FAQs – CCUF Portal

How Can We Help?

Common Criteria

Acronyms

How do I know what cPP I should use for evaluating my product?

How long does evaluation take?

What gets evaluated?

What happens when a certified product changes?

What is a Collaborative Protection Profile (cPP)?

What is a PP-Module

What is a Protection Profile?

What is a Security Target?

What is an Evaluation Assurance Level?

What is the CC evaluation process?

What is the Common Criteria?

Who recognizes CC certificates?

iTC Meetings

Topics about handling iTC meetings, such as scheduling, minutes, agendas

Do I need a meeting agenda for my iTC meetings?

Does there need to be a quorum for the vote to be valid?

General Decision Making

How can I make sure the iTC is an open forum that everyone feels welcome to participate in?

How long should you try to achieve consensus before going to the voting process?

Scheduling iTC meetings

Some of the vendors in the iTC have concerns about antitrust violations while participating in the iTC.

What should a meeting agenda contain?

What should meeting minutes contain?

iTC Lessons

Lessons from early iTCs to pass on to future iTCs

How should a Scheme participate in the various Interpretation Teams (ITs)?

The iTC has determined that the ESR needs to be edited (or a new ESR should be created to meet a new set of requirements). How does the iTC get this accepted?

What are some lessons learned from completed iTC work?

Review Periods

Information about handling review periods for documents

What is the best way to have review comments submitted to the iTC?

Document Editing

Points about editing, conversion to Asciidoc, pointers about formatting

How should I format my tables?

I already have my PP in Word. What is the easiest way to get it into the proper format?

When an iTC has completed writing a new cPP or updating an existing one, how should that iTC publish the documentation for release to the public?

Github Usage

Tips on using GitHub for managing documents

How should I setup GitHub approvals for the IT or Editors for merges?

Starting an iTC

How can I make sure the iTC is an open forum that everyone feels welcome to participate in?

How can my iTC come to agreement since we have completely different architectures?

How can my iTC come to agreement since we seem to be targeting different functions with the same product?

Vendor solutions for this product (that does not have an existing PP/cPP) have a lot of variety and it is difficult to come to agreement on how things should work. How can everyone get on the same page?

Interpretation Teams

How should a Scheme participate in the various Interpretation Teams (ITs)?

Voting

Does there need to be a quorum for the vote to be valid?

General Decision Making

How long should you try to achieve consensus before going to the voting process?

Should approval be based on a simple majority or a ‘’super majority” or some other criteria?

What is a typical voting process?

What type of voting scheme should be used?

Where is all of the rules around the voting process documented?

Who should be able to vote in the iTC?