Compliant with ISO 15408
1. Introduction
AM-C400/550 are ISO15408 certified, conforming to IEEE2600.2.
In order to use this product in compliance with ISO 15408, it is necessary for the user administrator or service engineer to install and setting according to "Security Functions Installation and Setting List".
Necessary information for carrying out the work is as follows.
1.1 Certified Products
ISO15408 certified products are following models with fax boards installed.
Not applicable if a fax board is not installed.
- AM-C400 with Fax Board (PR3FB1)
- AM-C550 with Fax Board (PR3FB1)
1.2 TOE (Target of Evaluation) version
TOE stands for "Target of evaluation" and it means the scope of ISO15408 certification target.
Certified items are the main unit and manuals (paper-based and electronic file ). The TOE versions certified and the versions of each item are as follows.
| Item | Version | |
|---|---|---|
| TOE | 1.00 | |
| Main unit | Hardware | A |
| Firmware | GL27NC | |
| Fax Board | Super G3/G3 Multi Fax Board/ PR3FB0 | - |
| Manual (paper) | Before Use | 4145053-01 |
| Manual (electronic) | Supplemental Security Guide | NPD7435-01 EN |
| User's Guide | NPD7235-00 EN | |
2. Requirements and restrictions necessary for compliance
The implementation matters and restrictions required for ISO15408 compliance are listed in "Security Functions Installation and Setting List".
This explains "Categorization of security threats for MFP", "Security functions" to counter the threats, "Security functions installation and setting items" and "Limitations or Restrictions".
See “Supplemental Security Guide” for details about installation and settings of security function.
3. Confirm user request
It is conceivable that users requesting ISO 15408 have various requests.
Before selling confirm which one of 1) ~ 3) below is applicable and make optimum installation and setting.
| No. | User's Requests | Procedure of Installation and Setting | ||
|---|---|---|---|---|
| 1 | ISO 15408 is not required | There is no problem in the installation procedure described in the service manual. There is no special installation / setting work. | ||
| 2 | User want to use only certain functions among multiple security functions. (e.g., User want to use only the function of the enable sequential deletion from HDD.) |
Confirm which security features the user wants to use by following the "Security Functions Installation and Setting List". Install and set functions that the user requested.
|
||
| 3 | User want to use in compliance with ISO 15408 |
All installation and setting items marked with "Security Functions Installation and Setting List" are included.
|
4. Outline of Installation and Setting
4.1 Confirmation Items
To use the machine under the ISO15408 certified condition, it is necessary to use the certified firmware.
Basically, it's recommended that using latest firmware version that is released after the certified FW, because it include bug fixed and same security function.
4.2 Confirmation and preparation before visiting customers
Items that need to be checked and prepared beforehand by dealers / service engineers before visiting customers.Extract and explain the items marked with "Security Functions Installation and Setting List".
| Confirmation and preparation | Description |
|---|---|
| Setup request to administrator | In order to satisfy security, ISO15408 judges dealers and service engineers as outsider. For setup procedure written in “Supplement Security Guide”, basically it should be done by User (administrator). |
| Check customer site internet connection | Electronic files (manual, printer driver) need to download by administrator for the installation and setting. |
| PC preparation request | It is necessary to update the certified firmware, to set each security function via the administrator PC. |
| Confirmation of packing box |
Make sure that the product packing box is not unpacked and that there is no obvious damage before transporting to customer site. Since pre-delivery inspection is not possible, unpacking work, initial ink charge, various settings, etc. will be performed on the customer's site. |
| Downloading the certified firmware | Download certified firmware (or latest firmware) from Tech Exchange beforehand, bring with you to customer site.
|
4.3 Details of Installation / Setting
Show the supplementary explanation about installation / setting work described in "Supplemental Security Guide".
As described in 4.2, installation / setting work is basically should be done by User(administrator), but some items require support from the service engineer.
Explain the Items excerpted from separate sheet "Security Functions Installation and Setting List". (Support items of "No." are shaded in yellow.)
| No. | Installation / Setting Item | Comment |
|---|---|---|
| 1 | Checking the shipping package | Make sure that the product packing box is not unpacked and that there is no obvious damage before transporting to customer site. *Can NOT perform Pre-delivery inspection（Ex. Unpacking work, Initial ink charge, various settings, etc. will be performed in customer site. ） |
| 2 | Checking the security label |
Confirm that there is no alteration from factory shipment to installation by "no security label peeling".
|
| 3 | Checking the name and model number of the fax board. |
|
| 4 | Downloading manuals (Refer "Before Use"sheet) |
・Confirm the internet connection customer site/ preparing the PC that can be connected to internet. ・Download the authentication manual from the website described in "Before use". ・Drivers used for authentication evaluation can also be downloaded from the same website.
|
| 5 | Checking digital certificates for the manuals | The certified version of each manual is as follows ー User's Guide: NPD7235-00 EN ー Supplemental Security Guide: NPD7435-01 EN |
| 6 | Checking digital certificates for the firmware (authenticated versions) | The service engineer must download the certification FW (or latest FW) in advance from Tech Exchange and bring it. ー Firmware version：GL27NC （T/I No. : PR25-FWE-0230） |
| 7 | Inserting ink cartridges and loading paper Fax board installation Checking the service person’s operations |
There is no problem in the installation procedure described in the service manual. There is no special installation / setting work. |
| 8 | Turning off/on the printer | - |
| 9 | Connecting the administrator’s computer to the printer by peer-to-peer connection | - |
| 10 | Updating the firmware to an authenticated version | Certification FW can not be updated via USB memory. It is necessary to prepare the PC. |
| 11 |
Making settings on the control panel | - |
| ・Set the administrator password and make the lock setting | Only administrator can change the security setting of this machine. |
|
| ・Log on as the administrator | - | |
| ・Make settings for operation time out | - | |
| ・Make settings for Screen Effect | - | |
| ・Make the storage settings | - | |
| ・Disable maintenance/service mode | The following functions for service support can not be used by disabling. ■Service Support Mode ー USB FW Update Mode ■Service Installer Mode ー USB FW Update Mode ■Authentication Mode ■User Special Mode In addition, Adoministrator password reset and Firmware update will become unusable. |
|
| ・Disable Accept Power Off function | - | |
| ・Disable the Automatic Firmware Update function | - | |
| 12 | Making settings using Web Config ・Make settings for the password policy ・Enable audit log ・Make settings for access control ・Register users, and then select the functions they are allowed to use ・Disable firmware updates using Epson Firmware Updater ・Disable folder operations by PDL ・Disable memory device and PC connection via USB ・Make setting to prevent the printer from starting up if program tampering is detected ・Disable WSD ・Disable RAW(Custom Port) Settings ・Disable IPP ・Select read only for access authority of SNMPv1/v2c ・Disable the SNMPv3 settings ・Disable the IPv6 setting ・Enable sequential deletion from hard disk ・Make the fax send settings ・Make the fax receive settings ・Disable network scan ・Make settings for date and time ・Make settings for default policy ・Make settings for the group policy ・Make settings for the servers mentioned in “System Structure” ・Do not make the following settings using Web Config ・Do not make the following settings using Web Config ・Do not make the following settings using Web Config ・Do not make the following settings using Web Config ・Do not make the following settings using Web Config ・Do not make the following settings using Web Config ・Do not make the following settings using Web Config |
- |
| 13 | Restarting the printer |
- |
| 14 | Connecting to an in-house network | - |
| 15 | Connecting to a phone line | - |
| 16 | Logging on as an administrator and checking the settings | - |
| 17 | Checking product information | Configuration Status Sheet Header - Product name - EPSON Logo <Version> - Main Firmware: GL27NC - Hardware: A - FAX 1 must be listed |
| 18 | Installing the printer driver | Since the driver is not included in the TOE, user can use the latest version of the driver. |
5. Repair work correspondence
Repairing is not scope of ISO 15408. Therefore service engineer will be able to repair as same as normal.
In order to use the device under the condition of ISO 15408 after repairing, it is necessary to follow the procedure below.
- Repair under administrator supervision
- HDD or any other boards, hand over old items to administrator to disposal, or destroy at the place.
- Confirm TOE version is completely same as showing at "TOE (Target Of Evaluation) Version"
If needs to do repair by using following modes, please change the Maintenance service function by administrator.
Service Support Mode USB FW Update Mode Special Setting Mode CE Special Setting Mode 
important / 重要Turn off “Maintenance service function” after repair.