Living With Moving Targets: CC:2022, Errata, Supporting Documents, and Interpretation Drift (W00c)
Sitting in the hardware assessor’s chair, we’ve watched CC:2022, its errata, and the JIL/JHAS attack-potential methodology — now moving from SOG-IS into EUCC — continually adapt AVA_VAN.4/.5 penetration and side-channel scope to new threats and vulnerabilities. As the risk landscape evolves, assurance is moving away from simply showing that controls work, toward proving they can’t be bypassed. This means utilizing separation frameworks such as the Information Exchange Gateway (IEG), OpenTDF/ZTDF cryptography, and hardware data diode fed fusion sandboxes. This session looks at how that shifting environment of multi-domain frameworks and requirements plays out on a developer’s and assessor’s desk, mid-project.