Evaluation of Evaluation Facilities (D22c)
The qualification of the lab which performs a CC evaluation is absolutely crucial for the level of assurance you will get. The International Common Criteria Recognition Agreement (CCRA) and the European Recognition Agreement (SOG-IS-MRA) define lab requirements – based on ISO/IEC 17025 – in an abstract manner. But what does it mean in real life? Which competences and tools are necessary if a specific product type has to be evaluated? How much oversight has still to be done by the certification body? How can I trust the evaluation as vendor, customer or certification body?
The speaker works for the German certification body (BSI) as policy officer and former senior certifier, has accompanied several international peer reviews (VPA) between certification bodies and performs accreditation audits for the German National Accreditation Body (DAkkS). He acted as chairperson for the JIWG Embedded Devices Subgroup (JEDS), which addresses the Common Criteria evaluation and certification of embedded devices and the corresponding lab requirements in Europe. His talk addresses the above-mentioned questions and shows best practices