Security Objectives Section

Updated 11 March 2024

A Security Objectives Section is required Protection Profiles and PP-modules unless they are Direct Rationale. For a Functional Package, the Security Objectives section is always optional.

Specifically, for Direct Rationale documents there are still Security Objectives for the Operational Environment, but no Security Objectives for the TOE.

CC:2022: "The security objectives are a concise statement of the intended solution to the security problem. The role of the security objectives is threefold:

• a) provide a high-level, natural language solution of the problem. The security objectives consist of a set of statements without overly much detail that together form a high-level solution to the security problem. The level of abstraction of the security objectives aims at being clear and understandable to knowledgeable potential consumers of the TOE. The security objectives are in natural language;

• b) divide this solution into two part-wise solutions, that reflect the roles of the TOE and its operational environment to address each part of the problem. In a ST the high-level security solution, as described by the security objectives, is divided into two part-wise solutions. These part-wise solutions are called the security objectives for the TOE and the security objectives for the operational environment;

• c) demonstrate that these part-wise solutions form a complete solution to the problem."

The Security Objectives section consists of three sections:

• Security Objectives for the TOE
• Security Objectives for the Operational Environment
• Security Objectives Rationale

The Security Objectives section is declared in either of two ways:

   <section title="Security Objectives" id="sec-uniqueId">

   <sec:Security_Objectives>