TrustCB works with trusted expert labs that have been licensed for IT security evaluations through TrustCB’s Lab Licensing program.
Lab capabilities for specific schemes
For details of labs that have been licensed for a specific scheme operated by TrustCB, please refer to the Schemes pages within this website:
TrustCB Lab Licensing
All labs listed above have satisifed the TrustCB Lab Licensing minimum requirements 1 to 3 for at least one scheme. These requirements are as follows.
- The lab shall have a suitable functioning quality system for the control of evaluation tasks. This can be demonstrated through ISO/IEC 17025 accreditation by the national accreditation council of the lab testing activities with the appropriate scope (such as Common Criteria, ISO/IEC 15408, or ISO/IEC 18045).
- The lab shall employ staff who have demonstrable evaluation knowledge, general technical skills, IT skills, and knowledge of IT security evaluation (such as Common Criteria).
While this is partially addressed through the ISO/IEC 17025 accreditation process, TrustCB has a responsibility to ensure that the evaluators employed by the lab have suitable knowledge of the evaluation criteria and methodology, as well as suitable testing skills for the technical domain in which they operate. Evaluators must have completed a recognised evaluator training course and passed the associated examination.
- The lab shall demonstrate suitable security of the organisation’s operations, staff, and processes in relation to evaluation activities.
The lab shall document and apply security operating procedures to control the processes and the handling of evaluation materials (samples and evidence). The security operating procedures shall cover the handling and storage of physical items and the processing, exchange, and storage of electronic items. As such, the procedures must consider the physical location of the lab and the networks and computing equipment used within the lab and remotely.
- The lab shall demonstrate its ability to successfully complete an evaluation.
The lab shall successfully complete a trial evaluation, as specified by TrustCB, applicable to the scheme(s) under which the lab chooses to operate.
Applying for TrustCB Lab Licensing
A lab’s application for Lab Licensing must details of how the lab meets the minimum licensing requirements, including details of ISO/IEC17025 accreditation from a National Accreditation Body (such as the RvA in the Netherlands) to demonstrate the lab has a suitable functioning quality system.
Labs that successfully complete this first step will be invoiced the lab licensing fee in order to go to the next step of an on-site lab audit by TrustCB, for the requested scheme(s).
A lab may only claim to be a Licensed Lab if TrustCB has confirmed a licensing status.
Provisionally licensed (“P”)
Once all aspects of requirements 1-3 have been judged by TrustCB as successfully completed, TrustCB may grant a “provisional license” to the lab. This enables the lab to perform a trial evaluation to show compliance to requirement 4 for a specific scheme.
To users of the lab, “provisionally licensed” reflects confidence in the lab’s technical competence to perform trial evaluation, while full licensing is pending.
Note that there is no time limit to how long a lab can stay in this “provisionally licensed” status, as long as the lab fulfils requirements 1-3, passes the yearly audit and pays the yearly licensing fee(s).
Licensed
Once the trial evaluation has successfully been completed, thereby fulfilling all aspects of requirements 1-4 , TrustCB may confirm the lab as (fully) “licensed” for that scheme.
To users of the lab, “licensed” therefore reflects that at least once the lab has shown it can perform the necessary work and operate within the processes of the scheme.
License renewals
Every year, including the year of application, the lab must pay the yearly license fee(s) and pass an audit for the schemes and technical domains the lab is (intended) to be licensed for. Non-conformities need to be resolved in a timely manner, as determined solely by TrustCB, or the lab’s licensing will be revoked, either partly or completely.
Contact [email protected] for more details