The A/B, A/B/C, or A/B/C/D switch used for network switching in IP-based VTC systems implementing a single CODEC that supports conferences on multiple networks with different classification levels must be Common Criteria certified.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259898 | SRG-VOIP-000180 | SV-259898r1173869_rule | CCI-002204 | medium |
| Description | ||||
| Common Criteria provides assurance that the process of specification, implementation, and evaluation of a computer security product has been conducted in a rigorous, standard, and repeatable manner at a level commensurate with the target environment for use. The Defense Security/Cybersecurity Authorization Working Group (DSAWG) mandated that the A/B, A/B/C, or A/B/C/D switches used in VTC systems implementing a single CODEC that supports conferences on multiple networks with different classification levels, where these networks are simultaneously and permanently connected to these networks, must receive NIAP approval in accordance with CNSSP #11. This was primarily due to the potential interconnection of separate networks designated as National Security Systems through the switch. This was a prerequisite to their approval of the multinetwork VTC system architecture. Therefore, the A/B, A/B/C, or A/B/C/D switch must be satisfactorily evaluated and validated in accordance with the provisions of the NIAP Common Criteria Evaluation and Validation Scheme. | ||||
| STIG | Date | |||
| Enterprise Voice, Video, and Messaging Policy Security Requirements Guide | 2025-12-23 | |||
Related Frameworks
1 mapping across 3 frameworks
Related Frameworks
SCF0 mappings
No source states a mapping between these directly.
Also reachable in 3 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
- SCF Secure Traceability Relationship Mapping (STRM)2026.2equal to
NIST 800-530 mappings
No source states a mapping between these directly.
Also reachable in 2 hops (1) derived by us, not asserted by any source
Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.
- DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
- DISA CCI List2025-01-23equal to(normalised)
CCI1 mapping
CCI-002204
1.00
- DISA STIG Benchmark (XCCDF)V1R4intersects(normalised)
Details
Check Text (C-259898r1173869_chk)
Review the NIAP Product Compliant List (PCL) at https://www.niap-ccevs.org to verify that a certification exists for the A/B, A/B/C, or A/B/C/D switch or review a vendor-provided letter from NIAP or the NIAP test report indicating satisfactory completion of testing and PCL listing.
Validation of certification via the NIAP PCL can be more easily facilitated if the vendor has provided the certification number.
If the product is not on the list or a NIAP letter or test report is not provided, this is a finding.
Fix Text (F-63536r946614_fix)
Obtain and install an A/B, A/B/C, or A/B/C/D switch that has obtained Common Criteria certification.