Composed TOE testing (ACO_CTT)

Objectives

498 This family requires that testing of composed TOE and testing of the base component, as used in the composed TOE, is performed.

Component levelling

499 The components in this family are levelled on the basis of increasing rigour of interface testing and increasing rigour of the analysis of the sufficiency of the tests to demonstrate that the composed TSF operates in accordance with the reliance information and the composed TOE SFRs.

Application notes

500 There are two distinct aspects of testing associated with this family:

a) testing of the interfaces between the base component and the dependent component, which the dependent component rely upon for enforcement of security functionality, to demonstrate their compatibility;

b) testing of the composed TOE to demonstrate that the TOE behaves in accordance with the SFRs for the composed TOE.

501 If the test configurations used during evaluation of the dependent component included use of the base component as a “platform” and the test analysis sufficiently demonstrates that the TSF behaves in accordance with the SFRs, the developer need perform no further testing of the composed TOE functionality. However, if the base component was not used in the testing of the dependent component, or the configuration of either component varied, then the developer is to perform testing of the composed TOE. This may take the form of repeating the dependent component developer testing of the dependent component, provided this adequately demonstrates the composed TOE TSF behaves in accordance with the SFRs.

502 The developer is to provide evidence of testing the base component interfaces used in the composition. The operation of base component TSFIs would have been tested as part of the ATE: Tests activities during evaluation of the base component. Therefore, provided the appropriate interfaces were included within the test sample of the base component evaluation and it was determined in Composition rationale (ACO_COR) that the base component is operating in accordance with the base component evaluated configuration, with all security functionality required by the dependent component included in the TSF, the evaluator action ACO_CTT.1.1E may be met through reuse of the base component ATE: Tests verdicts.

503 If this is not the case, the base component interfaces used relevant to the composition that are affected by any variations to the evaluated configuration and any additional security functionally will be tested to ensure they

Class ACO: Composition

September 2012 Version 3.1 Page 187 of 233

demonstrate the expected behaviour. The expected behaviour to be tested is that described in the reliance information (Reliance of dependent component (ACO_REL) evidence).

ACO_CTT.1 Interface testing

Dependencies: ACO_REL.1 Basic reliance information ACO_DEV.1 Functional Description Objectives

504 The objective of this component is to ensure that each interface of the base component, on which the dependent component relies, is tested.

Developer action elements:

ACO_CTT.1.1D The developer shall provide composed TOE test documentation.

ACO_CTT.1.2D The developer shall provide base component interface test documentation.

ACO_CTT.1.3D The developer shall provide the composed TOE for testing.

ACO_CTT.1.4D The developer shall provide an equivalent set of resources to those that were used in the base component developer's functional testing of the base component.

Content and presentation elements:

ACO_CTT.1.1C The composed TOE and base component interface test documentation shall consist of test plans, expected test results and actual test results.

ACO_CTT.1.2C The test documentation from the developer execution of the composed TOE tests shall demonstrate that the TSF behaves as specified.

ACO_CTT.1.3C The test documentation from the developer execution of the base component interface tests shall demonstrate that the base component interface relied upon by the dependent component behaves as specified.

ACO_CTT.1.4C The base component shall be suitable for testing.

Evaluator action elements:

ACO_CTT.1.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence.

ACO_CTT.1.2E The evaluator shall execute a sample of test in the test documentation to verify the developer test results.

ACO_CTT.1.3E The evaluator shall test a subset of the TSF interfaces of the composed TOE to confirm that the composed TSF operates as specified.

Class ACO: Composition

Page 188 of 233 Version 3.1 September 2012

ACO_CTT.2 Rigorous interface testing

Dependencies: ACO_REL.2 Reliance information ACO_DEV.2 Basic evidence of design Objectives

505 The objective of this component is to ensure that each interface of the base component, on which the dependent component relies, is tested.

Developer action elements:

ACO_CTT.2.1D The developer shall provide composed TOE test documentation.

ACO_CTT.2.2D The developer shall provide base component interface test documentation.

ACO_CTT.2.3D The developer shall provide the composed TOE for testing.

ACO_CTT.2.4D The developer shall provide an equivalent set of resources to those that were used in the base component developer's functional testing of the base component.

Content and presentation elements:

ACO_CTT.2.1C The composed TOE and base component interface test documentation shall consist of test plans, expected test results and actual test results.

ACO_CTT.2.2C The test documentation from the developer execution of the composed TOE tests shall demonstrate that the TSF behaves as specified and is complete.

ACO_CTT.2.3C The test documentation from the developer execution of the base component interface tests shall demonstrate that the base component interface relied upon by the dependent component behaves as specified and is complete.

ACO_CTT.2.4C The base component shall be suitable for testing.

Evaluator action elements:

ACO_CTT.2.1E The evaluator shall confirm that the information provided meets all requirements for content and presentation of evidence.

ACO_CTT.2.2E The evaluator shall execute a sample of test in the test documentation to verify the developer test results.

ACO_CTT.2.3E The evaluator shall test a subset of the TSF interfaces of the composed TOE to confirm that the composed TSF operates as specified.

Class ACO: Composition

September 2012 Version 3.1 Page 189 of 233