Final IT products, meaning the ones that are ready to be used by final consumers, consist typically of different components (both software and hardware) produced by different manufacturers.
Final IT product manufacturers and integrators can build their products on top of already certified components. Creating a new IT product which relies on cybersecurity properties offered by the underlying components.
- More information
Component manufacturers may not exactly know how their components will be used and integrated in the final IT product. Therefore, technical composition is useful for these cases, as manufacturers can maintain independence on how their components may be used and a single certification can be used to create multiple different compositions, which represent multiple final IT products.
Composition involves taking two or more IT entities already certified and combining them for use, with no further development of either IT entity. The composed TOE (Target of Evaluation) forms a new product that can be installed and integrated into a specific IT environment.
Usually, a composite product consists of two components, whereby the first one represents an underlying platform and the other one is a client running on the platform. The client component is expected to be relying on some of the cybersecurity properties offered by the underlying platform. The following are some examples of typical composition use cases:
- A Smart card, where the underlying platform is an IC (Integrated Circuit) and the client is an Operating System. In this case the Operating System can rely upon some of the cybersecurity properties of the Integrated Circuit (e.g., fault tolerance, cryptographic services, etc.).
- A Smart card, based on Java Card. The underlying platform is the Java run-time, and the client is the Java applet.
The following technical composition use cases were highlighted by the community due to their relevance as success cases and good examples of a certified composite solutions under a EU Certification Scheme.
- The list of documents should be updated once the community reaches an agreement on which documents to post and are considered relevant by the stakeholders.