| Table of contents |
|
2 History 3 Mutual Recognition Arrangement 4 External Links |
The CC defines a common set of potential security requirements, divided into functional requirements and assurance requirements.
The CC also defines two kinds of documents that can be built using this common set:
The CC also predefines sets of assurance requirements, termed Evaluation Assurance Levels (EALs). These EALs are numbered 1 to 7, with higher EALs requiring increasing levels of evaluation effort. The notion is that higher EAL levels gain more assurance, but cost more time and money to independently evaluate. Higher EAL levels do not necessarily imply "better security", they only mean that the claimed security of the TOE has been more extensively validated.
The CC originated out of two standards -- ITSEC, a European standard, developed in the early 1990s by the UK, France, the Netherlands, Germany, and also used by some other countries, e.g. Australia; TCSEC (also called the "Orange Book"), the US standard, and CTCPEC, the Canadian standard.
CC was produced by unifying these pre-existing standards, so that companies selling computer products for defence or intelligence use would only need to have them evaluated against one set of standards. The CC was developed by the governments of the UK, France, the Netherlands, Germany, the US, and Canada.Usage
Often, users desire an independent evaluation of a product (termed the Target of Evaluation, or TOE) to show that the product does, in fact, meet the claims in an ST. The CC is specifically written to support this independent evaluation.History