software acquisition community are trifold: to obtain a basis for defining
security evaluation criteria in solicitations for commercial software
applications, components, and systems, and contracted software
development services; to identify security evaluation techniques that