CCRA Management Committee
Report to the ICCC 2013
Dag Ströman, MC Chair
Orlando, September 10th 2013

1

Congratulations, India!

2

MC meeting, September 9th 20133

Volontary Periodic Assessment &Shadowing 2012/2013
 Completed MC voting on VPA of Spain, Norway,

Netherlands and Australiasian Schemes.
 Voting in progress of South Korean scheme Shadowing of India Q1 2013
 VPA:s being scheduled 2013/2014
 Sweden Q4 2013
 Italy Q1 2014
 Turkey Q2 2014
 USA Q4 2014

 Date of shadowing of a new national scheme to bedetermined.

4Membership matters One nation has indicated interest to apply for membership ascertificate consuming participant.
 One certificate consuming participant is considering toestablish a scheme and seek approval to change status tobecome certificate authorizing participant.

5

Liaison with the CCUF
 The activities of the CCUF makes excellent progress and theefforts by it’s members are highly appreciated.
 The CCDB chair is tasked to create a formal liason statementwith the CCUF, to be finally approved by the Management
Committee.

6Other CCRA activites
 Organization of the ICCC 2013 in Orlando Officers for the next 12 months:
 MC Chair: Mr. Dag Ströman, Sweden, 1 year
 ES Chair: Mr. Mark Loepker, US, elected 2012 for 2 years DB Chair: Mr. David Martin, UK, elected 2012 for 2 years
 Maintenance Board Chair: Dr. Susanne Pingel GE, and Ms

Eunkyoung Yi, South Korea.

7

Implementation of the MC
Vision statement…

8

Work by the CCES and CCDB withthe revision of the CCRA
 8 Nations participated as editors; Australia, Germany, Japan,Turkey, Malaysia, Canada, UK, US.
 Normally about 10-14 nations up on the bi-monthly virtual
meetings sessions.
 About 17 versions of the updated Arrangement produced.
 Other documents revised: CCDB Terms of Reference.
 Executive Subcommittee Terms of Reference Management Committee Terms of Reference Voting procedures

 Established a transition plan9

Agreement in principle
 The CCRA participants who attended the MCmeeting September 9th in Orlando, are in consensus
agreeing in principle to an updated version of theArrangement.
 The MC believe that the updated Arrangement is true to theMC vision statement established in Paris last year.
 The updated arrangement will now go through each nation’s
final review process including legal review.
 Until that process is complete, a group of nations have asked
that the updated Arrangement is not to be released publicly.
10Disclaimer!
The following text are excerpts from the updated Arrangement
established at the MC meeting in Orlando.
The text is subject for change and updates during final nationaland legal review and does not necessarily represent the finalwording.

11Article 2 - Scope “This Arrangement covers certificates with claims ofcompliance against Common Criteria assurancecomponents of either: 1) a collaborative Protection Profile, developed andmaintained in accordance with Annex K, with assurance
activities selected from Evaluation Assurance Levels up
to and including level 4 and ALC_FLR, developed
through an international Technical Community
endorsed by the Management Committee, or 2) Evaluation Assurance Levels 1 through 2 andALC_FLR.

12

Definition - Achievable Common
Level of Security Assurance:
 Security assurance requirements defined in cPPs that

produce reasonable, comparable, reproducible, and costeffective results. It is recognised that all Qualified CBs
have the potential to certify evaluations against cPPs andrelated Supporting Documents. Schemes may or may notuse cPPs based on their business need.

13

Definitions - International TechnicalCommunity (iTC): A group of technical experts including Participants,

14

Certification/Validation Bodies, ITSEFs, developers andusers which are:
 working in manners that promote fair competition;
 working in some specific technical area in order todefine cPPs;
 endorsed for this purpose by the Management
Committee; and establishing interpretations of the application of theCC and CEM necessary for cPPs through Supporting
Documents which are subject to the CCRA approval
process.

Definitions - collaborative
Protection Profile (cPP):
 A Protection Profile collaboratively developed by aninternational Technical Community endorsed by theManagement Committee. A cPP and related Supporting
Documents defines the minimum set of common
security functional requirements and the achievablecommon level of security assurance. It addresses
vulnerability analysis requirements to ensure certified
products reach an Achievable Common Level of Security
Assurance.

15Annex K - cPPs
 K.2 CC and CEM
 cPPs shall be compliant with the generic framework ofthe CC and CEM in order to support mutualrecognition. Supporting Documents supplementing
the cPPs are expected to be created to giveinterpretations to the CEM as needed. When arationale demonstrates that the cPP and/orSupporting Documents cannot express the security
needs, the CC and/or CEM may be modified, subject
to the CCRA approval process.

16Annex K - cPPs
 K.3 Mutual recognition
 CCRA certificates that claim conformance to a cPP

shall only cover the assurance requirements defined inthe said cPP and related supporting documents.
 CCRA certificates that claim conformance to a cPP
shall only cover the security functionality defined in
the said cPP.

17

The transition plan
 The transition plan states 36 months as a limit and places

incentive on the creation iTC and work of cPPs willcontinue.
 The Participants agree for a period of 36 months from thedate on which this Arrangement has been signed by all its
participants, to recognise re-certifications and maintenanceaddenda issued according to the previous version of thisArrangement. Thereafter, within the scope of thisarrangement all Participants shall limit recognition ofcertifications issued in accordance with Article 2.
 The 36 months begins at the time of CCRA ratification.
18

Next steps
 All CCRA Participants has acknowledged the ongoingreform in accordance with the MC Vision statement.
 Next steps:

 Tidying up the updated Arrangement from Orlando, and theninitiate final national and legal review of updated Arrangement.
 After this final ratification process will start (”signing”).

 Estimatet target date: 6-12 month. May be longer though.

19Some final remarks…

20

Inspiration for CC-marketing panel?

21Orlando – The roller coaster ridesyou offer are appreciated!
Thank you!

22