Who is responsible for producing the Security Target?
The CTAS evaluation company is responsible for ensuring that a Security Target has been produced but who actually produces it is not important. The Security Target could in fact be written by the Customer, Sponsor, CTAS evaluation company, CLAS Consultant, CLEF or by another party. For example, the Sponsor may already have a draft Security Target before they approach CTAS evaluation companies or they might ask the evaluation company to produce a Security Target as part of the package of work. The Security Target must be agreed by key stakeholders (including Accreditor and CESG) before the evaluation begins.
