RE: PD 0133: Level of Detail in SFRs

["Arnold, James L. Jr." <JAMES.L.ARNOLD.JR@saic.com>]

> I suggest that this is simply a result of the CCEVS decision 
> to focus on the needs of DoD customers.  Within the context 
> of such a focus, the effective purpose of CCEVS evaluations 
> becomes meeting those needs.  
> 
> This context is quite different (no statement about good/bad 
> or right/wrong ONLY different) from the context of a 
> broad-community evaluation scheme.  In the latter specifying 
> specific functionality would seem to be inappropriate.  In 
> the former context, specifying specific functionality is 
> likely in line with perceived customer needs and hence more 
> likely appropriate.

However, this draft precedent is not about functionality at all but
rather about presenting details in the SFRs in addition to presenting
them in the TSS. This draft precedent seems to simply require that
details within the TSS, that are supposed to be used to justify
conformance with requirements, must actually find its way directly into
the requirements.

While I understand the motive to limit the products being evaluated
based on NSA customer needs given the current resource situation, I
don't think that should result in long term ramifications for other CC
evaluation in the form of precedents or interpretations. Rather, I think
CCEVS policies are a vehicle more appropriate for imposing NSA-desired
restrictions on evaluations, much as I disagree with the notion of a
mandatory, ad hoc PP in the form of policy letters.