NVLAP LAB BULLETIN NUMBER: LB-107-2018 PAGE: 1 of 3

DEPARTMENT OF COMMERCE 

National Institute of Standards and Technology 

National Voluntary Laboratory Accreditation 

Program

ISSUE DATE:

January 2, 2018

LAB BULLETIN 

NUMBER:

LB- 107-2018

LAP: Common Criteria 

Testing 

SUBJECT: Supplement to NIST HB 150-20:2014, section 3.3.3 regarding frequency 

of commercial evaluation and the new section 3.3.4 regarding the use of the common 

criteria testing lab (CCTL) point system as a means of monitoring technical 

proficiency.

Purpose 

The purpose of this NVLAP bulletin is to publish a supplement to NIST HB 150-20:2014, 

section 3.3.3 regarding the frequency of the commercial evaluation requirements as well 

as the addition of section 3.3.4 which defines a point system for activities that could lead 

to suspension of accreditation for testing to the Common Criteria (CC). This bulletin 

becomes part of the NIST Handbook 150-20:2014, Common Criteria Testing, until such 

time as the next edition of the handbook is published. 

Overview 

NIST Handbook 150-20:2014, section 3.3.3 will now state that labs are required to 

demonstrate continued proficiency to perform Common Criteria evaluations by 

successfully completing a commercial evaluation annually under the oversight of NIAP.

Section 3.3.3 previously required a commercial evaluation on a two-year cycle.

Section 3.3.3 also states that upon completion or termination of each NIAP evaluation, 

NIAP will report to NVLAP the results of the evaluation. NIAP accomplishes this by 

completing a Proficiency Feedback (PF) report. 

The CCTL point system defined in section 3.3.4, provides a consistent and transparent 

means to classify nonconformities and monitor CCTL technical proficiency.

Background 

When NIAP finds nonconformities in evaluation evidence received from a Common 

Criteria testing laboratory (CCTL), it results in evaluation completion delays, 

terminations, and unforeseen costs to NIAP and industry. Nonconformities vary in 

severity; some are due to technicalities, such as incompleteness or missing 

documentation, while more serious issues are due to security-related product 

nonconformities. The PF report was originally created to address reports that required 

extensive iterations between the validation team and the laboratory. Today, the PF 

report contains proficiency feedback on a lab’s performance during each phase of the 
NVLAP LAB BULLETIN NUMBER: LB-107-2018 PAGE: 2 of 3

evaluation process. To objectively monitor CCTL technical proficiency, the CCTL point

system is being introduced. 

CCTL Point System 

The CCTL point system is modeled after the driver’s license point system, where traffic 

offenses are assigned points relative to the severity of the offense. CCTL points 

accumulate over a two-year period of accreditation. If the maximum number of points is 

reached, a laboratory’s accreditation will be suspended. Evaluation report issues will be 

assigned points based on the severity of the deficiency (see Table 1). 

Points Evaluation Report Issues (deficiency)

1 program management, such as failure to maintain a current project schedule

3 technicality, such as missing documentation, incomplete report, or failure to 

meet schedule

5 nonconformity, such as a security-related issue, or inaccurate 

representation of a product

Table 1. CCTL Point System

Points automatically expire or are removed at the end of the two-year accreditation 

period. A laboratory accumulating 12 or more points during the two-year period will have

the testing associated with NIAP suspended via official NVLAP notification. The terms to 

lift suspension will be handled on a case-by-case basis and will be outlined in the official 

notification. 

 

Implementation of Changes 

Effective January 1, 2018, NIST Handbook 150-20:2014 is amended by the revision of 

section 3.3.3 and the addition of section 3.3.4: 

3.3.3

Demonstration of continued proficiency 

NIAP CCEVS requires that the laboratory demonstrate its continued proficiency to 

perform Common Criteria evaluations by successfully completing a commercial 

evaluation annually under the oversight of the NIAP validation scheme. Upon 

completion or termination of each NIAP evaluation, NIAP will report to NVLAP the 

results of the evaluation. The continuing demonstration of successful completion of 

NIAP evaluations will serve to meet the NVLAP proficiency testing requirement.

3.3.4

CCTL Point System 

A system used to assign points for evaluation report issues identified in the performance 

of an evaluation activity. Points accumulate over a defined period and are assigned 

based on the type of deficiency: 
NVLAP LAB BULLETIN NUMBER: LB-107-2018 PAGE: 3 of 3

Points Evaluation Report Issues (deficiency)

1 program management, such as failure to maintain a current project schedule

3 technicality, such as missing documentation, incomplete report, or failure to 

meet schedule

5 nonconformity, such as a security-related issue, or inaccurate 

representation of a product

The laboratory shall maintain a point total of less than 12 points during a defined twoyear period of accreditation. If a laboratory accumulates 12 or more points during the 

two-year period, the accreditation for Information Technology Security Testing -

Common Criteria will be suspended. 

____________________________________________________________________

Please retain this NVLAP lab bulletin with your copy of NIST Handbook 150-20:2014 for 

future reference. 

The point system will be piloted from January 1, 2018, to June 30, 2018, to allow all 

parties to gain familiarity with the point system process. NIAP will levy points during this 

period and communicate any assigned points directly to the laboratory at the time they 

are levied.

On July 1, 2018, all laboratory point totals will be cleared and the permanent system will 

be enforced per the requirements of NIST Handbook 150-20:2014 section3.3.4. 

NVLAP will receive a monthly report from NIAP detailing all points assigned during the 

period. Any necessary accreditation actions regarding a laboratory’s cumulative points 

will be taken by NVLAP. 

Questions regarding the changes to the NVLAP Common Criteria LAP requirements 

should be directed to Brad Moore, brad.moore@nist.gov, 301-975-5740.