Re: I-0436: Compliance Claims Against A Flawed PP

["NIAP Interpretations Board" <faigin@aero.org>]

  The following is a proposal for a NIAP Interpretation of a Common
  Criteria document that has been approved by the IWG and is being
  submitted to CCEVS management for approval. It is being posted for
  informational purposes.




                      CCITSE/CEM  GUIDANCE (PROPOSED)


     _________________________________________________________________

                 I-0436: Compliance Claims Against A Flawed PP
     _________________________________________________________________

TYPE:                 Guidance
NUMBER:               I-0436
STATUS:               Ready to Prepare for Management/CCIMB

TITLE:                Compliance Claims Against A Flawed PP
PREVIOUS POSTING:      [cc-cmt 00559]

SOURCE REFERENCE:     CC v2.1 Part 3 Subclause 5.5 ASE_PPC
                      CEM v1.0 Part 2 Subclause 4.4.5 ASE_PPC.1
RELATED TO:           <None>

ISSUE:

   What should be done when an ST claims compliance to a PP that the
   evaluation team determines to be flawed?

STATEMENT

   When the PP underlying an ST is determined to be flawed, the ST should
   be appropriately corrected so that it (a) will pass evaluation, and
   (b) is consistent with the objective and intent of the underlying PP.
   The PP Compliance Claim should provide justification provided that the
   corrections are consistent with the PP. The method of determining the
   appropriate correction should be based on the procedures of the scheme
   that issued the PP.

SPECIFIC INTERPRETATION

   As the ASE criteria are still in flux, a specific change is not
   provided. However, the basic notion is to add something to the PP
   compliance requirements along the lines of:

     Each PP claim shall identify any new errors identified in the
     underlying PP, how they were corrected, and how the correction does
     not violate the intent of the PP.

SUPPORT:

   The basic notion underlying this guidance is that a flawed PP should
   not hinder the evaluation of STs. Thus, when such a problem is
   identified, it should be corrected in such a manner as to maintain the
   intent of the PP while fixing the flawed words.

   For PPs issued or evaluated under the CCEVS evaluation scheme, such
   problems should result in an Observation Report that is submitted to
   CCEVS. CCEVS will consult with the authors of the PP (if possible)
   and/or the PP Review Board to determine the original intent, and will
   issue a decision on how to correct the problematic requirements in the
   context of the ST's evaluation. Such an OR then serves as
   justification that the PP compliance claim is still valid even with
   the change.

0436.pdf