Japanese - European IC Cards
Security Conference

NITE

Japanese Information Technology
Security Evaluation andCertification Scheme-for E-Government30 March, 2001
National Institute of Technology and Evaluation (NITE)
Ministry of Economy, Trade and Industry (METI)
2001.03.30

1

Purpose of Japanese ITSEC
Scheme

NITE● To promote arrival and distribution ofsecured IT products● To share the same recognition between

developers and users by ST● To confirm, by the third party, that theprocured IT Products are in compliancewith the ST
2001.03.30

2

Activities and Participants

NITE

METI
Commission the Japanese ITSEC scheme to implement for NITECertification Program
National Institute of Technology and Evaluation
Certificate

・Certification of evaluation results
・Approval of ITSEF, technical support and monitoring
・Maintenance of scheme and the rule of evaluation and certification
Certification

Technical Supportand Monitoring

Certificate

Evaluation Report
Assessment andAccreditation

Accreditation
Program

ISO/IEC Guide 65

ITS Evaluation Facility(ITSEF)
・Implementation of the security
evaluation for IT products and systems
on request maker, vendor, and users

Certification Application andEvaluation Report

Maker and User
Evaluation
Results

Evaluation
Application

・Request of evaluation andcertification for IT products
and systems (supply products,its information, and evidence)
・Improvement of security
quality for IT products

ISO/IEC 17025
2001.03.30

3

NITE

Procedure of Japanese ITSEC
Certification Program
Contract ofCertification

Monitors andTechnical AssistantContract ofEvaluation③③
ITS
Evaluation Facility②

Contract ofCertification③

Reports andCertificate④

Evaluation Applicant

Application②

Contract ofEvaluation Support①

Maker and Developer
2001.03.30

4

Responsibility of Certification
Program 1

NITE

Establishment and Management of the Scheme● Responsibility and authorization concerning “the establishmentand implementation of the scheme, operational guideline andrules”, “supervision”, “interpretation”, “revision”, “observance”,“documentation” and “information supply”● Approval of ITSEF and revocation of the approval● Monitoring of the ITSEFs(consistency in evaluation, evaluation

process)● Provision of every information regarding the ITSEFs● Provision of information regarding recommendation, guidelines,assistance and training
2001.03.30

5

Responsibility of Certification
Program 2NITE● Security of confidential information including the ownershipconcerning IT products● Adjustment of the common interests among participants● Issuance of the certification program annual● Cooperation with certification bodies in other countries (CCRecognition Arrangement)● Management of the certification logo
● Report making on the certification activities and its management● Settlement of claim, objection, dispute, improper usage andslander

2001.03.30

6

Responsibility of Certification
Program 3NITE

Certification of Evaluation Results● Responsibility and authority over the certification and its

continuation, suspension or withdrawal● Issuance of the certification report and the certificate forcertified IT products● Provision of the information about the certification thorough thelist of certified IT products, etc

2001.03.30

7

Responsibility of ITS Evaluation
Facilities

NITEEvaluation and Reporting●

Formulate the evaluation plan and inform certification program ofits start●

Evaluate PP, ST or TOE●

Make an evaluation observation report about the problems foundduring the evaluation process, and submit it to the evaluation
applicant and certification program●

Make a evaluation technical report and submit it to evaluation
applicant and certification program●

Keep the documents made or used in the evaluation process for 5years after the evaluation

2001.03.30

8Requirements of ITS Evaluation
Facilities

NITE

Neutrality and Perfection●

Because of neutrality, and fairness and perfection of the evaluation
service, the facilities shall not be influenced by the financial orcommercial interests, and the evaluation activities shall beconducted within the scope of this scheme

Confidentiality●The facilities shall maintain the high secrecy level, shall have a
documented guideline and procedure, and shall protect theinformation that should be handled with care or ownership is
claimed of

2001.03.30

9Prohibited Items of ITS
Evaluation Facilities●

NITE

Development, manufacture and evaluation of the same IT
product or PP???

●

2001.03.30

Consulting Service
Exception;
Consulting service may be offered only if ITSEF follows its own
policy to maintain independency and fairness of the evaluators

10

NITE

Evaluation Process 1
Preparation for Evaluation●

Selection and decision of TOE●

Preparation of ST●

Preparation of evidences●

Selection and decision of ITSEF●

Pre-review of ST●

Contract of evaluation●

Declaration of evaluation●

Acceptance of declaration

2001.03.30

11NITEEvaluation Process 2
Execution of Evaluation● ST evaluation● TOE evaluation collating with its ST● Records making and publication of evaluation observation

reports●Content of evaluation observation reports;
Problems
Importance of the problems
Person responsible for solving the problems
Time table for solving the problems
Effects of unsolved problems

2001.03.30

12

NITE

Evaluation Process 3
Ending of Evaluation● ITSEF makes the evaluation technical report and submits it tothe Certification Program and an evaluation applicant (Notopen to the public)Content of evaluation technical report
Including confidential and handle-with-care information● Certification program makes the certification report and issues

it to the evaluation applicant along with a certificate (open tothe public)Content of certification report
Excluding confidential and handle-with-care information
2001.03.30

13

NITECertification
Management● Responsibility of the evaluation applicant

after the certificate has been issued● Suspension and revocation of certificate● Maintenance of certification(Maintenance of assurance)

2001.03.30

14

Responsibility of Evaluation
Applicants

NITE

After the Certificate has been Issued●It has to be ensured that the IT products are supplied in accordancewith the certification report and the certificate issued by thecertification program●If the fact stated on the Certificate and/or the List of Certified IT
Products has been changed, it shall be noticed to the Certification
Program without delay●

In the following cases,
When the change has been made, which has a great effect on thedesign or the specification of the Certified IT Products
When information has been given, which shows a possibility that
the Certified IT Products don’t conform to the requirement of
this scheme
the fact shall be reported to the Certification Program without delay

2001.03.30

15

Suspension and Revocation ofthe Certificate

NITE● If there is any doubt on the continuation of the validity of

the issued certificate, the certified IT Products shall be reevaluated and the certification be revoked.
● In that case the following procedure shall be taken;

Judge if investigation is needed and then carry it out
Suspend the certification
Judge if re-evaluation is needed and then carry it out
Revoke the certification

2001.03.30

16

Maintenance of Certification(Maintenance of Assurance) 1

NITE

Procedure●This procedure is applied when the validation of original
certification is to be maintained for a succeeding version orrelease of certified IT products or PP●

This procedure is set to reduce the financial burden and timeloss, which are excepted to occur when obtaining thecertification for the succeeding version or release, by applying
the original procedure of evaluation and certification●

If the succeeding version or release has changed greatly fromthe original one, certification can’t be given in the maintenanceof certification

2001.03.30

17Maintenance of Certification(Maintenance of Assurance) 2

NITE

Step by step guide for this procedure●

To get approval, an evaluation applicant shall submit themaintenance of certification plan and other material relevant tothe utilization of the procedure by the time the original
evaluation is invalidated●

The maintenance of certification contract shall be made between
ITSEF and applicant whose certification plan has been approved-the contracted term for the maintenance of certification is thatof approved maintenance plan-●When it is confirmed that the succeeding version follows thecertification maintenance plan, ITSEF shall report it to thecertification program

2001.03.30

18

For further information(Tentative)

NITE

Conformity Assessment Center, National
Institute of Technology and Evaluation
Hiromi ISHIGE, Yukimitsu MIURATEL 81-3-3481-1939
Fax 81-3-3481-1937

NITE will become Independent AdministrativeInstitution (Governmental Organization) inApril
Home Page Address: http.//www.nite.go.jp
2001.03.30

19