Common
Security Evaluation & Certification
Consortium
Common.SECC
Rule Book
Annex 2

Security Requirements for Site Audits

Version 2.1
30 July 2020

Common.SECC Rule Book – Security Requirements for POI Site Audits

Document History

Version
0.9
1.0

Date
11.11.2015
13.01.2015

1.1

29.01.2016

1.2

03.02.2016

1.3

01.03.2016

1.4

04.07.2016

1.5

04.08.2016

1.6

05.10.2016

1.7

23.01.2017

1.8
1.9

18.07.2017
09.05.2018

1.91

16.07.2018

2.0
2.1

29.11.2018
30.07.2020

30 July 2020

ChangeFirst draft
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS and Common.SECC remarks
Consideration of JTEMS remarks
Further remarks from JTEMS Vendors considered
Replace CCTV by VSS” (Video Surveillance
System) agreed by JTEMS on 30th May
2018
Endorsement of Common.SECC
Minor editorial corrections

Page 2 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

Table of Contents

1

Introduction ..............................................................................................................................42

Requirements of the JTEMS PPs .............................................................................................4

3

4

2.1

Criteria ..............................................................................................................................4

2.2

Explanation .......................................................................................................................4

Asset based approach ..............................................................................................................5
3.1

Asset List ..........................................................................................................................5

3.2

Security Measures ............................................................................................................5

3.3

Assessment of the proper implementation of the security measure ...................................6

Requirements for Sites to be assessed ....................................................................................6
4.1

Site Identification ...............................................................................................................7

4.2

Responsible staff...............................................................................................................7

4.3

Physical Security ...............................................................................................................8

4.3.1

Physical security perimeter ........................................................................................8

4.3.2

Physical entry controls ...............................................................................................9

4.3.3

Public access, delivery and loading areas ..................................................................9

4.4Human resources (Employees) .......................................................................................10

4.5

Secure Room ..................................................................................................................11

4.6

Audits ..............................................................................................................................11

4.7

Company Standards & Procedures .................................................................................12

4.8

Distribution ......................................................................................................................12

4.9

IT Security .......................................................................................................................13

4.10

Device Returns and End of Life .......................................................................................13

5

References .............................................................................................................................14

6

Annex: Several examples regarding requirements in chapter 4 ..............................................15

30 July 2020

Page 3 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

1

Introduction

A CC evaluation to be performed against the JTEMS Evaluation Framework for POIs requires according to the JTEMS Protection Profiles [JTEMS PP V2], [JTEMS PP V4] and [NO-CVM PP] site
visits regarding the initial key loading and the final assembly step of a POI device.
This document can be seen as guidance for Evaluators and for Vendors which shall be used during an evaluation process to obtain an overview of the main focus during site visits in terms ofevaluating against the JTEMS Evaluation Framework, in particular within the CC Assurance Class
ALC. It has to be noticed that this document does not claim to mandate given examples if given
examples are not applicable due to restrictions by any local or national privacy and data protection
laws. Nevertheless, the given guidance and examples are highly recommended to be followed andto be validated during the audit.
All information given in this document should give laboratories and vendors a guidance to be compliant to the ALC_DVS.2 refinements given in the Point of Interaction Protection Profile [JTEMS
PPV4].
Once a site has been assessed this is deemed to be valid for three years (unless there are any
reported changes).

2

Requirements of the JTEMS PPs

2.1

Criteria

In the [JTEMS PPV2] and [JTEMS PPV4] the following aspects are outlined:•“The evaluator shall confirm that the security measures are being applied by examination of thedeveloper's documentation and evidences. The security measures involving the final assembly and the Initial Key Loading facilities shall be checked during a site visit.”[JTEMS
PPV2]

•

Refinement for the developer: „The development environment stands for the design, manufacturing, assembling and maintenance environments of TOE components, including the final assembly and the Initial Key Loading facilities. The Initial Key Loading is defined as the point
where responsibility for the TOE security-related components falls to the acquirers. The initial
key here is not the Acquirer key, but is the key that assures the authentication of the hardware
device independent of the its ultimate purpose and destination” [JTEMS PPV4]•

The definition of the precise sites to be audited for both functions depends on the individual life
cycle, which must be provided by the vendor. If several sites exist, handled by the same quality
management system, and therefore similar procedures, the vendor must propose at least onesite for auditing.

2.2

Explanation

The audit of the initial key loading facility is required to prove the integrity of authentic POI and exclude opportunities for compromise. The attacker could tamper initial keys despite this audit, because the key generation is not in scope of the audit. Key generation is however evaluated basedon documentation.
30 July 2020

Page 4 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

The audit of the final assembly site is required to prevent manipulations of the POI during manufacturing. An attacker can try to compromise the POI during the manufacturing phase, e.g. by installing a „PIN disclosing bug“. Such compromises can damage POI specific cryptographic keys
and PINs. The attacker could of course also compromise the POI by performing manipulations
outside of the final manufacturing phase. It is more likely, however, that the compromise performedin this phase is effectively installed.
These audits in addition, enable the evaluator to assess whether the vendor is trustworthy andreliable.

3

Asset based approach

Requiring site audits the Common Security Evaluation & Certification Consortium does neither target at simple checklists to be ticked off nor at minimum requirements to be covered by an audit.
Instead an audit shall provide a good assurance that the POI produced in the sites are authentic
and secure. Therefore the Common Security Evaluation & Certification Consortium requires anasset based approach which requires that the auditor starts with a problem definition describing
clearly and comprehensively all the assets to be protected by the implementation of the sites. This
problem definition determines the scope of the site visit.
The following steps must be concluded to ensure that the assets that are in scope of the site visit
are protected.
1. Produce a list of identified assets,
2. Identify the according security measures to protect the assets,
3. Assess the proper implementation of these security measures,
3.1

Asset List

The asset list is based on the lifecycle documentation provided by the developer.
The following example is given to avoid misunderstandings to define assets:
Example:Aspect of the Lifecycle:

Key Confidentiality

Assets identified:

Keys
•
•

3.2

Authenticity of the public keys
Confidentiality of the initial keys

Security Measures

The identified assets must be mapped to adequate security measures that will be analysed. To
identify the security measures the assets outlined in chapter 3.1 are taken into account to ensure adetailed assessment in the next step.
The same examples as outlined in chapter 3.1 are used in the following text:
30 July 2020

Page 5 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

Example:Assets identified:

Keys
•
•

Authenticity of the public keys
Confidentiality of the initial keys

Considered security measures may be:- Site Identification- Responsible staff- Physical Security- Human Resources- Secure Room
- Audits- Company Standards- Distribution- IT-Security- Device Returns
3.3

Assessment of the proper implementation of the security measure

After having identified the proper security measures the site visit is conducted to assess the implemented measures and the evidence provided by the developer. This assessment is conductedin accordance to the requirements outlined in chapter 4. The results of the site visit are summarized in a complete audit report.

4

Requirements for Sites to be assessed

An important part of the laboratory’s assessment is the site visit to cover manufacturing, initial key
loading, possible warehouse storage and distribution. Not all site visits are the same and someflexibility must be expected in dealing with and reacting to the environment found.
It is recommended to integrate any report for multiple sites into one document.
It is a principal requirement to gain assurance that any declared policies and procedures relevantto the manufacturing of the POI, including final assembly and key loading are in place, within asecure environment and properly followed.
Site Audits of different manufacturing sites are required, if the relevant Lifecycle steps are not located at the same site.
For a manufacturing site visit report the headings below represent requirements that are expected
to be covered within a comprehensive review. The headings represent a broad and high-level template of requirements expected to be covered by a site visit within a CC evaluation. If some ofthese requirements are not satisfying or inadequate the product may not be able to receive an approval. Requirements which are not applicable for a specific vendor or in case that due to governmental restrictions a vendor is not able to comply with a requirement the vendor has to give a rational on how to handle the “spirit” of each requirement.
30 July 2020

Page 6 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

The following subchapters represent report headings, defined for structuring a site visit report. It
represents requirements derived from the [JILMINSSR] document.
The site visit is based on the developer documentation for each requirement in the subchapters.
During the site visit the evidence to proof the statements outlined in this documentation is gatheredand summarized in a final report by referencing interview partners and documenting the provenaspects.
There are examples outlined in the subchapters below, which represent security measures thatcan be used on a site in accordance to the security level that needs to be provided. Each site canbe different and therefore needs different security measures.
According to the JTEMS Protection Profiles there are two types of sites that are relevant for the
POI evaluation-

POI manufacturing site or Manufacturing line within a site where in the final assembly
step tamper mechanisms are switched on.

-

POI Manufacturing site or area where the initial key(s) for authentication are imported into
a POI

All procedures and information must be analysed before the site visit based on the lifecycle documentation and must further on analysed during the site visit.
4.1

Site Identification

This chapter consists of organisational aspects like address; number of sites to be visited, relevance of each and any inter-relationship between sites.
a)

The location where manufacturing occurs and description of the manufacturing performed,
along with the security measures applied. If there is more than one site used in the lifecycle,
secure transports between different locations must be identified. For example, manufacturing
and key injection could occur in different rooms within a single building, multiple buildings at
the same site, or at multiple sites.

b)

The main parameters for each location are:• location including complete address• purpose (manufacturing, initial key loading)• interaction between sites in scope of the audit (asset transfer)• security measures

4.2

Responsible staff

This chapter identifies particular requirements for any responsible staff within a secure manufacturing environment including names, positions and roles being responsible in the lifecycle of the targetof evaluation.
30 July 2020

Page 7 of 21

Common.SECC Rule Book – Security Requirements for POI Site Auditsa)The security roles and responsibilities of employees, contractors and third party users must
be documented in accordance with the organization's security policy, e.g. in project plans orcontracts.

b)

Especially roles like security manager, key distributors and HSM administrator’s need to be
outlined the names of backup personnel.

c)There must be a translation into Roman alphabet if the names are only available in otherfonts.

4.3

Physical Security

This chapter contains requirements concerning perimeter security, VSS (VIDEO SURVEILLANCESYSTEM), security guards and visitor policies. The analysis of the physical security requirements
is based on documentation and the site visit itself.
4.3.1

Physical security perimeter

The physical security perimeter of a final manufacturing site is the property with its buildings and IT
Systems where the final assembly steps of the POI are performed. The key injection room to injectkeys for authentication can be part of this site or is located on an additional site.
a)

Manufacturing areas (final assembly and initial key loading sites) where integrity could be
impaired shall be properly secured.

b)

The first protection layer of the manufacturing areas shall have at least two lines of defence,a detection layer and a stop layer. These layers shall separate authorized from unauthorizedpeople, including employees. In case that no physical manifestation is handled and solely
logical access to electronic data is present a stop layer may also be a logical one. In case ofa natural disaster the physical security measurements should uphold.

c)

In case buildings of rooms are used for security relevant activities, e.g. key injection, the layers shall separate the different activities to avoid modification and manipulation during the
manufacturing steps.

d)

In general, the POI relevant areas should provide• perimeter protection• protection of the outer skin of the building• protection of the outer skin of the security area
• protection within the security arease)

The resistance time value of the stop layer shall exceed the reaction time of supporting forces. This should be supported by the construction.

h)Unauthorized use of photo and video cameras or audio recording equipment shall be prohibited.

30 July 2020

Page 8 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

i)

4.3.2

Site should be secured by security personnel 365 days a year /24 hours a day in accordance
to the attack potential on the location. For example there could be an intruder alarm system if
the protection layer provides a resistance until security personnel reacts and is reaching thesecurity area.
Physical entry controlsa)Secure manufacturing areas shall be protected by appropriate entry controls to ensure that
only authorized personnel are allowed to access.

b)

Access requests shall be submitted in written or via an electronic work flow system. Accessrights shall only be granted to employees and contractors on a need-to-know basis. A process shall be in place to ensure that access rights can only be granted after approval of responsible people, e.g. the manager of the applicant, the owner of the area, and the Security
Manager.

c)

Segregation of duty should ensure that setting access rights in the access control system isseparated from producing and issuing ID/badges. Any withdrawal of a badge shall be logged.

d)

The access control system shall provide full traceability. All access attempts shall be logged
and should be reviewed at least once per month, tailgating shall be effectively prevented,
and unauthorized access attempts should be analysed. In case of a security breach thatmakes further investigation necessary the data has to be stored securely and kept as evidence.

4.3.3

Public access, delivery and loading areasa)

Access points such as delivery and loading areas of the products, and other points where
unauthorized persons may enter the premises shall be controlled and isolated from processing facilities to avoid unauthorized access.

b)

Visitors shall have only predefined, controlled access to the manufacturing areas.

c)

Delivery and loading areas shall be monitored by VSS. The recordings shall provide clear
pictures enabling identification of any unintended unloading and loading. VSS recordings
should be analysed in regular intervals. In case of a recorded security breach the affected
VSS recordings should be kept until the breach is completely investigated and is not anymore needed for any evidence purposes.

d)Incoming material for manufacturing /final assembly shall be registered on entry, and inspected before delivery to the point of use. This can be done by e.g. checking a bill of materials. If the final assembly site and the personalisation site are on different locations the secure delivery process between the sites is checkede)Transfer of security relevant materials within a physically secured area shall be logged inorder to provide full traceability.

f)Devices shall be protected against tampering or theft during transit between physically separated sites. The protective mechanism shall enable the recipient to detect if tampering or
theft has taken place.

30 July 2020

Page 9 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

4.4

Human resources (Employees)

This chapter identifies requirements for access control management, security policies, security
training, hiring and dismissal procedures, and contracts with third party companies that are relevant for the POI.
a)

Physical protection and guidelines for working in secure areas shall be designed and applied
to the personnel that is working with the POI.

b)

Personnel that is working with the POI shall be aware that information may only be shared ona need-to-know basis.

c)

People from external parties (e.g. customers, development partners, Manufacturing partners,
housekeeping, vendors, suppliers, carriers) shall not work in POI relevant areas without supervision of approved internals (e.g. host, owner of area, guard). This rule does not apply to
externals which work as internal team members and are subject to the same security rules asinternalsd)

The developer shall grant access to the POI or its parts only to trustworthy people. That objective should be accomplished by appropriate hiring and termination procedures which ensure careful selection of trustworthy staff.

e)Background verification checks on all candidates for employment, contractors, and third party
users should be carried out in accordance with relevant local laws, regulations and ethics,
and proportional to the business requirements, the classification of the information and material to be accessed, and the perceived risks.

f)

As part of their contractual obligation, employees, contractors and third party users that are
working with the POI shall agree and sign the terms and conditions of their employment contract, which shall state their and the organization's responsibilities for security. Contracts withall employees (permanent, temporary, subcontractors, students etc.) shall contain a confidentiality clause which remains valid after expiration/termination of the contract; third party
users respectively shall sign a non-disclosure agreement (NDA).

g)

All employees of the organization, where relevant, contractors and third party users that are
working with the POI shall receive appropriate awareness training and regular updates in organizational policies and procedures, as relevant for their job function. That can be face toface or online training. Records of training shall be kept, including date, attendances andcontent. An Initial and regular (annual) security training program shall make the development
team members aware of their responsibilities, e.g. handling of documents and information,
behaviour in public, and encourage them to act pro-actively when problems occur.

h)

All employees, contractors and third party users that are working with the POI shall return allof the developer's assets in their possession upon termination of their employment contract
or agreement. The same shall apply when they leave the developer’s organization due tochange of job assignment or dismissal due to disciplinary reasons. This process should be
supported by a checklist for employees leaving employment in order to make sure that all
relevant tasks, e.g. return of company properties, deletion of access rights are completed.

30 July 2020

Page 10 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

4.5

Secure RoomThis chapter identifies the requirements for secure rooms for personalisation or key injection.
a)Secure rooms shall be protected by appropriate entry controls to ensure that only authorized
personnel that is allowed to work with the POI has access.

b)

The access control system shall provide full traceability. All access attempts shall be logged,
tailgating shall be effectively prevented, and unauthorized access attempts should be analysed.

c)

The design and layout of sites and premises should avoid secure rooms next to public areas.
The routes and walkways designated to visitors should be designed to ensure that visitors
will not see restricted areas or information unintentionally.

d)All openings towards the secure rooms (air conditioning, cable ducts, etc.) shall be protected
in order to effectively prevent intrusion, e.g. with a welded metal grid.

e)Secure rooms should be alarmed and locked when unattended. Access controlled doors
should be monitored with magnetic contacts and VSS, and the secure rooms should be monitored with motion detection.

d)

Any storage objects like safes must be set up so that it cannot be removed until security
forces arrive.

4.6

AuditsThis chapter identifies requirements for internal or external security audits including their evidence
and time interval.
a)

The organization should conduct internal or external audits at planned intervals to determine
whether the processes and procedures of its POI manufacturing including all components:• conform to the requirements of this Requirement Document;• conform to the identified security needs of the POI;
• are effectively implemented and maintained; and• are performed as expected.

b)

An audit program should be planned once a year, taking into consideration the status andimportance of the processes and areas to be audited, as well as the results of previous audits. The audit criteria, scope, frequency and methods should be defined. The selection ofauditors and conduct of audits should ensure objectivity and impartiality of the audit process.
Auditors shall not audit their own work.

c)

The management responsible for the area being audited shall ensure that actions are taken
without undue delay to eliminate detected nonconformities and their causes. Follow-up activi-

30 July 2020

Page 11 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

ties should include the verification of the actions taken and the reporting of verification results.
4.7

Company Standards & Procedures

In this chapter written standards for the manufacturing especially for the firmware of a POI are
identified. Authentication and storage during manufacturing, including change control logs, andfirmware validation procedures are part of the following requirements.
a)

An automated configuration management System must be used to automatically maintainand control the firmware. The CM system shall ensure the integrity of the firmware from theearly design stages through all subsequent maintenance efforts, that the firmware is correctand complete before it is installed into a POI and preventing unauthorized modification, addition, or deletion of any firmware parts.

b)

Access rights to the CM system should be controlled and restricted to authorized personnel.

c)There must be documented processes for the manufacturing of all components of a POI, e.g.
the firmware including validation procedures.

d)manufacturing machines and all classified digital information to conduct the secure POI
manufacturing must be located in a secured network environment.

4.8

Distribution

Transportation between sites is part of the following requirements if the final assembly and initial
key loading are conducted on different locations.
a)

The whole transport chain from final assembly area to shipment of the POI to the initial key
loading site shall be controlled. Transport shall be monitored for security violations and any
incidents shall be responded to and acted upon immediately.

b)Transports of parts of the POI or the unfinished POI between different sites, , are to be covered by security measures, e.g. transport keys between interacting sites.

c)
The security measures during transit shall correspond to integrity and authenticity and should
be defined in a written document. This includes reliable contracts with the courier company to trackdevices during transit.
d)A recipient should be provided with all information necessary to verify the integrity and authenticity of the shipment. The following information should be included.
• Number of boxes• Seal number(s) of transport box(es)• Number of pieces packed.
Additionally, it may be useful to provide• Route and schedule• Driver’s name, truck license plate number
30 July 2020

Page 12 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

4.9

IT Security

This chapter includes requirements according to signing procedures and encryption, access tosensitive information, equipment maintenance, system back-up (onsite / offsite), sensitive information uniqueness in scope of the POI manufacturing.
a)

Only authorized people shall have access to electronic information and data related to the
POI.

b)

Security relevant hardware such as HSMs and or other tools to establish signing or distributekeys must be located in a secure room and operated under dual control.

c)

It should not be possible to view and/or modify security items from outside a defined security
area, even from within the corporate network. A strong authentication scheme shall be defined for network access.

d)Adequate back-up facilities shall be provided to ensure that all essential information andsoftware can be recovered following a disaster or media failure while maintaining confidentiality and integrity of the POI and its part. Beside all information and data related to the POI,e.g. design data and CM system, access control and administrator log files shall be backedup.

e)

All equipment and cryptographic implementations shall be correctly maintained to ensure its
continued integrity and – for security systems - availability.

f)

A defined network plan with security mechanism shall be provided that includes at least thefollowing information according to the assets in the data flow:- on overview of network segments,- the boundary and interfaces of each network segment,- overview of network infrastructure (router, firewall, storage system, etc.),- the administration concept including security relevant configuration and maintenanceof network components (e.g. workstations, backup machines, firewalls, intrusion detection systems, intrusion prevention systems, production machines)g)

A defined policy for classified digital information must be provided (e.g. BOM for Manufacturing)

4.10 Device Returns and End of Life
This chapter defines requirements to aspects of devices that are returned at end-of-life including
re-cycling or destruction, repair, storage and inspection procedures if this is applicable in the scopeof the site that is audited.

30 July 2020

Page 13 of 21

Common.SECC Rule Book – Security Requirements for POI Site Auditsa)Finished goods, semi-finished goods, rejected material, or parts of the POI that are no longer
needed should be destroyed in a way that the remains cannot be used in any meaningful
way that might affect the confidentiality of the POI.

b)

If there is a repair process the storage of POIs must be traceable from the moment they are
in an unsecure state until a new firmware or key is injected. All security measures must uphold as if the POI is a complete new produced device.

c)

The related processes shall be designed to provide full traceability of every piece of any tangible form of the POI or its parts.

5

References[JTEMS PPV2]

Point
of
Interaction
Protection
Profile,26.11.2010,
Version2.0
https://www.sogis.eu/documents/cc/pp/hardware_devices/poi/obsolete/anssicc_pp-profil-2010_08_09_10en.pdf[JTEMS PPV4]

Point
of
Interaction
Protection
Profile,06.03.2015,
Versionhttps://www.sogis.eu/uk/pp_pages/poi/pp_poi_comprehensive.html[NO-CVM PP]

NO-CVM Point of Interaction Protection Profile, 01.02.2019, Version 1.0[JILMINSSR]

Joint Interpretation Library Minimum Site Security Requirements, Version 2.2,
April 201930 July 2020

4.0

Page 14 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

6

Annex: Several examples regarding requirements in chapter 4

It should be noticed that the following are only examples and are not in all cases applicable to allsites in scope of an audit.
Example Physical security perimeter (4.3.1):
On a). In a typical setup, the premises manufacturing are located within a manufacturing building
with other manufacturing lines surrounded with a fence or wall. Buildings are constructed with concrete or stonework walls, ceilings and floors. Controlled doors are strong (including frames), close
automatically, and are monitored with magnetic contacts and VSS.
Windows are secured with irremovable metal grid or with magnetic contacts and glass breakage
sensors. Where the site may not be fenced an IR curtain can be deployed or the outer skin of thebuilding is monitored by digital VSS with motion detection (“Telemat”) or is patrolled by security
guards 24/7.
On b) A Detection Layer may consist of at least one or more of the following and, where implemented, proper operational review processes must be evidenced:-

Fence with sensor (vibration, ultrasonic, motion, etc.)-

IR curtain-

Digital VSS with motion detection-

Wall with alarm tapestry or vibration sensor-

24/7 guard post

A Stop Layer is a constructive measure which needs time to overcome in accordance to the location (country) and attack risks identified:-

Concrete or brick stone wall-

dry walling construction enforced with inside metal grid (> 8mm diameter, <100 mm grid
distance) or enforced with steel plate (> 3mm thickness)-

windows in a stop layer are either protected with metal bars (> 8 mm diameter) or madewith bullet proof glass-

door hardware must be properly installed, locked door blades fixed at floor and ceiling, door
locks are still working by default even when power loss is happening.

On e). If supporting forces need at least 5 mins to reach the secure area after detecting an attacker, a wall or door should withstand this attacker until supporting forces arrive.

30 July 2020

Page 15 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

Example Physical entry controls (4.3.2):
On d). In a typical setup, access to the building is controlled by electronic badge access. Security
areas (e.g. laboratory, data centre, security control rooms; key injection rooms) have dual authentication, e.g. badge with PIN.
Example Human resources (Employees) (4.4):On e). Respecting privacy regulations, the developer shall make a reasonable effort to gain confidence in the integrity of the staff, e.g. through-careful check of job applications regarding completeness, conclusiveness, and authenticity,-

check of indicated references, and-criminal record check (“Clearance Certificate”, “Criminal Records Bureau check”, “Casier
judiciaire”, “Polizeiliches Führungszeugnis” etc.).

Example Secure Room (4.5):
On a). In a typical setup, access to the building is controlled by electronic badge access. Security
areas (e.g. laboratory, data centre, security control rooms) have dual authentication, e.g. badge
with PIN. A separate access room (manlock) should be used to enforce the dual control mechanism of two authorized employees.
Example Distribution (4.8):
On c). Example of different measures to ensure transport security in accordance to attack risk:
During transportation, the POI is attended at any time except while locked in an airplane. Therefore
the following rules apply to ground transportation-

packed in sealed transport boxes with unpredictable seal number (seal, plumb, or security
tape)

-

transport in a locked vehicle-

point-to-point transport without additional payload or hub/relation-

Two-man rule shall be applied during the entire transportation and the vehicle shall not be
unattended at any time-

the transport should be equipped with mobile phone and GPS based-

Surveillance-

In order to prevent attacks shipment information may be encrypted.

-

A TOE with activated tamper detection logic is secured for shipment by loading a uniquesecure token (transport key) into the HSM key store. At the final destination the TOE is in-

30 July 2020

Page 16 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits

spected for signs of tampering. The tamper status is checked and the secure token is verified.
-

TOE hardware parts without active tamper detection mechanisms are shipped using packages secured with security adhesive tape. This tape provides a unique seal number foreach package. At the final destination the packages are inspected for signs of tampering.
The seal numbers are checked using a packaging list exchanged between sender and recipient refer to d). Those Parcels are shipped using normal parcel services (DHL, UPS,
FedEx).

Example IT Security (4.9):On g). Example for Information classification:
Information Classification related to public (e.g. marketing information)
Information Classification related to restricted (e.g. Security awareness documents):
The access to TOE related information classified as "restricted" is controlled by the developer and can be shared with other organisations under non-disclosure agreement. The logicalseparation shall implement:- The network storing and processing restricted information is separated from the remaining company networks. Access to networks with lower classification (company
network and internet) shall be limited and controlled to:- Receipt of software, libraries, data from other parts of the company or third parties
that is integrated in the TOE or used to develop the TOE.
- Receipt of patches, virus pattern, etc. used to maintain the development environmentand security measures.
- Client systems shall only have controlled internet access based on proxy and filter
functionality.
- Client systems, servers and the gateways (routers, firewalls) shall only allow andsupport the network services and ports required within the restricted network.
- The integrity protection of data can be split into sections. For example the protection
at the client-side and the server-site can rely on organisational and/or technicalmeasures and the transmission between these two locations is protected by cryptographic mechanisms. Restricted information can be stored and processed by third parties under NDA. This can include outsourcing of services like email or data storage.
While the integrity protection at both parties (developer and third party) can be ensured
based on a combination of mechanisms provided by the transmission protocols andphysical security measures to limit access to authorised persons, the connection between the parties needs to be protected by cryptographic security mechanisms ensuring confidentiality and allowing the detection of integrity violations.
30 July 2020

Page 17 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits- Authentication to computer systems processing the same restricted classification canbe based on a single sign-on solution.
- A company-wide directory service is appropriate for user authentication. However thisrequires a consistent and automated process for maintaining user accounts.
- Only client systems registered for the restricted network can access the network.
Thereby it shall be ensured that IT systems with controlled software, defined configuration and client related security measures can connect to the network.
- Remote access to the internal network classified as restricted is allowed. The remote
access must ensure a VPN connection with strong authentication.
- Access to servers processing and storing restricted information shall be limited to clients authorised to access restricted or higher classified information.
- Tools and equipment used for network monitoring need to be managed within the restricted network and shall not provide any data to lower security levels.
- Smart phones or other mobile devices are only allowed to access restricted networks
if they provide the same security measures as other clients in the network e.g. laptops.
Information Classification related to sensitive:
The access to TOE related data classified as “sensitive” is limited to members of specified
teams only. The logical separation shall implement:- The network storing and processing sensitive information is separated from any othercompany network.
- communication with external parties must be secured accordingly- Receipt of software, libraries, data from other parts of the company or third parties
that is integrated in the TOE or used to develop the TOE using quarantine network
techniques.
- Receipt of patches, virus pattern, etc. used to maintain the development environmentand security measures using network quarantine techniques.
- Client systems must not have internet access.
- Exchange of data between networks storing and processing sensitive information andnetworks storing and processing restricted information shall be controlled. The downgrading and upgrading of data must be supported by specific transfer mechanisms ensuring the protection of the network with higher classification. This shall be implemented e.g. by network quarantine techniques.

30 July 2020

Page 18 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits- Client systems, servers and the gateways (routers, firewalls) shall only allow andsupport the network services and ports required within the restricted network. Allowed
network services shall support secure authentication.
- Integrity protection and confidentiality shall be based on technical measures. Cryptographic mechanisms shall be used e.g. for data transmission or backup in any case theclassified data leaves the physically protected area sufficient to protect sensitive information.
- Credentials for the authentication to sensitive networks shall be different from the credentials for the authentication of networks with lower security classification. Single signon solution shall not be implemented for this classification.
- A dedicated directory service is required for networks processing sensitive information
and above. The administration of this directory service shall be limited to evaluatedsites.
- No outsourcing or external hosting of IT-services should be allowed.
- Technical measures shall ensure that only authorised client systems can access the
network classified with sensitive or higher security level.
- Tools and equipment used for network monitoring need to be managed within thesensitive network or the critical network and shall not provide any data to lower security
level.
- No remote access to the network should be allowed.
Information Classification related to “critical” and above:
The access to TOE related data classified as “critical” knowledge is limited to a few individuals only on a need to know basis. Most requirements are the same than for sensitive information. However specific requirements are enhanced compared to sensitive classification.
Logical separation shall implement:- The network storing and processing critical or above information is separated fromany other company network.
- Communication with external parties must be secured accordingly- Receipt of software, libraries, data from other parts of the company or third parties
that is integrated in the TOE or used to develop the TOE using quarantine network
techniques.
- Receipt of patches, virus pattern, etc. used to maintain the development environmentand security measures using network quarantine techniques.
- Client systems do not have internet access.

30 July 2020

Page 19 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits- Exchange of data between networks storing and processing critical classification (andclassifications above) and networks storing and processing restricted information shallbe controlled. The downgrading and upgrading of data must be supported by specifictransfer - - mechanisms ensuring the protection of the network with higher classification. This shall be implemented e.g. by network quarantine techniques.
- Client systems, servers and the gateways (routers, firewalls) shall only allow andsupport the network services and ports required within the restricted network. Allowed
network services must support secure authentication.
- Integrity and confidentiality shall be based on technical measures. Any data transfer
between client and server shall be encrypted using transport layer security or application layer security. Backup tapes need to be encrypted in any case.
- Credentials for the authentication to critical networks shall be different from the credentials for the authentication of networks with lower security classification. Single signon solution shall not be implemented for this classification category.
- A dedicated directory service is required for networks processing sensitive information
and above. The administration of this directory service shall be limited to evaluatedsites.
- No outsourcing or external hosting of IT-services is allowed.
- Technical measures shall ensure that only authorised client systems can access the
network classified with critical or higher security level.
- No remote access to the network is allowed.
- Email exchange between individuals classified as critical is individually encrypted between the sender and the receiver.
Specific requirements
Some aspects can be applicable for all security levels and allow for very different implementations.
Therefore they are listed here separately.
- The access to printouts can be implemented by logical security measures (e.g. authentication with badge at the printer) or by physical security measures (e.g. access
control to the room with printer). However besides the access to the printouts also the
network cabling as well as print servers may need to be considered depending on the
network services provided by the printer. The security concept shall outline the related
policy and the implemented security measures.
- Licence management is widely-used within development and production areas. An effective licence management requires the control independent of the security level thelicence is currently used. This requires an appropriate separation of the licence management with an appropriate security concept regarding the separation and informationflow.
30 July 2020

Page 20 of 21

Common.SECC Rule Book – Security Requirements for POI Site Audits- Storage systems may be used for different classifications as long as they are physically protected according to the highest classification and they support logical or physical separation for the different classifications e.g. VLAN or different interfaces. In addition they need to support the classification related protection of the transmission.
- The entire persistent data storage of mobile devices shall be encrypted either by operating system supported tools like e.g. Bitlocker or third party tools. This shall be implemented for all security classification. The encryption of the persistent storage of other systems may depend on the physical security measures protecting the device.
Example Physical entry controls (4.10):
On a). Example:- Hardware tamper detection mechanisms are triggered to erase sensitive information.
- In case of a Security Module or a complete TOE, this part will be destroyed by the vendor
using a box column drill. A single hole is drilled through the keyboard and Security Module.
- All TOE hardware scrap is stored in a locked box before destroyed by a certified external
service provider for electronic recycling. The service provider is shredding the hardware
parts in pieces smaller than 10 mm² (DIN 66399 E-5).
- TOE documentation classified restricted or above- on paper is shredded to at least particles of 30 mm² (DIN 66399 P-5).
- on optical disk is shredded to at least particles of 10 mm² (DIN 66399 O-5)
- on re-writable data carriers (HDD, SSD, USB sticks) are erased by degaussing the
medium.

30 July 2020

Page 21 of 21