Which security testing and evaluation program is used to assess security features and assurances for commercial off-the-shelf products?

• A. Common Criteria
• B. Cryptographic Module Verification
• C. FIPS 140-2
• D. ISO 27001

Answer: (A)

Assessing security features and assurances for commercial off-the-shelf products is done using a standardized, independent evaluation framework that defines security requirements, evaluation methods, and levels of assurance. This is provided by the Common Criteria for Information Technology Security Evaluation. It lets vendors specify what security benefits their product offers (through security targets and protection profiles) and submit to rigorous, lab-based testing and evaluation by accredited bodies to obtain a formal assurance rating (the EALs). The result is an internationally recognized certification that the product meets defined security properties.

In contrast, the Cryptographic Module Verification Program focuses on validating cryptographic modules against specific cryptographic standards, such as FIPS 140-2, which is about the security of the crypto module itself rather than the broader product. ISO 27001 is about establishing and maintaining an information security management system within an organization, not evaluating a particular product’s security features.