A product or technology whose primary role is not security, but that provides security services as an associated feature of its intended operating capabilities. To meet the intent of Committee on National Security Systems Policy (CNSSP) 11, acquired CS- enabled products must be evaluated if the CS features are going to be used to perform one of the security services (availability, integrity, confidentiality, authentication, or nonrepudiation). Note: Examples include such products as security-enabled web browsers and screening and security-enabled messaging systems.
Sources:
CNSSI 4009-2022
from
NSA/CSS Policy 3-4 - adapted