Which set of standards allows users to specify security functional and assurance requirements in a system, including Evaluation Assurance Levels (EALs)?

Which set of standards allows users to specify security functional and assurance requirements in a system, including Evaluation Assurance Levels (EALs)?

• A. Cloud Security Alliance's Security Trust Assurance and Risk (CSA STAR)
• B. National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)
• C. Common Criteria (CC)
• D. Children's Online Privacy Protection Act (COPPA)

Answer: (C)

Common Criteria provides a formal way to specify both what security functions a system must have and how confidently those functions are implemented, using Evaluation Assurance Levels (EALs) to express the depth of the evaluation. It does this through Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs), plus structures like Protection Profiles and Security Targets. When a product or system is evaluated, it receives an EAL rating that indicates how thoroughly design, testing, and in some cases formal methods were applied to verify its security properties. This international framework (ISO/IEC 15408) is precisely about defining and validating security capabilities with a transparent assurance level. Other options don’t fit this combination. CSA STAR centers on cloud security trust and risk assessments, not a standardized, EAL-based evaluation of products. The NIST Cybersecurity Framework is a broad risk-management framework, not a formal product-level assurance scheme. COPPA is a privacy regulation focused on protecting children's data, not security evaluations.

Common Criteria provides a formal way to specify both what security functions a system must have and how confidently those functions are implemented, using Evaluation Assurance Levels (EALs) to express the depth of the evaluation. It does this through Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs), plus structures like Protection Profiles and Security Targets. When a product or system is evaluated, it receives an EAL rating that indicates how thoroughly design, testing, and in some cases formal methods were applied to verify its security properties. This international framework (ISO/IEC 15408) is precisely about defining and validating security capabilities with a transparent assurance level.

Other options don’t fit this combination. CSA STAR centers on cloud security trust and risk assessments, not a standardized, EAL-based evaluation of products. The NIST Cybersecurity Framework is a broad risk-management framework, not a formal product-level assurance scheme. COPPA is a privacy regulation focused on protecting children's data, not security evaluations.