bodies of knowledge. The tools used for system evaluation in the separate
disciplines of CC and C&A consider software assurance as a minor goal in
the overall certification of the whole system. (C&A typically assesses security
only at the whole-system level.) C&A focuses mainly on infrastructure and