Introduction
From the CCDB-established Working Group, the iTC for Application Software (AppSW-iTC for short) was formed. The AppSW-iTC consists of members of Certification Bodies, labs and vendors working together to create requirements for application security testing.
To join the AppSW-iTC, please send a message to: cm-itc-mailing-list@gmail.com
Current Status
The AppSW-iTC has published the version 1.0e Public Release of the collaborative Protection Profile (cPP) and Supporting Document (SD) as of February 15th, 2024.
The Current Documents for Review section provides links to the documents under review.
Current Documents for Review
Version 2.0 Public Review Draft 1
- Review Package Date
-
August 17, 2026
- Public Review Opening Date
-
September 9, 2026
- End of Comment Period
-
October 24, 2026
- Status
-
Public Review Draft 1
The AppSW-iTC has opened the Version 2.0 document set for public review. This draft is based on the NIAP Protection Profile for Application Software, Version 2.0, and includes the AppSW-iTC distributed TOE, microservices, module, and PP-Configuration updates.
See the Version 2.0 public-review overview for a high-level explanation of the rebase, the re-layered Server and Agent modules, and the substantive additions that are particularly relevant to review.
Reviewers are encouraged to provide comments by opening an issue in the AppSW-iTC repository. Select the template that fits the cPP, Supporting Document, PP-Module, or PP-Configuration; identify the document and section; and include a proposed resolution where possible.
| Title | Version | Links |
|---|---|---|
Collaborative Protection Profile for Application Software |
2.0 Draft |
|
Supporting Document Mandatory Technical Document: Evaluation Activities for Collaborative Protection Profile for Application Software |
2.0 Draft |
|
PP-Module for Application Software Server |
2.0 Draft |
|
Supporting Document Mandatory Technical Document: Evaluation Activities for PP-Module for Application Software Server |
2.0 Draft |
|
PP-Module for Application Software Agent |
2.0 Draft |
|
Supporting Document Mandatory Technical Document: Evaluation Activities for PP-Module for Application Software Agent |
2.0 Draft |
|
PP-Configuration for Enterprise Server Applications |
2.0 Draft |
|
PP-Configuration for Enterprise Server Applications and Agent/Application Component(s) |
2.0 Draft |
|
Current Published Documents
Version 1.0e
- Publication Date
-
February 15, 2024
- Sunset Date
-
Active
- Retired Date
-
Active
The following are the documents are included in Version 1.0e:
| Title | Version | Links | Latest TD Version | Links |
|---|---|---|---|---|
collaborative Protection Profile for Application Software - [cPP_APP_SW] |
1.0e |
|
||
Supporting Document Mandatory Technical Document: Evaluation Activities for collaborative Protection Profile for Application Software - [SD_APP_SW] |
1.0e |
|
||
collaborative Protection Profile for Application Software - Allowed With List |
1.0e |
|
||
collaborative PP-Module for Server Applications [MOD_Server] |
1.0e |
|
||
Supporting Document Mandatory Technical Document: Evaluation Activities for collaborative Protection Profile Module for Server Applications [SD_MOD_Server] |
1.0e |
|
||
PP-Configuration for Enterprise Server Applications [cPP + MOD_Server] |
1.0e |
|
||
collaborative PP-Module for Agent Applications [MOD_Agent] |
1.0e |
|
||
Supporting Document Mandatory Technical Document: Evaluation Activities for collaborative Protection Profile Module for Agent Applications [SD_MOD_Agent] |
1.0e |
|
||
PP-Configuration for Enterprise Server Applications and Client Agent(s) [cPP + MOD_Server + MOD_Agent] |
1.0e |
|
| Title | Link |
|---|---|
cPP + Modules V1.0e Release package |
|
Version 1.0
- Publication Date
-
April 6, 2022
- Sunset Date
-
Active
- Retired Date
-
Active
The following are the documents are included in Version 1.0:
| Title | Version | Links | Latest TD Version | Links |
|---|---|---|---|---|
collaborative Protection Profile for Application Software - [cPP_APP_SW] |
1.0 |
|
||
Supporting Document Mandatory Technical Document: Evaluation Activities for collaborative Protection Profile for Application Software - [SD_APP_SW] |
1.0 |
|
||
collaborative Protection Profile for Application Software - Allowed With List |
1.0 |
|
||
collaborative PP-Module for Server Applications [MOD_Server] |
1.0 |
|
||
Supporting Document Mandatory Technical Document: Evaluation Activities for collaborative Protection Profile Module for Server Applications [SD_MOD_Server] |
1.0 |
|
||
PP-Configuration for Enterprise Server Applications [cPP + MOD_Server] |
1.0 |
|
||
collaborative PP-Module for Agent Applications [MOD_Agent] |
1.0 |
|
||
Supporting Document Mandatory Technical Document: Evaluation Activities for collaborative Protection Profile Module for Agent Applications [SD_MOD_Agent] |
1.0 |
|
||
PP-Configuration for Enterprise Server Applications and Client Agent(s) [cPP + MOD_Server + MOD_Agent] |
1.0 |
|
| Title | Link |
|---|---|
cPP + Modules V1.0 Release package |
|
Technical Decisions
Technical Decisions produced by the AppSW-iTC be found at the AppSW-iTC Technical Decisions page.