Q1-1. What is Security Evaluation and Certification？

A1-1:

For IT products and systems procured in the digital government, the use of a product evaluated its security according to international standards is recommended.
Effective on April 2004, IPA (Information-Technology Promotion Agency) has started to implement security evaluation/certification program (IT Security Evaluation and Certification Program) for IT related products to ensure Information security as the Certification Body which organization has been transferred from NITE (National Institute of Technology and Evaluation) as the Certificate Authorizing Participant in accordance with the CCRA , the ex-Certification Body.
This certification program gives certification for security evaluation of IT products and systems conducted by accredited evaluation bodies in accordance with JIS Q 17025:2000.

Q1-2. What is the relationship among ISO/IEC 15408, Common Criteria and JIS X5070?

A1-2:

These standards are same. (Regarding to Common Criteria, later than Version 2.1 are equivalent to other standards.)

Q1-3. What is TCSEC and ITSEC?

A1-3:

TCSEC（Trusted Computer System Evaluation. Criteria）is issued in 1983 (revised in 1985)as the criteria for the procurement of computer systems to be used for the military purpose and affected the development of ITSC and CC, Europe. It was published as one of Rainbow Series and is frequently referred to as the Orange Book according to the color of cover page of the book.

Q1-4. What is the relationship with Information Security Management System （ISMS） based on ISO/IEC 27001(JIS Q  27001、BS7799-2)？

A1-4:

Each of them is an independent system respectively.
The security evaluation and the certification system based on ISO/IEC 15408 evaluate the implementation of the IT product and the system.
On the other hand, information security management system (ISMS) adaptability evaluation system based on ISO/IEC 27001 evaluates the operation management concerning the information security.

Q1-5. What is CCRA？

A1-5:

Official name is Arrangement on the Recognition of Common Criteria Certificates in the Field of IT Security. It is also called Common Criteria Recognition Arrangement for short and is abbreviated to CCRA.

Q1-6. Let me know the Security Target and Protection Profile.

A1-6:

The specification of Security Target and Protection Profile are defined in Appendix of ISO/IEC 15408 Part 1.  Please refer to the Appendix of CC Version 3.1 Part 1.

Q2-1. Let me know the procedure to take an evaluation and certification?

A2-1:

1. Preparation of evaluation documents such as Security Target (by the developer or by the sponsor).
2. Evaluation request for Evaluation Facility.
3. Contract with Evaluation Facility.
4. Certification Application to Certification Body
5. Evaluation Practice by Evaluation Body.
6. Writing an evaluation report by Evaluation body.
7. Certification by Certification Body.

Q2-2. Let me know the certification body and evaluation Facility.

A2-2:

Certification body is IPA.
Regarding to the certification of IT products and systems, please refer “IT Security Evaluation and Certification Scheme”.
To offer the service as the evaluation facility, it is necessary to be authorized by the accreditation body (NITE) and to be approved by the certification body (IPA).
Currently (as of April. 2008), following four facilities are accredited as the evaluation facilities formally.

Q2-3. Let me know the term and cost for evaluation and certification.

A2-3:

Term and cost are different for each evaluation because of the size of TOE and EAL level is different for each case. For example, in case of EAL2, it takes four to six months at least. In case of EAL4, it could take more than twelve months.

It is required that expense for evaluation facility as well as the preparation of each evidence data specified by ST or CC, modification of documents occur during the evaluation, and tests using the real products or systems.
Depending on the size of TOE, the expense for evaluation facility is decided between the evaluation body and applicant.
In addition, the application fee for Certification Body is required.

Q2-4. When the consulting service is received from the evaluation organization, can the evaluation be received in the evaluation organization?

A2-4:

The evaluation organization is prohibited from providing the consulting service as a general rule.　It is admitted as a special case, when the evaluation organization, evaluator's independence and fairness can be maintained.

Q2-5. What is TOE?

A2-5:

TOE stands for Target Of Evaluation.

A TOE is defined as a set of software, firmware and/or hardware possibly accompanied by guidance. While there are cases where a TOE consists of an IT product, this need not be the case. The TOE may be an IT product, a part of an IT product, a set of IT products, a unique technology that may never be made into a product, or a combination of these.

Q2-6. What kind of products or systems can be a target of evaluation and certification?

A2-6:

Basically, IT product/system which has security functions, Software, Hardware, firmware can be a target of evaluation and certification.
ISO/IEC 15408 is standard to evaluate that security functions implemented to IT product /system can protect the information against the attack, objectively.

Q2-7. If an existing product and a newly developing product is combined to one system, how is it evaluated and certified?

A2-7:

The scope of evaluation and certification is defined as TOE (Target of Evaluation) on Security Target (ST). To undergo an evaluation and certification takes expenses and time so that it needs to be studied the effective scope of evaluation and certification and decided the cost-benefit performance is best.

Q2-8. What is required for the evaluation?

A2-8:

At evaluation, design documents, test documents, administrator’s guidance, user guidance, .evidence of configuration management and so on used for the actual development. The necessary documents vary from EAL level to EAL level.

Q2-9. How can I develop the Security Target?

A2-9:

JISEC, Information Technology Security Center Evaluation Department and Electronic Commerce Security Technology Laboratory Inc. Evaluation Center (ECSEC) run various training courses to develop Security target .
For details, please contact each agency.

Q2-10. What is EAL?

A2-10:

EAL stand for Evaluation Assurance Level.
EAL is the scale represents ascending levels of confidence that where IT product or system assure the security functional requirements defined by CC. It is packaged as the subset of each assurance requirements and hierarchically-divided in levels.
A CC evaluation is carried out against a set of pre-defined assurance levels, termed Seven levels from EAL1 to EAL7 is pre-defined in Part 3 of ISO/IEC 15408.
Higher level means the greater the degree of rigorous in assurance.

Q2-11. Who should decide EAL? (Developers? Procurement authority? users?)

A2-11:

It all depends. In some cases, developers decide it, in another occasion, procurement authority or users can decide it.

Q2-12. What is Functional Requirements?

A2-12:

Functional Requirements is the requirements regarding security functions that products and systems should implement. On the part 2 of ISO/IEC 15408, the functional requirements are provided as 11 major classes.

Q2-13． What is Assurance Requirements?

A2-13:

Assurance Requirements are the requirements to seek confirmation that the security functions are certainly implemented. On the part 3 of ISO/IEC 15408, the assurance requirements are divided into 10 major classes and prescribed. (It is called as Assurance.

Q3-1．Can venders other than Japan also apply to JISEC?

A3-1:

It is available. However, it is necessary to understand our scheme documents written in Japanese. Please consult the evaluation facility described in the list of Evaluation Facilities about the support for the application.

• JISEC Home