CSfC Components List

Skip to Components List Index

Customers select products from this listing to satisfy the reference architectures and configuration information contained in published Capability Packages. Customers must ensure that the components selected will permit the necessary functionality for the selected architecture.

For some technologies, the CSfC program requires specific, selectable requirements to be included in the Common Criteria evaluation validating that the product complies with the applicable NIAP-approved protection profile(s). Some selections, which are not required for the product to be listed on the NIAP Product Compliant List, are mandatory selections for products that are to be listed on the CSfC Components List.

To see the selectable requirements, go to the CSfC Components List and click on the links for IPSec VPN Gateways, IPSec VPN Clients, WLAN Clients, WLAN Access Systems, Certificate Authorities, MDM, SW FDE, Mobile Platforms, SIP Servers and VoIP Applications.

Open source components may be listed, provided they have a responsible sponsor, and an NSA-approved plan for, taking a component through Common Criteria evaluation and sustainment of the component. Customers wishing to use open source components should contact us with their evaluation and sustainment plans and the responsible parties for each.

Contact us here for questions regarding the CSfC Components List.

Which protection profiles are published and which are in development?

View a current listing of NIAP approved U.S. Government Protection Profiles.

View a listing of U.S. Government Protection Profiles currently in development.

Additional information about NIAP and the Common Criteria Evaluation and Validation Scheme. 

What is the process to get a commercial product CSfC-listed?

In deciding whether a particular product is appropriate for CSfC, NSA considers the totality of circumstances known to NSA, including the vendor's past willingness to fix vulnerabilities, supply chain, foreign ownership, control or influence, the proposed uses of the product under consideration and any other relevant information available to NSA. Vendors of products submitted for consideration under the CSfC process will be notified of NSA's decision on a product-by product basis.

The vendor will enter into a Memorandum of Agreement (MoA) with NSA. The MoA specifies that the vendor's product must be NIAP certified and that the vendor agrees to fix vulnerabilities in a timely fashion. The MoA may also reference technology-specific selections for NIAP testing.

Interested vendors must complete and submit the CSfC Questionnaire (PDF) for each product. Please submit completed questionnaires via email.

An Update to the Manufacturer Diversity Requirement

The manufacturer diversity requirement for CSfC layered solutions has been modified to permit, subject to certain conditions, single-manufacturer implementations of both layers. The manufacturer must show sufficient independence in the code base and cryptographic implementations of the products used to implement each layer. To demonstrate this, a manufacturer must document the similarities and differences between the two products, to include cryptographic hardware components, software code base (i.e. operating system), software cryptographic libraries, and development teams. It is a fundamental requirement that the code bases of the two products be significantly different. Additionally, the vendor must document measures taken to ensure that supply chain risk is no greater than would be the case for products from two different vendors. NSA will review the information and determine whether the documentation is sufficient to meet the requirements for independent layers. Manufacturer diversity will continue to be accepted to constitute independent layers.

Please contact the CSfC PMO at csfc_components@nsa.gov for approved Independence Layer Approval letters.

• Curtiss-Wright DTS1 Implementation Independence Letter
  • (1) The Curtiss-Wright DTS1 Hardware Encryption Layer (v5.4)
  • (2) The Curtiss-Wright DTS1 Software Encryption Layer (v3.01.00)
• Samsung Electronics Co., Ltd
  • (1) Platform Encryption: Samsung Galaxy Devices on Android 13
  • (2) File Encryption: Samsung Knox File Encryption 1.5

Vendors who wish to submit a statement may do so via email.

Components List Index

• Archived Components List
• Authentication Server
• Certificate Authority
• Client Virtualization Systems
• E-mail Clients
• End User Device / Mobile Platform
• File Encryption
• Hardware Full Drive Encryption
• IPS
• IPsec VPN Client
• IPsec VPN Gateway
• MACSEC Ethernet Encryption Devices
• MDM
• Session Border Controller
• Enterprise Session Controller
• Software Full Drive Encryption
• TLS Protected Servers
• TLS Software Applications
• Traffic Filtering Firewall
• VoIP Applications
• Web Browsers
• WIDS/WIPS
• WLAN Access System
• WLAN Client

Authentication Server

Click for Selections

Certification Authority

Click for Selections

Client Virtualization Systems

Click for Selections

E-mail Clients

Click for Selections

End User Device / Mobile Platform

Click for Selections

File Encryption

Click for Selections

Hardware Full Drive Encryption

Click for Selections

​Note: Products that only fulfill Authorization Acquisition (AA) OR the Encryption Engine (EE) are reflected as AA or EE in the notes column next to the appropriate product. HWFDE products falling into these split evaluations categories must be used with another AA or EE product from the HWFDE product list so that both the AA and EE are met. If a registration is using an AA or EE that is not on the product list, a Deviation Request for requirement DAR-PS-7 must be submitted.

IPS

Click for Selections

IPsec VPN Client

Click for Selections

IPsec VPN Gateway

Click for Selections

MACSEC Ethernet Encryption Devices

Click for Selection

MDM

Click for Selections

Session Border Controller

Click for Selections

Enterprise Session Controller (aka SIP Server)

Click for Selections

Software Full Drive Encryption

Click for Selections

TLS Protected Servers

Click for Selections

TLS Software Applications

Click for Selections

Note: Components listed here are validated for their ability to establish a TLS connection as specified in the Capability Packages.  Additional functionality not described within the Capability Packages and evaluated by the Protection Profile for Application Software are beyond the scope of CSfC approval.

Traffic Filtering Firewall

Click for Selections

VoIP Applications

Click for Selections

Web Browsers

Click for Selections

WIDS/WIPS

There is currently no WIDS/WIPS Selection document.

WLAN Access System

Click for Selections

WLAN Client

All validated End User Device / Mobile Platform components include validated WLAN Client implementations