Read the second part of the text. Name the topics which are outside the scope of CC.

Certain topics, because they involve specialised techniques or because they are somewhat peripheral to IT security, are considered to be outside the scope of the CC. Some of these are identified below.

a) The CC does not contain security evaluation criteria pertaining to administrative security measures not related directly to the IT security measures. However, it is recognised that a significant part of the security of a TOE can often be achieved through administrative measures such as organisational, personnel, physical, and procedural controls. Administrative security measures in the operating environment of the TOE are treated as secure usage assumptions where these have an impact on the ability of the IT security measures to counter the identified threats.

b) The evaluation of technical physical aspects of IT security such as electromagnetic emanation control is not specifically covered, although many of the concepts addressed will be applicable to that area. In particular, the CC addresses some aspects of physical protection of the TOE.

c) The CC addresses neither the evaluation methodology nor the administrative and legal framework under which the criteria may be applied by evaluation authorities. However, it is expected that the CC will be used for evaluation purposes in the context of such a framework and such a methodology.

d) The procedures for use of evaluation results in product or system accreditation are outside the scope of the CC. Product or system accreditation is the administrative process whereby authority is granted for the operation of an IT product or system in its full operational environment.

Evaluation focuses on the IT security parts of the product or system and those parts of the operational environment that may directly affect the secure use of IT elements. The results of the evaluation process are consequently a valuable input to the accreditation process. However, as other techniques are more appropriate for the assessments of non-IT related product or system security properties and their relationship to the IT security parts, accreditors should make separate provision for those aspects.

e) The subject of criteria for the assessment of the inherent qualities of cryptographic algorithms is not covered in the CC. Should independent assessment of mathematical properties of cryptography embedded in a TOE be required, the evaluation scheme under which the CC is applied must make provision for such assessments.

Grammar tasks. Check your grammar.

Test A.

I. Choose the correct form of the verb.

1. Usually I have/am having breakfast at 8.

2. Look! What are the children doing/do the children do?

3. Hello! I haven’t seen/didn’t see you for ages.

4. Tom has met/met his friends yesterday.

5. When I last have seen /saw her, she went/ was going to Moscow.

6. Have you read/did you read all these books? – I have read/read them last month.

7. I have lost /lost my notebook. Have you seen/Did you see it anywhere?

8. If we go/will go shopping, we buy/will buy something tasty.

9. He is so annoyed. If he leave/left earlier, he will catch /would catch the train.

10. I have redecorated/have been redecorating my sitting-room.

It’ll be ready next week.

11. When I went/came home, my mother already cooked/had already cooked dinner.

II. Choose the correct modal verb.

1. I can/have to start my work early in the morning.

You must /should get up early, I think.

2. He can/may swim and play tennis.

3. You can/may come in and sit down.

4. The train has to be/might be late. It depends on the weather.

5. You can/must come and see us! We’ll be happy to see you.

6. I should/have to learn English for my university exam.

7. I might not/can’t talk to my friends’ parents. I don’t speak French.