https://www.giac.org/paper/gsec/3089/applying-common-criteria-certification-accreditation-department-defense-unclassified-information-technology-systems/105134