certifiers and evaluators, can establish confidence in the organizational
capability as one input to system or product security assurance
u Standard mechanism for customers to evaluate a provider’s security
engineering capability.