As announced earlier in 2011, the new Commercial Product Assurance (CPA) scheme is being rolled out to provide a more robust and defined method to assure commercial products for use by government and the wider public sector.
As such, the current CESG Claim Tested Mark (CCTM) scheme is being phased out and any products that have certification under CCTM are expected to seek assurance under the new CPA scheme where possible.
It was always CESG's intention that there would be some degree of crossover in the 2 schemes so as to allow for products to be re-assessed under the newer CPA requirements before their current CCTM certification date expired.
However the planned rollout of key technical documentation (know as Security Characteristics - SCs) will not be completed in time for a smooth transition of products from CCTM to CPA.
Although CESG are taking active steps to minimise this delay, there will be a number of products currently certified under CCTM whose certification will expire and will therefore not be able to be re-certified under either scheme (CCTM or CPA) for a period of months.
The lack of valid certification does not equate to the product not being suitable or able to provide a level of assurance. End users and risk owners should review their assurance requirements and ensure that the CCTM products, whatever the status of individual certification, meet those requirements.
CESG will not be issuing general certification extensions for products at this time, however products that are intended to be assured under a “Priority C” characteristic may apply for an extension if they meet current scheme requirements. This is in line with letters sent to all certificate holders earlier this year.
CESG appreciate that there could be some confusion between a lack of a certificate and an expired certificate. If you are a current CCTM holder or UK government customer and you require more assistance or support on this topic please contact
cctm@cesg.gsi.gov.uk and we will offers further assistance where possible.