SP 800-23. Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products

Computer security assurance provides a basis for one to have confidence that security measures, both technical and operational, work as intended. Use of products with an appropriate degree of assurance contributes to security and assurance of the system as a whole and thus should be an important factor in IT procurement decisions. Two Government programs are of particular interest -- the National Information Assurance Partnership (NIAP)'s Common Criteria Evaluation and Validation Program and NIST's Cryptographic Module Validation Program (CMVP). The NIAP program focuses on evaluations of products (e.g., a firewall or operating system) against a set of security specifications. The CMVP program focuses on security conformance testing of a cryptographic module against Federal Information Processing Standard 140-1, Security Requirements for Cryptographic Modules and related federal cryptographic algorithm standards.