4. Approval of security products for the protection of defence secrets

4.1 Information system certification

Product approval not only certifies that a product will be able to protect information classified as "confidential" or "secret defense", but also ensures that it will be suitable for use within the very precise framework provided by information system approval. However, for an information system to be approved for processing confidential or "secret defense" information, approval is not enough. The people who have access to the system must have "confidential-defense" or "secret-defense" clearance, and the premises must be suitably protected (e.g. by daily surveillance) or not be vulnerable to Tempest attacks, i.e. it must not be possible to attack the elements of the information system by picking up electromagnetic radiation from the screens, for...