The live version of the catalog can be found here: https://commoncriteria.github.io/xml-builder/
The Protection Profile (PP) XML Builder is a form-filling application that allows a user to either import, edit, and export PP XML files, or to generate a PP XML file from an empty template. No knowledge of XML is needed to edit or generate a PP XML file.
- The tool is currently designed to assist in the development of Base PPs, Functional Packages (FPs), and Modules (MODs). When opening the tool, a user will be presented with a blank form that can be filled out with many editable sections such as Overview, Threats, Objectives, and Security Functional Requirements (SFRs).
- The tool currently allows for the import of Base PPs, FPs, and MODs. To work with a Base PP (Application, Mobile Device, Operating System, Virtualization, General Purpose Computing Platforms), Functional Package (TLS), or Module (VPN Client), download the xml file you wish to work with from the associated GitHub Repo and import it into the tool using the “File Options/Configure XML Settings” menu option in the navigation bar on the left-hand side.
- Once loaded, the tool will be filled with data from the PP, FP, or MOD. Some of this data will not be visible/editable, but will be generated by the transforms process when the xml file produced by the tool is loaded into the GitHub repo for that PP.
- SFR Creation: The SFR section allows a user to easily view all imported SFRs and to create new SFRs without requiring knowledge of XML, but still produces well-formed, usable XML for the purposes of creating release documents through the use of the transforms process, and for the purposes of automation.
- Tests: Tests have been standardized into a testlist -> test format. If the imported XML implements a different tag structure, the information from those tags will be loaded into a general-purpose textbox. The text in that textbox can then be moved to the correct testlist/test structure (with dependencies).
- Extended Component Definition (ECD): Extended Component Definitions are supported for all PPs. Application SW PP version 1.4 will not display any Extended Component Definitions when loaded, but they may be added via the tool’s functions.
- XML Preview/export: There is an XML preview toggle on the upper right side of the tool which will allow a user to view the XML that will be generated upon export. There is an export option in the left-hand navigation bar that will allow a user to download the generated XML to their downloads folder.
- Tables: Tables within sections, Audit tables, Management Function tables, and tables in rich-text editors in certain sections are all supported. This includes the new "Tabularize" table format. (Currently only found in General Purpose Computing Platform PP)
- Application Software 1.4
- Application Software 1.4 CC2022 Direct Rationale
- Application Software 2.0 CC2022 Direct Rationale
- Enterprise Session Controller 2.0 CC2022 Direct Rationale
- ESM-EDR 2.0 CC2022 Direct Rationale
- ESM-HA 2.0 CC2022 Direct Rationale
- File Encryption 2.0 CC2022 Direct Rationale
- File Encryption Enterprise Management 2.0 CC2022 Direct Rationale
- GPCP 1.0
- GPCP 2.0 CC2022 Direct Rationale
- GPOS 4.3
- IPS 2.0 CC2022 Direct Rationale
- Lifi Access Systems 1.0 CC2022 Direct Rationale
- MACsec 2.0 CC2022 Direct Rationale
- MDF 3.3
- SDN Controller 1.0 CC2022 Direct Rationale
- Session Border Controller 2.0 CC2022 Direct Rationale
- TLS 2.1 CC2022 Direct Rationale
- Virtualization 1.1
- VPN Client 2.6 CC2022 Direct Rationale
- VPN Client 3.0 CC2022 Direct Rationale
- VVOIP 2.0 CC2022 Direct Rationale
- Images: Support for creation of images is not yet implemented.
- Exact Formatting: The output from this tool will differ slightly in formatting and order due to being automatically produced rather than hand-written.
- ECD: Currently the ECD is a straight pass through to export. This is a known issue and is a planned area of focus for upcoming phases.
- Platform dependencies: The tool supports platform dependencies only in the Tests section of the Evaluation Activity. This is a known issue and is a planned area of focus for upcoming phases.
Note
This tool is a proof-of-concept and is in “Phase 4” of development.
- Audit Tables: Audit tables are now imported into the tool and exported if the FAU_GEN (Audit Data Generation) SFR is present.
- Management Function Tables: Management tables are now present in the FMT_SMF (Specification of Management Functions) SFR, and can be edited by double clicking the table cells.
- Security Assurance Requirements (SARs): SARs are now imported into the tool, are editable, and will be exported.
- Rich-Text Editor Tables: Users may now create tables in rich-text editors. Tables can be resized using cell indicators that appear upon selection.
- Tabularize Tables: The tabularize table format is now supported.
- "Invisible" SFR categorization option: SFRs may now be categorized as "invisible" which should only be used in certain rare cases. please see the tooltip within the tool or the github.com/commoncriteria wiki for more information.
- Faster XML File Loading: XML Files now load more quickly.
- XML File Load Indicators: Users can now see what sections of the file have been loaded during import.
- Numerous Formatting Corrections: Tests, paragraphs, spacing, and line breaks are more consistent with released documents.
- Numerous Quality-of-Life Improvements: Certain sections are collapsed or open by default, tooltips have been added, and navigation has been made easier for some sections.
The Phase 2 implementation does not allow for editing of the following elements, and supports pass-through export only:
- Include-pkg and module related external dependencies.
- Most appendices beyond A, B, and C. Several of these appendices will be generated by the transforms when uploaded to GitHub based on selections made in the SFR section.
- Common Criteria 2022 Support: Creating CC2022 Standard and CC2022 Direct Rationale PPs from scratch as well as converting a 3.1 versioned PP to CC2022 Standard or CC2022 Direct Rationale. Key differences include changes to the Conformance, Threats, and SARs sections.
- Appendices: Add rich-text editors to the appendices which are not generated from transforms to allow user input. Additionally include these sections in the exported XML.
- New rich-text editor: Allows better html table support and formatting of cells.
- Organizational Security Policies (OSPs): Added the parsing of the OSPs when importing PPs.
- Deletion Modals: Added user confirmation modals when deleting sections or artifacts in the tool.
- Faster text rendering: Regular text boxes in the tool would previously lag when typing into them.
- Functional Package Support: Creating CC2022 Standard and CC2022 Direct Rationale Functional Packages from scratch as well updating existing CC2022 Versioned Functional Packages
- Module Support: Creating CC2022 Standard and CC2022 Direct Rationale Modules from scratch as well updating existing CC2022 Versioned Modules
- Formatting enhancements of the exported XML to better align with the HTML document formatting.
- XML Import optimization that drastically reduces the loading of XML documents from minutes to seconds.
Note
THIS REPO IS THE FOURTH DEPLOYMENT OF A PROTOTYPE AND EVALUATION TOOL. IT IS NOT MEANT FOR GENERAL USE.
Please provide any feedback you have to the issues board associated with this repo. Your feedback will help this tool or any that comes after it and is greatly appreciated! https://commoncriteria.github.io/XML-Builder/issues This software was produced for the U.S.Government under Basic Contract No.W56KGU - 18 - D-0004, and is subject to the Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation Clause 252.227 - 7014(FEB 2014) © 2026 The MITRE Corporation.