Question

A government procurement team is evaluating two firewall products. Vendor A advertises that its product achieved EAL4+ certification. Vendor B states its product was certified against a specific network device Protection Profile (PP). The procurement officer asks the security architect which certification best assures that the product's security functions meet the government's actual operational security requirements. What should the architect explain?

Accepted Answer

A Protection Profile defines the functional and assurance requirements for a category of products, so certification against the relevant PP better demonstrates the product meets stated security needs.

Answer

The EAL rating alone guarantees the product meets the government's security functional requirements because higher EALs include more functions.

Answer

Both certifications are interchangeable, so the officer should simply choose the product with the higher assurance number.

Answer

The Security Target is irrelevant to procurement decisions and only the EAL number should be compared between vendors.