[2600] Question related to ALC_FLR

[UEDA Shigeru <ueda.shigeru@xxxxxxxxxxx>]

Hi

Can I have your opinion regarding ALC_FLR? ( because I have no idea how
to solve my problem )

As you know, ALC_FLR is the "Flaw remediation" which  requires that
discovered security flaws be tracked and corrected by the developer.

However, once corrected, the TOE becomes to be different from the TOE
which was certified. this is my understanding.

So you will need to get certified again with the corrected TOE before
providing it to the customer.

However, ALC_FLR does not require this process.

Is that mean that we leave the risk that vendor provides un-certified
software when he corrected the security bug?

Or, do you (or NIAP) think that corrected TOE is still the certified one ?

Or should we ask vendor to get certified again with the corrected TOE before
providing it to the customer? 

Regards.

Shigeru Ueda.