US NIAP Overview:

QRC in Commercial Technology

JON ROLF – DIRECTOR NIAP/US

25 MAR 2025

NIAP-CCEVS.ORG

NSS [CSfC]

U.S. Gov’t

Industry

Gov’t, Industry

COTS Product Validation

Establish and implement processes to oversee COTS product evaluations under the terms of the Common Criteria Recognition Arrangement to ensure evaluated COTS IT products are available for use in NSS. 

Protection �Profile

250+ Products & 1000+ Product Configurations

COTS IT Product

Security Target (Draft)

NIAP Validation�Oversee | Review | Validate

Evaluation by Common Criteria Testing Lab�Analyze | Test | Document | Report

NIAP Portfolio

NIAP-CCEVS.ORG

Mobility

Automation

Encrypted

Storage

Computing �Platform

Secure Component

Apps

Cloud

Virtualization

Security �Mgmt

Network

• Mature COTS Product Evaluation for National Security Systems
• Define minimum security requirements for commercial technologies
• Represent US in Common Criteria Recognition Arrangement
• CNSSP 11 Enforcement Mechanism

81

FY24 Product Evaluations

33

Nation Partnerships

52

Protection Profiles

NIAP Today

Continued growth of PP coverage and �product evaluations

• 81 Evaluations
• 250+ Configurations

FY24 Evaluations �by Technology

UNCLASSIFIED

UNCLASSIFIED

(U) Total NIAP Evaluations by Fiscal Year

• Total NIAP Evaluations by Fiscal Year

Relationship Between NIAP and CSfC

• CSfC enables products on NIAP Product Compliant List to be used in layered solutions to protect classified National Security Systems (NSS).
• After receiving NIAP validation, a vendor follows a separate process with CSfC to obtain approval to be used in CSfC.
• CSfC may require a product to support certain, more secure selections that are only optional for NIAP compliance.
• Approved products are added to the CSfC Components List.

Represent U.S. in CCRA

Position the U.S. as a leader among Common Criteria Recognition Agreement (CCRA) nations. Further U.S. government and industry objectives to eliminate trade barriers and ensure transparent, meaningful, and repeatable evaluations. 

Certificate Producers

NIAP Protection Profiles

Requirements Driving Protection Profile Development (2024/2025)

• International standards updates to all Protection profiles – CC:2022
• Post Quantum updates to algorithms – CNSA 2.0
• Cybersecurity Requirements Updates –
• Supply Chain (SBOM)
• Vulnerability tracking
• SSDF
• Zero Trust
• Commercial Solutions for Classified Roadmap coordination and product availability - CSfC
• Cloud strategy – Operational Requirements, Whole of government coordination, Industry and International Coordination

​

​

​

CNSA 2.0 Overview

Anticipated Timeline

Predicted Timeline for Adding Algorithms to PPs

​

Protection Profile updated with CNSA 2.0

NIAP Current Path to QRC Testing

Update Protection Profiles

Talk to Industry

Test and Evaluate Products with QRC

Field Products with QRC

FY25🡪 FY26🡪 Late FY26🡪

Cryptographic Algorithm Testing Using ACVP

• Policy Letter #5: NIST CAVP certificate required
• Full testing supported:
• LMS
• ML-DSA
• ML-KEM
• SLH-DSA

Entropy Source Testing Using ESVP

• Labgram #118: NIST ESV certificate required
• QRC requires strong random numbers
• ESV process is rigorous, but enables reuse:
• Across NIAP and FIPS evaluations
• Across multiple NIAP evaluations
• atsec tested 30% of all ESV certificates

How to Contribute

​

• Technical Communities

​

• Common Criteria User Forum

​

• GitHub site: https://github.com/commoncriteria

​

​

For More Information…

Visit the NIAP Website: www.niap-ccevs.org

​

Contact Us via E-mail: niap@niap-ccevs.org

​

CCRA:  www.commoncriteriaportal.org

​

​

​