An evaluated product provides a level of assurance in its security functionality that an unevaluated product does not. To assist in providing this assurance, the Australian Signals Directorate (ASD) performs evaluations for products used to protect SECRET and TOP SECRET data via its High Assurance Evaluation Program.
The Australian Certification Authority within ASD certifies product evaluations conducted by licensed commercial facilities, in accordance with the Common Criteria (i.e. the International Organization for Standardization/International Electrotechnical Commission 15408 series), as part of the Australian Information Security Evaluation Program (AISEP).
For an organisation seeking to procure evaluated products, the Common Criteria’s Certified Products List contains a list of products that have been evaluated, certified and mutually-recognised in accordance with the Common Criteria and the Common Criteria Recognition Arrangement (CCRA).
Some CCRA schemes leverage the Cryptographic Algorithm Validation Program for the evaluation of cryptographic algorithms used by cryptographic modules within evaluated products. In such cases, cryptographic evaluations are performed by Cryptographic and Security Testing laboratories that are accredited by the United States’ National Voluntary Laboratory Accreditation Program to International Organization for Standardization/International Electrotechnical Commission 17025:2017, General requirements for the competence of testing and calibration laboratories.
A Protection Profile (PP) is a technology-specific document that defines the security functionality that must be included in a Common Criteria evaluated product to mitigate specific cyber threats. PPs can be published by a recognised CCRA scheme or by the CCRA body itself. PPs published by the CCRA body are referred to as collaborative PPs.
ASD recognises all collaborative PPs listed on the Common Criteria website, and will consider national PPs listed on the United States’ National Information Assurance Partnership website, in addition to those listed on ASD’s AISEP webpage. Where a PP does not exist, an evaluation based on an Evaluation Assurance Level (EAL) may be accepted. Such evaluations are capped at EAL2+ as this represents the best balance between completion time and meaningful security assurance gains.
An organisation choosing to use Common Criteria evaluated products can determine their suitability by reviewing their evaluation documentation. This includes the security target and certification report.
Products that are undergoing a Common Criteria evaluation will not have published evaluation documentation. However, documentation can be obtained from ASD if a product is being evaluated through the AISEP. For a product that is in evaluation through a foreign scheme, the product’s vendor can be contacted directly for further information.
Further information on the High Assurance Evaluation Program is available from ASD.
Further information on the AISEP is available from ASD.
Further information on Common Criteria evaluated products can be found on the Common Criteria’s Certified Products List.
Further information on cyber supply chain risk management can be found in the ‘Cyber supply chain risk management’ section of the Guidelines for procurement and outsourcing.
3 controls