reside within the enterprise. They will also maintain the organizational attributes that are associated with these subjects. By providing a means for subjects to validate their identities and determining the relationship these subjects have to the enterprise, an Identity and Credential Management product is able to support enterprise accountability and access control.

The establishment of unique, unambiguous identities is an important foundational capability that enables issuance and management of credentials and authorization attributes. The notion of identity refers to that unique identifier assigned to an individual against which credential and attribute data can be associated.

In order for an individual to be identified as a user within the ESM system, they must be enrolled. Enrollment refers to the act of assigning a unique identifier to a subject, generating and issuing credentials, defining attributes for a user, and propagating that data to any repositories that use it. It is necessary for the TSF to be able to securely transmit this data to those components.

TOEs compliant with this PP are expected to exhibit the following behavior:

  • Provisioning of subjects (enroll new subjects to an organizational repository, associate and disassociate subjects with organizationally-defined attributes)
  • Issue and maintain credentials associated with user identities
  • Publish and change credential status (such as active, suspended, or terminated)
  • Establish appropriate trusted channels between itself and compatible Policy Management and Authentication Server ESM products
  • Generate an audit trail of configuration changes and subject identification and authentication activities
  • Write audit trail data to a trusted repository
  • Securely transmit identity and credential attribute data via a trusted channel

Assigned to the following Validated Products

Related Technical Decisions

  • 0245 – Updates to FTP_ITC and FTP_TRP for ESM PPs
  • 0079 – RBG Cryptographic Transitions per NIST SP 800-131A Revision 1
  • 0071 – Use of SHA-512 in ESM PPs
  • 0066 – Clarification of FAU_STG_EXT.1 Requirement in ESM PPs
  • 0055 – Move FTA_TAB.1 to Selection-Based Requirement
  • 0042 – Removal of Low-level Crypto Failure Audit from PPs

Please forward any questions or comments to

Site Map              Contact Us              Home