What is the difference between NIAP CCEVS evaluated products and NSA approved products?
Products found on the NIAP Validated Products List (VPL) have been tested and shown to meet the security requirements articulated in their associated security targets. Residing on the VPL, by itself, is not grounds for NSA or NIST endorsement of the product. It is only an acknowledgement that the product’s security claims have been tested using a Common Evaluation Methodology and that those claims have been shown to be true to a certain level of confidence (i.e., It does not make a statement that the claims that were made were indeed the right ones to make.) However, some products on the NIAP VPL will be approved by NSA. Specifically, products that meet one of NSA’s approved Protection Profiles that have been written for various technologies (e.g., operating systems, firewalls) fall into this category. The NIAP Validated Products List clearly annotates those products that are compliant to NSA approved Protection Profiles. In addition to products that meet approved NSA protection profil
