Summary of Policy Letter Updates (22 January 2010)

• Policy #1, Language in STs, ETRs, VPL, & VRs, was changed to adjust wording and removal of the out of date background information.
• Policy #2, Reuse of Previous Evaluation Results & Evidence, was cancelled; it will be incorporated into Pub 5: Guidance to Sponsors.
• Policy #3, Target of Evaluation Security Targets Claiming Conformance to Protection Profiles, was cancelled; the main purpose of this policy was to allow for the reuse of APE work units. The new PP development process no longer includes a separate evaluation of the PP itself.
• Policy #4, Inactive Evaluations, was updated to clarify the inactive evaluation condition.
• Policy #8, Rules for Component Evaluations under CCEVS, was cancelled; CCv3.1 includes ACO: Composition.
• Policy #9, Crypto in Common Criteria Evaluations, was cancelled; Crypto requirements will be included in each PP and a common requirements guidance documents.
• Policy #10, Acceptance of Security Targets (STs) Into NIAP CCEVS Evaluation, was updated, clarified and combined with policy #13.
• Policy #11, Candidate CCTL Policy, minimal wording changes were made for clarification.
• Policy #12, Letter of Intent (LOI) Requirement for Acceptance into CCEVS Evaluation, no changes were made.
• Policy #13, Acceptable TOEs for Evaluation, cancelled; combined with policy #10.
• Policy #15, Mandatory Inclusion of Audit Generation Functionality in TOEs, cancelled; crypto requirements will be included in each PP and the common requirements guidance documents.
• Policy #16, Validator Oversight Review (VOR) Scheduling Priorities, was updated to specify PP compliant products have first priority.
• Policy #17, Effects of Vulnerabilities in Evaluated Products, minimal wording changes made for clarification.
• Policy #18, Time Limits on CCEVS Evaluations, Updated to reduce the time allotted for the majority of evaluations to 12 months.
• Policy #19, Requirements for Evaluations with Components above Evaluated Assurance Level (EAL) 4, cancelled; NIAP no longer does evaluations with components above EAL 4.