NIAP: U.S. Government Approved Protection Profile - Protection Profile for Enterprise Security Management - Identity and Credential...

NIAP Oversees Evaluations of Commercial IT Products for Use in National Security Systems
Questions?  We're here to help
  NIAP  »»  Protection Profiles  »»  Approved PPs  »»  Details  
U.S. Government Approved Protection Profile - Protection Profile for Enterprise Security Management - Identity and Credential Management Version 2.1

Short Name: pp_esm_icm_v2.1

Technology Type: Enterprise Security Management

CC Version: 3.1

Date: 2013.11.21

Preceded By: pp_esm_icm_v1.0

Conformance Claim: None

Protection Profile [PDF]

Control Mapping [PDF]



This protection profile focuses on the aspect of ESM that is responsible for enforcing identity and credential management. Identity and Credential Management products will generate and issue credentials for subjects that reside within the enterprise. They will also maintain the organizational attributes that are associated with these subjects. By providing a means for subjects to validate their identities and determining the relationship these subjects have to the enterprise, an Identity and Credential Management product is able to support enterprise accountability and access control.

The establishment of unique, unambiguous identities is an important foundational capability that enables issuance and management of credentials and authorization attributes. The notion of identity refers to that unique identifier assigned to an individual against which credential and attribute data can be associated.

In order for an individual to be identified as a user within the ESM system, they must be enrolled. Enrollment refers to the act of assigning a unique identifier to a subject, generating and issuing credentials, defining attributes for a user, and propagating that data to any repositories that use it. It is necessary for the TSF to be able to securely transmit this data to those components.

TOEs compliant with this PP are expected to exhibit the following behavior:

  • Provisioning of subjects (enroll new subjects to an organizational repository, associate and disassociate subjects with organizationally-defined attributes)
  • Issue and maintain credentials associated with user identities
  • Publish and change credential status (such as active, suspended, or terminated)
  • Establish appropriate trusted channels between itself and compatible Policy Management and Authentication Server ESM products
  • Generate an audit trail of configuration changes and subject identification and authentication activities
  • Write audit trail data to a trusted repository
  • Securely transmit identity and credential attribute data via a trusted channel

This U.S. Government Approved Protection Profile is not assigned to any Validated Products

Active Related Technical Decisions

Archived Related Technical Decisions

Please forward any Protection Profile specific comments to the applicable Technical Rapid Response Team (TRRT).

Please forward any general questions to our Q&A tool.

Site Map              Contact Us              Home