Common Criteria in the Cloud Technical Community Terms of Reference

Editorial decisions (including correction of technical inconsistencies) are made at the discretion of the Technical Editor, in consultation with the Core SMEs and Cloud-TC Chair when needed.

Ideally, technical decisions are made by reaching group consensus (see Section 6.7, “Voting” for a definition). In most cases, the Core SMEs will be able to propose a resolution that is acceptable to the Cloud-TC and the originator of the issue.

As a guideline, decisions are made according to the following process:

Other Cloud-TC members are encouraged to post comments in response to issues and proposed resolutions at any time.

A typical issue should be resolved within a two week period. Some issues may require more time for study and deliberation or due to holidays or other events.

Voting is limited specifically to the members defined at the time the vote is called. Membership in the Cloud-TC is defined as inclusion on the Cloud-TC roster on the CCUF approved collaboration tool.

One vote is allowed for each member organization, not for each individual member, regardless of membership within the Cloud-TC. Organization is defined according to the definition adopted by the CCUF; for commercial enterprises, a parent company and all of its divisions and subsidiaries comprise one organization. It is the responsibility of each organization to determine which individual member will cast a vote on its behalf.

Eligible voting organizations are determined at the time the Call for Votes is sent out based on inclusion on the Cloud-TC mailing list. Any organization not included on this list at the time the Call for Votes is posted is ineligible to cast a vote.

As a guideline, voting takes place according to the following process:

This process is illustrated, below. Timing for each part of the process is provided as a benchmark. A typical voting cycle should be completed within a three-week period. Some voting periods may be longer due to holidays or other events.

Votes submitted shall be explicit: positive, negative, or abstention. A positive vote may be accompanied by editorial or technical comments, on the understanding that the TC Chair or Technical Editor (as applicable) will decide how to deal with them. If a voting member finds the proposal unacceptable, it shall vote negatively and state the technical reasons. It may indicate that the acceptance of specified technical modifications will change its negative vote to one of approval, but it shall not cast an affirmative vote which is conditional on the acceptance of modifications.

A vote is approved if:

Counted votes are determined by the following conditions:

Abstentions are not Counted votes in the final total. They will be noted in the record only.

Essential Patent means any issued or pending patent claim for which its use is necessary (i.e., there is no commercially and technically feasible non-infringing alternative) to fulfill the conformance requirements of the work product(s) including, but not limited to, guidance for cPP and SD authors produced by the Cloud-TC.

Cloud-TC members must inform the Chairperson if they are personally aware of any potential Essential Patent, regardless of the owner or controller of such patents.

As soon as an Essential Patent is identified, the Cloud-TC should seek resolution in the following priority order:

Cloud-TC members are solely responsible for protecting their organization’s proprietary, trade secret, or other sensitive information. The Chairperson, other members, and the technical infrastructure used by the Cloud-TC, do not provide any assurance of such protection.

No copyrights will be asserted on Cloud-TC work products. Cloud-TC members may use such work products but may not assert moral or authorship rights. The use of those work products is controlled by the Common Criteria evaluation process: claims of conformance to the work products are meaningless without Common Criteria certification.

Industry SMEs provide knowledge of the technology area and experience with product evaluation. They also help make appropriate decisions based on their practical knowledge of markets, customer expectations, implementation, and costs.

Lab SMEs provide a solid understanding the evaluation process in the various schemes under the CCRA, and can offer contributions from a unique perspective. They can offer perspective on evaluation activities (what the evaluator does to test or otherwise confirm compliance with requirements), and well as ensuring the requirements are written in such a way that there can be a clear pass/fail criteria.

Common Criteria certification bodies provide knowledge and experience in the expression of functional and assurance requirements in the language of the CC, and help ensure that the cPP and SDs comply with CCRA-accepted standards and practices.

Other SMEs can come from a wide range of background, including government technical experts, end user representatives, as well as consultants or those from academia.