15.3.93 OfficialJournaloftheEuropeanCommunities NoC73/19
thatthelevelofjoblossesmayappearsmallwhen
comparedtomassivejoblossesinlargecompanies,
buttheeffectmaybemuchgreaterontheSMEs
involved.thereisthedangerofprimecontractorschanging
sourcesofsupplytolowercostthirdcountries;
althoughSMEsareknownfortheirabilitytoadapt
tochange,theyneeddiversification programmesto
assistthem;
DoneatBrussels,27January1993.
TheChairman
oftheEconomicandSocialCommittee
SusanneTIEMANN
OpinionontheproposalforaCouncilRecommendation onCommonInformationTech­
nologySecurityEvaluationCriteria
(93/C73/05)
On29September1992theCouncildecidedtoconsulttheEconomicandSocialCommittee
underarticle198oftheTreatyestablishingtheEuropeanEconomicCommunity,onthe
abovementioned proposal.
TheSectionforIndustry,Commerce,CraftsandServices,whichwasresponsibleforpreparing
theCommittee'sworkonthesubject,adopteditsOpinionon6January1993.TheRapporteur
wasDameJocelynBarrow.
Atits302ndPlenarySession(meetingof27January1993)theEconomicandSocialCommittee
adoptedthefollowingOpinionunanimously .
1.Introduction
1.1.TheproposalpresentedbytheCommissionis
designedtoensuregreaterconsumerconfidenceinthe
securitycapabilitiesofinformationtechnologyproducts
andtoestablishayardstickagainstwhichthesecurity
capabilitiesofinformationtechnology (IT)products
maybejudged.Ittakesforwardworkalreadycarried
outinMemberStates,theUSandJapanonthedevelop­
mentofITsecurityevaluationcriteria.
1.2.TheproposedCouncilRecommendation isfor:
i)theadoptionoftheInformationTechnologySecur­
ityEvaluationCriteria(ITSEC)throughouttheEC
foraninitialperiodoftwoyears;
ii)theadvancement ,undertheaegisoftheSenior
OfficialsGroupforSecurityofInformationSystems
(SOG-IS),ofinternationalharmonization andstan­
dardizationofthesecriteria;andiii)thereviewofthesemeasuresaftertheinitial2year
periodandtheproposalbySOG-ISofappropriate
furtheractionfortheCommunity .
1.3.ITSECcomprisestandardcriteriafortheevalu­
ationofsecurityofITproductsandsystems,covering
bothhardwareandsoftware.
1.4.ThesecriteriaaretobeappliedtoITsystems
andproductsundernationalcertificationschemesby
independentandimpartialevaluationbodiesatthe
requestofa'sponsor'(normallythevendororuserof
theITsystem/product).Certificationisthereforepurely
optional.
1.5.InformationTechnologySecurityhasthreecom­
ponents:
—Confidentiality —preventionofunauthorized dis­
closure;

NoC73/20 OfficialJournaloftheEuropeanCommunities 15.3.93
canceofthisproblem,particularlyinitsOpinionon
theproposalsforaDirectiveontheProtectionofIndi­
vidualswithregardtotheProcessingofPersonalData
andtheCouncil'sDecisionontheFieldofSecurityof
InformationSystems(1).—Integrity—preventionofunauthorized modifi­
cation;
—Availability—preventionofunauthorizedwithhold­
ingofinformationorresources.
1.6.ITSECarenotconcernedwithfeaturesdesigned
topreventphysicalthreatstosecurity(suchaslocks
andbolts)butwithhardware,softwareandfirmware
inITproductsandsystems.2.2.Theintroductionofstandardcriteriaforevalu­
atingsecurityfeatureswillenableuserswhohaveident­
ifiedthethreatswhichconcernthemtoselectwhich
productsorsystemsareappropriatetotheirneeds
andasaresulthelpuserstoavoidover-investing in
unnecessaryfeaturesorfailingtocontrolsecurityrisks.
1.7.Asponsorwhowishestoobtainasecurityevalu­
ationofhisITproductorsystemmustdefinethe
securitytargetfortheparticularproductorsystem
againstwhichitwillbeevaluated.Thissecuritytarget
mustsetouttherelevant'securityobjectives'theIT
product/systemshouldachieve,its'securityenforcing
functions',anypotential'threats'totheITproductor
systemand,optionally,the'securitymechanisms'—
thelogicoralgorithmsthatimplementthesecurity
functions.2.3.Acertificationschemewillalsohelpensurethat
suppliers'claimsconcerningtheinherentsecurityof
theirITproductsandsystemsarejustified;further,if
standardcriteriaexisttoevaluatetheabilityofsecurity
enforcingfunctionsincorporatedinproductstocounter
similarthreats,thecomparisonbetweencompeting
productsbecomeseasier.Thisisparticularlyvaluable
intheareaofpublicprocurementandisalsohelpful
forprivateindustryandcommerce.
2.4.Sellersofsecurityproductswhichhaveunder­
gonesecurityevaluationshouldbeabletoimprovesales
oftheirproductsbytheproperuseofcertification ;they
shouldalsobeablemoreeasilytotargetfutureproduct
developmentstomarketrequirements .1.8.Evaluationiscarriedoutattwolevels:thefirst
isanevaluationofwhethertheselectionandincorpor­
ationofthesecurityenforcingfunctionsinthecourse
ofdevelopmentofthesystem/productandthewayin
whichtheyareusedarecorrect;thesecondiswhether
thesystemorproductiseffectiveinaccomplishingthe
securityobjectives.
2.5.Theexistenceofstandardcriteriashouldfacili­
tatetheintroductionofcodesofpracticeorlegislation
establishingminimumstandardsofsecurityacceptable
inITsystemsandproducts,ifandwheretheseare
justified,forexampleintheareaofdataprotection.1.9.Thesponsorwillcallforthecorrectnessand
properimplementation ofsecurityenforcingfunctions
tobeassessedonthebasisofanevaluationlevelfromE0
(lowest)toE6(highest).Eachevaluationlevelinvolves
morerigorousexaminationofthesystem/product.The
evaluationoftheeffectivenessofthesystemorproduct
intheaccomplishment ofthesecurityobjectivesisthen
builtontothecorrectnessassessment,andtheability
ofthesecuritymechanismstowithstanddirectattack
willberatedbasic,mediumorhigh.2.6.Theexistenceofsecuritycriteriashouldincrease
confidenceinECproductsandsystemsoutsideEurope
andincreaseexportsfromtheEC.
1.10.Oncompletionoftheevaluation,theindepen­
dentnationalbodywillawardaratingofE0toE6
whichwillconfirmthattheITsystemorproducthas
satisfiedallthecorrectnesscriteriaandiseffectiveat
thelevelclaimed.2.7.Harmonization ofstandardsisalsodesirablein
ordertofacilitatethefreemovementofgoodsinthe
ECandtoreducetoaminimumtheuseofArticle36
byMemberStatesandthenumberofreferralstothe
CourtofJustice.TheCommitteehasalreadystressed
theimportanceofstandardization forrealizingthesin­
glemarketinitsReportandOpiniononStandardiz­
ationandtheRemovalofTechnicalBarriersto
Trade(2).
2.Generalcomments
2.8.TheCommitteeapprovesthefactthatthecri­
teriahavebeendrawnupbearinginmindcriteria
existinginothercountriesoutsideEuropeinparticular2.1.TheCommitteewelcomestheproposaland
approvesitsaims.ITproductsandsystemsplayan
increasinglyimportantroleinsocietyandthedamage
thatcouldresultfrombreachesofsecurityhascorre­
spondinglyincreased.TheEuropeanParliamentand
theCommitteeitselfhaverepeatedlystressedthesignifi­(!)OJNoC159,17.6.1991.
(2)OJNoC14,20.1.1992.

15.3.93 OfficialJournaloftheEuropeanCommunities NoC73/21
theUnitedStatesofAmerica.TheCommitteehasin
thepastcalledforattentiontobegiventothemerits
ofstandardization onaworldwidebasiswithaview
toavoidingtechnicaltradebarrierswithcountriesout­
sidetheCommunity;andtheCommitteereaffirmsthat
itdoesnotwishEuropeanITSECtobecomeaninvisible
barriertotrade.
2.9.TheCommitteeapprovesthefactthatItsechave
beendrawnupfollowingconsultationwiththose
involvedinthemanufactureanduseofITproducts
andsystems,andstressestheimportanceofcontinued
consultation .
3.Specificcomments
3.1.TheCommitteeregretstheuseofsomuchun­
cleartechnicallanguageinthebodyoftheRecommen­
dation,whichmakestheProposalunnecessarilydiffi­
culttocomprehend .
3.2.TheCommitteewelcomestheseparationof
functionalityfromassurancerequirementsinthecri­
teriaenablingITSECtobeappliedtoawiderangeof
ITproductsorsystems.
3.3.TheCommitteeapprovestheintention,afterthe
two-yearmonitoringperiodbySOG-IS,andfurtherconsultationwithindustryandusers,toreviewdevelop­
mentsinthesecurityofinformationtechnologysys­
tems.Italsoapprovestheintentiontomovetowards
theimportanttargetofmutualrecognitionofnational
certificationthroughouttheCommunitybutbelieves
thatfurtherconsiderationshouldbegiventocertain
concernsexpressedbyusersasto:
a)whetherinpracticeevaluationscanbemadesuf­
ficientlyprecisetobecommerciallyuseful;
b)howtodealwithdifferencesbetweenthevarious
modelsofeachinformationtechnologyproduct,
whichmaybenumerous;
c)themethodologies tobeappliedintheevaluation
processandhowconsistencybetweennationalcerti­
ficationbodiesmaybeachieved;
d)whetherornotinfutureanyparticularstandard
willberequiredinpublicorprivatesystemsasa
matterofCommunitylaworunderanycodeof
practice,forexampleinrelationtosystemshandling
personaldata;and
e)inthecontextofthisfastmovingindustry,howto
ensurethatsecurityevaluationsmaybecarriedout
sufficientlyquicklyandthatevaluationcriteriaare
up-datedregularly.
DoneatBrussels,27January1993.
TheChairman
oftheEconomicandSocialCommittee
SusanneTIEMANN