In the Common Criteria, an implementation-independent statement of
security needs for a set of IT security products that could be built is called a:

A.
Package.

B.
Security Target (ST).

C.
Target of Evaluation (TOE).

D.
Protection Profile (PP).

Explanation:
The correct answer is “Protection Profile (PP)”. Answer a, ST, is a statement of security
claims for a particular IT product or system.
* A Package is defined in the CC as an intermediate combination of security requirement
components.
* ATOE is an IT product or system to be evaluated.