TECHNICAL GROUP
Software Technical Group
Developing shared methods and technical references for consistent software security evaluation under the EUCC scheme.
ABOUT THE GROUP
Purpose and activities
The Software Technical Group develops a common technical reference base for software security evaluations at AVA_VAN.3, AVA_VAN.4 and AVA_VAN.5. Its work supports consistent evaluation practices across laboratories, certification bodies, schemes, developers and other stakeholders involved in the EUCC ecosystem.
The group focuses on three connected deliverables: an Attack Methods Catalogue, a Software Attack Potential Reference and guidance on Minimum ITSEF Requirements. The first outputs are technology agnostic, with product or technology-specific annexes added where they provide practical value.
The group reuses established standards, catalogues and industry experience before developing new material. Its deliverables are maintained as living documents and coordinated with EUCC maintenance activities and the other EUCC ISAC technical groups.
AI-assisted software evaluation is addressed as a cross-cutting activity because it affects evaluation evidence, vulnerability analysis, attack-potential judgements and the capabilities expected from evaluation facilities.
TECHNICAL WORKSTREAMS
Subgroups and chairmen
The subgroups work in parallel and coordinate their outputs through the Software Technical Group plenary.
SUBGROUP 01
Attack Methods Catalogue
A practical catalogue giving laboratories and evaluators a common basis for selecting, performing and justifying software attack methods.
Co-chairmen
Jorge Wallace Ruiz, DEKRA
Mario Alvarez Iregui, NCC Group
SUBGROUP 02
Software Attack Potential
A common reference for rating attack potential in software evaluations, compatible with ISO/IEC 18045 and informed by realistic software attack scenarios.
Chairman
Frank Schönherr, BSI
SUBGROUP 03
Minimum ITSEF Requirements
Guidance on the minimum competence, methods, tools, infrastructure, reporting and evidence-handling capabilities required for software security evaluations.
Chairman
Nils Tekampe, Konfidas
CROSS-CUTTING ACTIVITY
AI-assisted Software Evaluation
Practical analysis of how AI affects evidence review, vulnerability research, attack-potential factors, confidentiality and evaluator control.
Co-chairmen
Philippe Proust, Thales
Jorge Wallace Ruiz, DEKRA
GROUP LEADERSHIP
Technical Group Leader
Philippe Proust, Thales
Chairman
