Common Criteria Recognition Arrangement

Development BoardPolicies and Procedures

Document Number: DB 2017-06-001
Date: June 27th, 2017
Subject: Supporting Documents
Definition
A supporting document is a document that specifies the use of the Common Criteria or
Common Methodology for Information Technology Security Evaluation in a particular field or
domain of technology.
There are two types of supporting document:•Mandatory Technical Document•Guidance Document

Mandatory Technical Documents contain a consistent set of interpretations that specify theuse of the criteria and methodology within a particular field or domain of technology. These
documents contain the elements necessary for mutual recognition of certificates for suchtechnologies .
Guidance Documents may contain background material to aid the understanding of theevaluation approach or any other information not considered to be mandatory.
In addition, during their development, both types of document may be used in 'Trial Use' asdescribed below.
Rationale
The Common Criteria (CC) and the associated evaluation methodology (CEM) are intended
to cover a wide range of technologies (both current and future). In order to apply these to aspecific technology it may be necessary to make interpretations of both the criteria andmethodology. In cases where there are a number of such interpretations needed, a mandatory
Technical Document is used to collect these together. This, in conjunction with any
associated Guidance Documents, clarifies the harmonised approach.
Development procedure
Supporting documents are developed as CCDB work items and are reported to the ES and MC
via the CCDB business plan. The MC must approve the field or domain of technology whereMandatory Technical Documents are to be required. A rationale for each case will be provided
via the CCDB.
Trial Use
In general, supporting documents will be developed by international technical communities(iTCs) to support the evaluation of cPPs within the technical area concerned.
The iTC participating nations/CCDB member(s) producing the SD will uphold the broadconsistency of SDs to CC/CEM and the schemes overseeing evaluations that apply such SD:swill be responsible for applying them consistent with CC/CEM and CCRA.
During their development the supporting documents can be provided for 'trial use', with anannouncement that they are not yet final but may be applied by schemes anyway. They can be
published on the website together with a clear indication of their status.

Formal Approval Process
The proposing CCDB member is primarily responsible for checking that the SDs aretechnically appropriate for use , consistent with CC/CEM, and that the SDs are deemed suitablefor use under the CCRA.
New mandatory supporting documents will be provided to the CCDB for an 8 week review
process during which the CCDB will seek to reach a consensus before taking a vote regarding
the suitability of the documents.
A shorter review process (3 weeks) will be used for updates to already approved documents.
To assist the review process, any comments will be provided to the whole CCDB with a clear
indication of their status:•critical (i.e. not conformant to CC and/or CEM), or•

improvement/editorialusing the appropriate review form.
Critical comments/Negative votes must come with a justifiable reason. If there is a technicalreason, a technical rationale has to be provided.
All responses to comments marked as “critical” must be reviewed by the CCDB which will,within 1 month, decide if the issue is considered resolved.

Label procedure
The supporting documents shall be labeled with a CC logo and are to be put on the relevant
area of the CC Website. The title of each document shall indicate its formal status as either amandatory (normative) or guidance (informative) document and its development status as 'intrial use' or 'in full use'.

Certification Requirements
Certification reports shall acknowledge the use of mandatory supporting documents (including
any version numbers).