Common Criteria: A Global Security Standard
Many software products claim to make your networks secure, but how do you know for sure? Common Criteria (CC) is a framework for evaluating and certifying the security of IT products and systems that is recognized by governments and IT professionals around the world as a critical measure of the quality of an information technology security product. CC certification is increasingly used as one of the key decision-making criteria by local, federal, and international government agencies and is also becoming a key differentiator for many private-sector industries, such as finance and healthcare. You can read more about CC on the Common Criteria site.
ISA Server 2006
Microsoft Internet Security and Acceleration (ISA) Server 2006 has passed Common Criteria Evaluation Assurance Level 4+ (EAL 4+).
The certification work has been performed by the Federal Office for Information Security (BSI), the Common Criteria certification body of the German government.
Microsoft Internet Security and Acceleration (ISA) Server 2006 certification report is available for reading from the BSI website, here.
The CC Guidance Documentation Addendum for ISA Server 2006 is available for download from this page.
ISA Server 2004
Microsoft Internet Security & Acceleration (ISA) Server 2004 has achieved CC Evaluation Assurance Level 4+ (EAL 4+). Level 4 is the highest level possible that is mutually recognized by all countries participating in CC certification. This level provides the deepest evaluation and testing possible from an independent testing laboratory. In addition, ISA Server passed an even more thorough review, earning Level 4+. This CC certificate assures you that the evaluated security features of ISA Server Standard Edition are effective and implemented correctly.
ISA Server 2000 Standard Edition
In September 2003, ISA Server 2000 achieved certification for CC Evaluation Assurance Level 2 (EAL 2). ISA Server CC certification, coupled with the Windows 2000 Server EAL 4 + Flaw Remediation certification, is an important consideration for organizations requiring CC certification.
The Microsoft Commitment to CC Certification
Robust and objective non-Microsoft auditing, as with the certification process involved in CC, is critical for establishing trust in security products. Auditing represents a significant investment and is something that all customers should evaluate when making technology purchases. It is a Microsoft corporate goal to provide rigorous non-Microsoft auditing for all Microsoft security products, at a level comparable to or better than that of other vendors.
