ASD ISM 0280 Choose PP-evaluated products over EAL-based ones
What it says
If procuring an evaluated product, a product that has completed a PP-based evaluation, including against all applicable PP modules (as well as a software bill of materials assessment if applicable), is selected in preference to one that has completed an EAL-based evaluation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishPrefer products evaluated against protection profiles over those with EAL evaluations for procurement purposes.
When choosing products to buy for your organisation, it's better to select those that have been evaluated using protection profiles rather than just a general evaluation level. This is important because it ensures the product meets specific security needs and standards, reducing the risk of security breaches that could expose sensitive data or disrupt operations.
Free. Save your status, tasks and notes.
Why it matters
Opting for PP-evaluated products over EAL helps ensure required security functions are covered, reducing risk from incomplete evaluations.
How to implement
The procurement officer should prioritise purchasing products evaluated with protection profiles.
They can do this by checking if suppliers provide certification documents that confirm the product has met specific security standards under these profiles.
IT managers should make a list of products that need to be evaluated before purchasing.
This ensures any software or hardware has the right certification to meet your organisation's security needs.
Have a meeting with your IT team and procurement officers to review these lists and certifications together.
This helps in making sure everyone understands what protection profiles cover and why it's crucial for the purchase.
The procurement officer should compare products by looking at documentation from suppliers that indicate a protection profile evaluation.
Ensure this documentation is part of the procurement process checklist.
When a product is selected, IT and procurement need to archive the evaluation documents together.
This keeps records organised, making it easy to verify that only properly evaluated products are in use during audits.
Keep it running
Confirm purchases have PP-based certification for all applicable PP modules, and obtain/verify an SBOM assessment where relevant.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The procurement checklist for products.
Look at
Sections where evaluation requirements are listed, such as protection profiles.
Good evidence
Checklist shows clear preference for PP-evaluated products over EAL evaluations.
- Check 2 of 3What an auditor asks for
Good evidence
Document clearly shows the product has undergone PP evaluation and it's up to date.
- Check 3 of 3What an auditor asks for
Ask for
Them to explain how they verify evaluation standards before making a purchase.
Good evidence
Is they understand the difference between PP and EAL evaluations and how they assess these during procurement.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.19.
ISM-0280 requires organisations to select PP-evaluated products in preference to EAL-evaluated products when procuring evaluated products. Annex A 5.19 addresses managing information security risks in supplier relationships more generally, including requirements placed on supplier products and services. ISM-0280 fits as a specific supplier/product assurance selection rule within the wider supplier-relationship management control in Annex A 5.19.
This control partially meets A.5.21.
ISM-0280 requires organisations to prefer procuring products that have completed Protection Profile (PP)-based evaluations (including applicable PP modules and SBOM assessment where relevant) over EAL-based evaluations. Annex A 5.21 requires defining and implementing processes to manage ICT supply chain security risks, which can include setting assurance requirements for procured products. ISM-0280 is a specific procurement assurance criterion within the broader supply-chain risk management expectations of Annex A 5.21.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.