In the current version of the CC (Version 2), systems evaluated at EAL4
and below [283] do not require rigorous security engineering practices. The vast
majority of COTS software, if evaluated at all, is evaluated at or below EAL4. In
addition to these specific reasons for the gap between the studies of software