[CISSP-D] Re: common criteria evalution criteria

I can think of several reasons for this:

1) Products are placed on the Evaluated Products List once they are 
certified by a Common Criteria Testing Lab (CCTL). According to the 
agreement between the member countries - Mutual Recognition 
Agreement (MRA) only products evaluated at Evaluated Assurance Level 
(EAL) 4 and below will be accepted in other member countries. 

2) CCTLs (at least in the US) are only permitted to evaluate 
products at or below EAL4

3) EALs above 4 become very expensive and prohibitively expensive 
for complex systems. You will notice that products evaluated at 
higher assurance levels (5-7) - there are some, are rather simple in 
function such as a one-way diode.

4) Although US procurement guidance requires a minimum of EAL2 for 
all information assurance products and EAL4 is called for in some 
government RFPs, there are few (or no) requests from the market for 
higher assurance level evaluations.

Hope this helps,

Doug Landoll, CISSP, CISA
President, Veridyn Inc.
(512) 310-2228




 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/CISSP-Discuss/

<*> To unsubscribe from this group, send an email to:
    CISSP-Discuss-unsubscribe@yahoogroups.com

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/