In addition to the requirements of E2, source code or hardware drawings to be produced. Correspondence must be shown between source code and detailed design. Acceptance procedures must be used. Implementation languages should be to recognised standards. Evidence of retesting to be provided after the correction of errors.
Evaluators perform functional and penetration testing.
In addition to the requirements of E3, formal model of security and semi-formal specification of security enforcing functions, architecture and detailed design to be produced. Testing must be shown to be sufficient. TOE and tools are under configuration control with changes audited, compiler options documented. TOE to retain security on re-start after failure. In addition to the requirements of E4, architectural design explains the interrelationship between security enforcing components.