Publications
Withdrawn on August 01, 2018.
Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products
Documentation
Topics
Date Published: August 2000
Planning Note (08/01/2018):
Withdrawn: Pre-dates many relevant laws, regulations, and executive directives, and does not reflect NIST’s current validation programs, Risk Management Framework, or the Cybersecurity Framework. For a current overview, see SP 800-12 Rev. 1, An Introduction to Information Security.
Author(s)
Edward Roback (NIST)
Computer security assurance provides a basis for one to have confidence that security measures, both technical and operational, work as intended. Use of products with an appropriate degree of assurance contributes to security and assurance of the system as a whole and thus should be an important factor in IT procurement decisions. Two Government programs are of particular interest: the National Information Assurance Partnership (NIAP)'s Common Criteria Evaluation and Validation Program and NIST's Cryptographic Module Validation Program (CMVP). The NIAP program focuses on evaluations of products (e.g., a firewall or operating system) against a set of security specifications. The CMVP program focuses on security conformance testing of a cryptographic module against Federal Information Processing Standard 140-1, Security Requirements for Cryptographic Modules and related federal cryptographic algorithm standards.
Computer security assurance provides a basis for one to have confidence that security measures, both technical and operational, work as intended. Use of products with an appropriate degree of assurance contributes to security and assurance of the system as a whole and thus should be an important...
See full abstract
Computer security assurance provides a basis for one to have confidence that security measures, both technical and operational, work as intended. Use of products with an appropriate degree of assurance contributes to security and assurance of the system as a whole and thus should be an important factor in IT procurement decisions. Two Government programs are of particular interest: the National Information Assurance Partnership (NIAP)'s Common Criteria Evaluation and Validation Program and NIST's Cryptographic Module Validation Program (CMVP). The NIAP program focuses on evaluations of products (e.g., a firewall or operating system) against a set of security specifications. The CMVP program focuses on security conformance testing of a cryptographic module against Federal Information Processing Standard 140-1, Security Requirements for Cryptographic Modules and related federal cryptographic algorithm standards.
Hide full abstract
Keywords
Assurance; computer security; evaluation; information assurance; IT security; security testing
Control Families
Assessment, Authorization and Monitoring; Risk Assessment; System and Services Acquisition
