New Policy for Cloud-based SaaS Solutions

The National Information Assurance Partnership (NIAP), the government agency that oversees Common Criteria evaluations in the U.S., has announced a new policy allowing evaluations of cloud-based SaaS products.

The new policy outlines the requirements for evaluation submissions claiming conformance against protection profiles that are able to be used with applications in the cloud. These requirements fall into the following areas:

• Assurance and Evaluation Activities
• Suitability Review
• Remote Testing
• Mutual Authentication
• Federal Risk and Authorization Management Program (FedRAMP)
• Platform Functionality
• Evaluated Configuration
• Public Vulnerability Search

The announcement is significant as it reflects NIAP’s dedication to updating requirements of evolving and emerging technologies.

For help with a Cloud-Based SaaS product evaluation or any other certification, contact Corsec directly!

What is Common Criteria?

Common Criteria is an international cybersecurity standard recognized by 33 countries, or schemes. 18 of these schemes participate as certificate authorizing entities). While Common Criteria offers a common framework for evaluating products, each national certifying scheme was allowed to establish their own rules for doing so. Over the years certain nations have made more large scale changes to the framework. While these changes initially create turmoil, the Common Criteria community works to integrate the changes in the overall framework. We see this with NIAP in the U.S. when they moved to certifying only Protection Profile based certifications.

We are now seeing it again, as the EU, and specifically ENISA, have created the EUCC.