Re: How to write assumptions

["NIAP Interpretations Board" <faigin@aero.org>]

The NIB understands well why there are questions about assumptions.

The CC does not define a unique role for assumptions.  They do not have to be 
related back to threats.  They may simply "stand on their own" as statements 
about what the environment should be or should provide (which is actually the 
more proper use of the word "assumption").  However, the CC also states that 
assumptions may be related to threats.  Such associations do little more than 
convey to the reader the fact that the ST or PP author has thought about the 
threat.  Note also that the assumption need not completely cover the threat.  

In the example in the email thread, the function of the non-IT assumption "The 
TOE assumes that the root administrator is trusted and trained" could be to 
counter a stated threat, or it may merely serve to explain the absence of any 
objectives referring to root administrators (and therefore the absence of any 
TOE capabilities in that area).