What is CTAS?
CTAS is an independent, technical security evaluation of a system or product for a government department (or possibly a CNI) customer. CTAS is carried out by approved evaluation companies with support from CESG and results in advice on the extent to which technical risks have been addressed. CTAS is designed to meet the needs of HMG Infosec Standard 1(IS1) and equivalent documents like JSP440. Evaluations focus on the technical security of systems, COTS products and bespoke components within a system context. Procedures associated with technical security can also be included within scope but evaluations do not extend to an assessment of physical or personnel security. It does not deal with cryptography as this is covered by the CAPS scheme. As far as availability is concerned, the evaluations can consider resilience against malicious denial of service attacks, but in general will not consider reliability or redundancy (although this might be reviewed in future). CTAS has been designed
