What is the objective of NSTISSP #11?
The objective of NSTISSP #11 is to ensure that COTS IA and IA-enabled IT products acquired by the U.S. Government for use in national security systems perform as advertised by their respective manufacturers, or satisfy the security requirements of the intended user. To achieve this objective, the policy requires COTS products be evaluated and validated in accordance with either the International Common Criteria for Information Technology Security Evaluation, or the National Institute of Standards and Technology (NIST) Federal Information Processing Standard (FIPS) 140-2. Supportive of the intent and implementation of NSTISSP #11, the NSA and NIST have collaborated to establish the following two evaluation and validation programs: The National Information Assurance Partnership’s (NIAP) Common Criteria Evaluation and Validation Scheme (CCEVS) Program and the NIST Federal Information Processing Standard (FIPS) Cryptographic Module Validation Program (CMVP) each which target different, but
