perpetuated in the CC are the inadequacies of the evaluation processes [e.g., the
National Information Assurance Partnership (NIAP) CC Evaluation Program]
with regard to their omission of direct vulnerability testing of the software
components of systems under evaluation. Moreover, the vulnerability analyses