Re: I-0460: Empty Selections Or Assignments/One Or More

["NIAP Interpretations Board" <ccevs-nib@nist.gov>]

The CC does not state whether assignments can be completed by effectively 
choosing nothing. I-0460 makes it clear that assignments must be completed 
and rewrites every instance of this in the CC to be explicit. Since the CC is 
ambiguous the NIB believe that such exactitude is necessary. There are 
some requirements that would not be properly satisfied if their assignments 
were not filled-in; for example, actions to be taken upon authentication failure. 
An ST writer could take advantage of this and create a specification that was 
essential void of any meaningful controls. An even more 'crafty' ST writer 
could come up with some action that effectively translates to nothing; and the 
vendor can even more invisibly implement 'null' actions. It is up to the 
evaluators to detect these (and the validators to check their work).