You can see the SKPP certification requirements here: https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_hr_v1.03.pdf https://www.commoncriteriaportal.o

You can see the SKPP certification requirements here: https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_hr_v1.03.pdf https://www.commoncriteriaportal.org/files/ppfiles/pp_skpp_h... You can see the Security Target specification and how it conforms here: https://www.commoncriteriaportal.org/files/epfiles/st_vid10362-st.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid103... You can see the certification report here: https://www.commoncriteriaportal.org/files/epfiles/st_vid10362-vr.pdf https://www.commoncriteriaportal.org/files/epfiles/st_vid103... Of note in the certification requirements are: "For example, SKPP separation mechanisms, when integrated within a high assurance security architecture, are appropriate to support critical security policies for the Department of Defense (DoD), Intelligence Community, the Department of Homeland Security, Federal Aviation Administration, and industrial sectors such as finance and manufacturing." AVA_VLA_EXP.4 Highly Resistant on page 116: "The NSA evaluator shall perform an independent vulnerability analysis." "The NSA evaluator shall perform independent penetration testing." "The NSA evaluator shall determine that the TOE is resistant to penetration attacks performed by an attacker possessing a high attack potential." First party NSA penetration test and analysis certifying it is appropriate for critical DoD systems. Note that the system is used on the F-35. ADV_FSP_EXP.4 Formal Functional Specification on page 92: "The developer shall provide a formal presentation of the functional specification of the TSF." Formal specification of the code. "The evaluator shall determine that the functional specification is an accurate and complete instantiation of the TOE security functional requirements." Formal specification matches the requirements. ADV_IMP_EXP.3 Structured Implementation of the TSF on page 93: "The developer shall make available, the implementation representation for the entire TSF." Full source code provided to evaluator. "The implementation representation shall unambiguously define the TSF to a level of detail such that the TSF can be generated without further design decisions." Source -> Binary translation is verified.