Aligning CC Certification with Customer Deployment Realities: Cloud, Hybrid, and Containerized Environments (C20a)
CC certification evaluates products in tightly defined configurations, yet customers increasingly deploy them as virtual appliances in public clouds, containerized microservices, and hybrid architectures that diverge significantly from what was evaluated. This creates a growing assurance gap between the certificate and the actual deployment. This talk examines how current Protection Profiles for Virtualization, Computing Platforms, Operating Systems, and Network Devices map to cloud-native realities. It assesses progress from community-driven cloud evaluation guidance, identifies critical gaps around container orchestration, ephemeral workloads, and shared-kernel isolation, and proposes practical approaches—including CC:2022’s modular framework for cloud-tailored PP extensions—to ensure CC assurance remains meaningful as infrastructure modernization accelerates.