How complete must the ST evaluation be in order to be used as part of a TOE evaluation?

An evaluated ST is not required before TOE evaluation may start, however a level of completeness is required on which to base evaluation.

In order to address this interpretation, the following changes are made to CC v2.1, Part 1:

• Reword Subclause 4.2.2, paragraph 110, item (a) as follows:

a) the set of TOE evidence, which includes an ST as the basis for TOE evaluation;

• Reword Subclause 4.5.3, paragraph 161 as follows:

The TOE evaluation is carried out against the evaluation criteria contained in Part 3 using a substantially complete ST as the basis. A substantially complete ST reduces the risk of problems later on in the evaluation process and is where all sections have been completed to an extent acceptable by the evaluation scheme and for which no significant evaluation hurdles are foreseen. The result of a TOE evaluation is to demonstrate that the TOE meets the security requirements contained in the evaluated ST.

TOE evaluations which start before the ST is substantially complete are more prone to substantial problems during the evaluation.