Evaluated Products List & AISEP

New Zealand is a member of the Australasian Information Security Evaluation Programme (AISEP) and is represented on its Management Board by the GCSB.

The programme provides for impartial evaluation of Information Technology products against an internationally recognised standard, the Common Criteria for information technology security evaluation. The results of these evaluations are certified by the Defence Signals Directorate, Australia (DSD) and are published in the DSD Evaluated Products List (EPL).

Other Evaluated & Certified Products Lists are available from:

• Communications Security Establishment Canada
  
• Communications Electronics Security Group
• National Information Assurance Partnership (operated by the NSA)

Evaluation Assurance Levels

EAL4 & Mutual Recognition
The Mutual Recognition Arrangement (MRA) provides for the recognition of Common Criteria certifications up to and including EAL4 among what are known as “certificate producing” and “certificate consuming” nations, and all products certified between EAL1 and EAL4 are published to the Common Criteria Portal Certified Products List.

EAL5-7
There is no MRA for products certified between EAL5 and EAL7.  For products certified at these assurance levels look at the national EPLs listed above.

GCSB Recognition of Evaluated & Certified Products
The GCSB recognises all products certified up to EAL4 (including EAL4+, which incorporates Flaw Remediation) as per the MRA.  However, for products certified EAL5 and higher the GCSB recognises those produced by DSD under the AISEP scheme only. The GCSB is to be consulted for products certified by other schemes to EAL5 and higher.

About Evaluation Programmes

The list of countries that operate ICT product security evaluation and certification programmes and/or recognise the evaluation results is steadily increasing. Countries with such programmes include the United States, the United Kingdom, Germany, Canada, France, Israel, Sweden, Spain and of course the Australasian AISEP scheme. Around double that number of countries formally recognise the evaluation results of those programmes, while several additional countries have expressed an interest to participate.