IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
On the basis of the shortlist drawn up during the preselection stage, those
products should be selected which are to be tested. A test plan is then
compiled.
This plan comprises the following:
- Determining the contents of the test on the basis of the Requirements
Catalogue
- Checking references
- Determining the total testing time
- Time planning, including time required for each test
- Determining persons-in-charge of testing
- Testing environment
- Contents of the test documentation
- Determining decisive criteria
These points are described in detail below.
Determining the contents of the test on the basis of the Requirements
Catalogue
The requirements which are to be tested are selected on the basis of the
Requirements Catalogue. In particular, these should be the features which are
of great importance or which have a high confidence factor.
Checking references
Initial references were obtained during the preselection stage (see S 2.81
Preselection of a Suitable Standard Software Product). These can also be
obtained if the external test group gives rise to sufficient confidence.
If a certificate was issued for the product in accordance with the criteria for
the evaluation of the security of IT systems (ITSEC) or the Common Criteria
(CC), the certification report should be used to check to what extent the test
results can be taken into consideration.
An internal test can either be dispensed with or conducted on a small scale.
The test capacities this leaves free can be distributed among other tests.
Determining the total testing time
In order to limit the time required for testing, the total time should be
determined in advance, e.g. in working days or by setting a deadline.
Time planning, including time required for each test
When testing several products, it is recommended to run comparative tests.
This means that all products are tested by one test group or in regard to one
requirement of the Requirement Catalogue. The testing time should thus be
determined for each requirement of the Requirement Catalogue and is thus
automatically distributed evenly among all products to be tested. The testing
time results from the testing depth and complexity of the feature. The testing
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000