+SA-04(07) NIAP-approved Protection Profiles

SA-04(07) NIAP-approved Protection Profiles

Control

  1. Limit the use of commercially provided information assurance and information assurance-enabled information technology products to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists; and
  2. Require, if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that the cryptographic module is FIPS-validated or NSA-approved.

Discussion

See [NIAP CCEVS](#795aff72-3e6c-4b6b-a80a-b14d84b7f544) for additional information on NIAP. See [NIST CMVP](#1acdc775-aafb-4d11-9341-dc6a822e9d38) for additional information on FIPS-validated cryptographic modules.

Assessment Objective

  1. the use of commercially provided information assurance and information assurance-enabled information technology products is limited to those products that have been successfully evaluated against a National Information Assurance partnership (NIAP)-approved Protection Profile for a specific technology type, if such a profile exists;
  2. if no NIAP-approved Protection Profile exists for a specific technology type but a commercially provided information technology product relies on cryptographic functionality to enforce its security policy, that cryptographic module is required to be FIPS-validated or NSA-approved.

Assessment Method

Examine

Supply chain risk management plan system and services acquisition policy procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process solicitation documents acquisition documentation acquisition contracts for the system, system component, or system service list of deployed IT products/solutions NAIP-approved protection profiles FIPS-validation information for cryptographic functionality system security plan other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility for determining system security requirements organizational personnel responsible for ensuring that information assurance products have been evaluated against a NIAP-approved protection profile or for ensuring products relying on cryptographic functionality are FIPS-validated organizational personnel with information security responsibilities

1. Pregled

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

Zahteve

3. Povezani predpisi

Predpisi

Povezane zadeve

Povezave
is blocked by SA-04(07) NIAP-approved Protection Profiles – Assessment Procedure
is blocked by Information Assurance Enabled Products