Re: How to write assumptions

["NIAP Interpretations Board" <ccevs-nib@nist.gov>]

The CC is lacking in specific guidance on what sorts of assumptions are to be 
used. Must the assumptions be restricted to those related to IT? Are they 
assumptions made about the TOE, or assumptions that the TOE makes (about its 
environment)? 

The NIB believes that the assumptions are not those about the TOE, because that 
is what gets verified as part of the evaluation. Therefore, the assumptions 
stated should only be those that the TOE makes about its environment.

The IT assumptions that the TOE makes about its environment would result in 
security objectives for the environment. 

The non-IT assumptions that the TOE makes about its environment are those that 
affect the stated threats, which are those that the TOE is designed to address.