Management Advisory: The National Information Assurance Partnership’s Evaluation and Certification Process for Commercial Off-the-Shelf Products

(U) Rec. 1.a.1: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director, revise the product evaluation process to require National Information Assurance Partnership officials to conduct a search of public records for any vulnerabilities disclosed after the Common Criteria Testing Laboratory's last vulnerability search and, if a new vulnerability is discovered, return the product to the Common Criteria Testing Laboratory for additional testing before certifying a product for inclusion on the Product Compliant List.

(U) Rec. 1.b: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director revise the National Information Assurance Partnership Product Compliant List website to include, at a minimum: the core features for each product, the full name of the protection profiles for each product, a list of features of each product that have been tested and certified for use on National Security Systems, and a list of features of each product that have not been tested and not certified for use on National Security Systems.

(U) Rec. 1.d.2: The DoD OIG recommended that the National Information Assurance Partnership Director, in coordination with the National Security Agency Cybersecurity Director develop and implement policy and procedures to require National Information Assurance Partnership officials to disclose that a product has been suspended or removed, including the reason for the suspension or removal, on the Product Compliant List website.