A Protection Profile (PP) is a document stipulating the security functionality that must be included in a product. Organisations can have confidence that evaluations against PPs will cover the expected security functionality of a given product type and address known cyber threats.
In the past, evaluations were conducted at a specified Evaluation Assurance Level (EAL); however, PPs do not incorporate this scale. A cap of EAL 2 will apply to all EAL-based evaluations where a suitable PP does not yet exist. EAL-based evaluations will not be considered where a suitable PP already exists.
The ACA endorses all collaborative Protection Profiles that are listed on the Common Criteria website. In addition, the below table includes PPs that are also endorsed by the ACA for an evaluation within the AISEP.
Protection Profiles endorsed by the Australian Certification Authority
| Technology | Protection Profile | Version | Published |
|---|---|---|---|
| Application software | Protection Profile for application software | V1.4 | 2021-10-07 |
| Certificate authority | Protection Profile for certification authorities | V2.1 | 2017-12-01 |
| Network and network-related devices and systems | PP-module for Virtual Private Network (VPN) gateways (Mod_VPNGW_v1.3) | V1.3 | 2023-08-16 |
| Network and network-related devices and systems | PP-module for MACsec Ethernet encryption | V1.0 | 2023-03-02 |
| Network and network-related devices and systems | PP-module for intrusion prevention systems (Mod_IPS_v1.0) | V1.0 | 2021-05-11 |
| Peripheral switch | Protection Profile for Peripheral Sharing Device | V4.0 | 2019-07-19 |
| Peripheral switch | PP-module for keyboard/mouse devices | V1.0 | 2019-07-19 |
| Peripheral switch | PP-module for video/display devices | V1.0 | 2019-07-19 |
The ACA follows the transition end-date of NIAP-developed PPs as published on the NIAP’s website. During the transition window, products will be accepted for evaluation against the preceding version of the PP. All product evaluations submitted after the transition end-date will only be accepted by the ACA for evaluation against the new version of NIAP-approved PP.
Protection Profiles under consideration by the Australian Certification Authority
The below table includes PPs that are based on technologies that align with the Information Security Manual and are under consideration by the ACA as suitable for an evaluation within the AISEP.
| Technology | Protection Profile | Version | Published |
|---|---|---|---|
| Mobility | Protection Profile for mobile device fundamentals | V3.3 | 2021-04-15 |
| Network encryption | Functional package for TLS | V2.0 | 2019-02-12 |
| Peripheral switch | PP-module for analogue audio output devices | V1.0 | 2019-07-19 |
| Peripheral switch | PP-module for audio input devices | V1.0 | 2019-07-19 |
| Peripheral switch | PP-module for user authentication devices | V1.0 | 2019-07-19 |
Other PPs from the National Information Assurance Partnership may be considered on a case-by-case basis.
Need help with AISEP?Contact the Australian Certification Authority for program and certification enquiries. | Related resources |