UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Common Criteria Certification Report Symantec Privileged Access Manager 4.3.0 CAN-668-EWA 9 October 2026 v1.0 Centre canadien pour la cybersécurité Communications Security Establishment Canada Canadian Centre for Cyber Security Centre dela sécurité des télécommunications Canada UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Foreword This certification report is an UNCLASSIFIED publication, issued under the authority of the Chief, Communications Security Establishment (CSE). The Information Technology (IT) product identified in this certification report, and its associated certificate, has been evaluated at an approved testing laboratory established under the Canadian Centre for Cyber Security (a branch of CSE). This certification report, and its associated certificate, applies only to the identified version and release of the product in its evaluated configuration. The evaluation has been conducted in accordance with the provisions of the Canadian Common Criteria Program, and the conclusions of the testing laboratory in the evaluation report are consistent with the evidence adduced. This report, and its associated certificate, are not an endorsement of the IT product by Canadian Centre for Cyber Security, or any other organization that recognizes or gives effect to this report, and its associated certificate, and no warranty for the IT product by the Canadian Centre for Cyber Security, or any other organization that recognizes or gives effect to this report, and its associated certificate, is either expressed or implied. If your organization has identified a requirement for this certification report based on business needs and would like more detailed information, please contact: Canadian Centre for Cyber Security Contact Centre and Information Services contact@cyber.gc.ca | 1-833-CYBER-88 (1-833-292-3788) Communications Security Establishment Canada Canadian Centre for Cyber Security ; ; Centre de lasecurite des telecommunications Canada Centre canadien pour la cybersécurité 1 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Overview The Canadian Common Criteria Program provides a third-party evaluation service for evaluating the security of IT products. Evaluations are performed by a commercial Common Criteria Testing Laboratory (CCTL) under the oversight of the Certification Body, which is managed by the Canadian Centre for Cyber Security. A CCTL is a commercial facility that has been approved by the Certification Body to perform Common Criteria evaluations; a significant requirement for such approval is accreditation to the requirements of ISO/IEC 17025, the General Requirements for the Competence of Testing and Calibration Laboratories. By awarding a Common Criteria certificate, the Certification Body asserts that the product complies with the security requirements specified in the associated security target (ST). A security target is a requirements specification document that defines the scope of the evaluation activities. The consumer of certified IT products should review the ST, in addition to this certification report, to gain an understanding of any assumptions made during the evaluation, the IT product's intended environment, the evaluated security functionality, and the testing and analysis conducted by the CCTL. The certification report, certificate of product evaluation and ST are posted to the Common Criteria portal (the official website of the International Common Criteria Program). Communications Security Establishment Canada Canadian Centre for Cyber Security ; ; Centre de lasecurite des telecommunications Canada Centre canadien pour la cybersécurité 2 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ### TABLE OF CONTENTS | Foreword....................................................................................................................................................... | 1 | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------| | Overview ....................................................................................................................................................... | 2 | | Executive Summary CAN-668-EWA ............................................................................................................ | 4 | | Identification of Target of Evaluation ........................................................................................................ | 5 | | Common Criteria Conformance .............................................................................................................. | 5 | | TOE Description ........................................................................................................................................ | 5 | | TOE Architecture ....................................................................................................................................... | 6 | | Security Policy .............................................................................................................................................. | 7 | | Cryptographic Functionality ..................................................................................................................... | 7 | | Assumptions and Clarification of Scope ................................................................................................... | 8 | | Usage and Environmental Assumptions ................................................................................................ | 8 | | Clarification of Scope ............................................................................................................................... | 9 | | Evaluated Configuration ............................................................................................................................ | 10 | | Documentation ....................................................................................................................................... | 10 | | Evaluation Analysis Activities ................................................................................................................... | 11 | | Development ........................................................................................................................................... | 11 | | Guidance Documents ............................................................................................................................. | 11 | | Life-Cycle Support .................................................................................................................................. | 11 | | Testing Activities ....................................................................................................................................... | 12 | | Assessment of Developer tests ............................................................................................................ | 12 | | Conduct of Testing ................................................................................................................................. | 12 | | Independent Testing............................................................................................................................... | 12 | | Vulnerability Analysis ................................................................................................................................ | 13 | | Vulnerability Analysis Results ............................................................................................................... | 13 | | Results of the Evaluation .......................................................................................................................... | 14 | | Recommendations/Comments ............................................................................................................. | 14 | | Supporting Content .................................................................................................................................... | 15 | | List of Abbreviations .............................................................................................................................. | 15 | | References | .............................................................................................................................................. 15 | | YY Communications Security Establishment Canada Centre de la sécurité des télécommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 3 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Executive Summary CAN-668-EWA Symantec Privileged Access Manager 4.3.0 (hereafter referred to as the Target of Evaluation, or TOE), from Broadcom , was the subject of this Common Criteria evaluation. The results of this evaluation demonstrate that the TOE meets the following conformance claim: Standard Protection Profile for Enterprise Security Management - Policy Management Version 2.1 EWA-Canada is the CCTL that conducted the evaluation. This evaluation was completed on 9 October 2026 and was conducted in accordance with the rules of the Canadian Common Criteria Program. The scope of the evaluation is defined by the Security Target, which identifies assumptions made during the evaluation, the intended environment for the TOE, and the security functional/assurance requirements. Consumers are advised to verify that their operating environment is consistent with that specified in the security target, and to consider the comments, observations, and recommendations in this Certification Report. The Canadian Centre for Cyber Security, as the Certification Body, declares that this evaluation meets all the conditions of the Arrangement on the Recognition of Common Criteria Certificates and that the product is listed on the Certified Products list for the Canadian Common Criteria Program and the Common Criteria portal (the official website of the International Common Criteria Program). Communications Security Establishment Canada Canadian Centre for Cyber Security ; ; Centre de lasecurite des telecommunications Canada Centre canadien pour la cybersécurité 4 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Identification of Target of Evaluation The Target of Evaluation (TOE) is identified as follows: Table 1: TOE Identification | TOE Name and Version | Symantec Privileged Access Manager 4.3.0 | |------------------------|--------------------------------------------| | Developer | Broadcom | See the Evaluated Configuration section for more details on the evaluated configuration of the TOE. ### Common Criteria Conformance The evaluation was conducted using the following methodology: Common Methodology for Information Technology Security Evaluation, 2022 Release 1, for conformance to the Common Criteria for Information Technology Security Evaluation, 2022 Release 1 The TOE claims the following conformance: Standard Protection Profile for Enterprise Security Management - Policy Management Version 2.1 ### TOE Description The TOE is a software-based enterprise security management solution that centrally manages policies governing user access to organizational IT resources. Delivered as a virtual appliance, it mediates user access to managed devices and enables administrators to define access-control policies and distribute them to Socket Filter Agents (SFAs) installed on managed devices for enforcement. Administrators manage the TOE through the PAM Client or a web browser. The TOE supports enterprise authentication, records security-relevant audit events, and protects management and policy communications using secure channels. Communications Security Establishment Canada Canadian Centre for Cyber Security ; ; Centre de lasecurite des telecommunications Canada Centre canadien pour la cybersécurité 5 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ### TOE Architecture A diagram of the TOE architecture is as follows: Figure 1: TOE Architecture Communications Security Establishment Canada ; ; Centre de lasecurite des telecommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 6 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Security Policy The TOE implements and enforces policies pertaining to the following security functionality: -  Enterprise Security Management -  Security Audit -  Cryptographic Support -  Identification and Authentication -  Security Management -  Protection of the TSF -  TOE Access -  Trusted Path/Channel Complete details of the security functional requirements (SFRs) can be found in the Security Target. ### Cryptographic Functionality [The TOE makes use of the following ACVP/CAVP validated cryptographic implementation(s):](https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/validation-search) Table 2: Cryptographic Implementation(s) | Cryptographic Implementation | Certificate Number | |--------------------------------|----------------------| | wolfCrypt v5.2.3 | A7470 | Additionally, the TOE uses the following CMVP validated entropy source(s): Table 3: Entropy Source(s) | Entropy Source | Certificate Number | |---------------------------------------------------------------------------------------|----------------------| | Symantec Access Privilege Manager Userspace CPU Time Jitter RNG Entropy Source v3.4.1 | E297 | Communications Security Establishment Canada ; ; Centre de lasecurite des telecommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 7 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Assumptions and Clarification of Scope Consumers of the TOE should consider assumptions about usage and environmental settings as requirements for the product's installation and its operating environment. This will ensure the proper and secure operation of the TOE. ### Usage and Environmental Assumptions The following assumptions are made regarding the use and deployment of the TOE: -  The TOE will be able to establish connectivity to other ESM products in order to share security data. -  There will be one or more competent individuals assigned to install, configure, and operate the TOE. -  The Operational Environment will provide mechanisms to the TOE that reduce the ability for an attacker to impersonate a legitimate user during authentication. -  The TOE will receive identity data from the Operational Environment. Communications Security Establishment Canada ; ; Centre de lasecurite des telecommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 8 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ### Clarification of Scope The following functionality was not evaluated and is not part of the evaluated configuration: -  Application-to-Application (A2A) functionality -  Redundancy via clustered servers with automatic synchronization -  Secure Sockets Layer (SSL) Virtual Private Network (VPN) service -  REST API and Java API (must be disabled) -  Forwarding of audit records to an external audit server (e.g., Syslog) -  SNMP, RDP Proxy, SSH Proxy, RADIUS, TACACS+, RSA ACE, SAML, SMTP, and Telemetry -  Session recording and threat analytics -  Legacy Access Agent -  Credential Management (password vault, credential rotation and lifecycle management, and A2A credential services) and the Credential Manager CLI; basic authentication services needed for ESM operations remain in scope. -  In the evaluated configuration, the TOE is deployed as a QCOW2 virtual machine under KVM. Other deployment formats were not evaluated. The following configuration settings are required for the evaluated configuration: -  FIPS mode is enabled. -  Connections to the PAM Client use HTTPS. -  Credential validation for web users is performed by an external LDAP server with TLS enabled. -  Credentials for targets are not configured in policies. -  TOE administrators using the PAM Client are assigned the Global Administrator role; other users are assigned the Standard User role. -  SFA Monitoring is enabled for all configured Socket Filter Agents. -  The preconfigured "super" account password is changed to a secure value during installation, and the account is not used after installation. All administrator access is through user accounts added during installation or operation. -  Login timeouts for inactive sessions are not disabled. Communications Security Establishment Canada ; ; Centre de lasecurite des telecommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 9 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Evaluated Configuration The evaluated configuration for the TOE comprises: Table 4: Evaluated Configuration | TOE Software/Firmware | Symantec Privileged Access Manager 4.3.0.1654 | |-------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Environmental Support | Virtualization host running KVM hypervisor (QEMU-KVM 7.2.0) on Debian 12.5 Authentication server supporting LDAPv3 with TLS (e.g., Active Directory on Windows Server 2022) Socket Filter Agent 4.3.0 on Windows Server 2022 Socket Filter Agent 4.3.0 on Red Hat Enterprise Linux 9 | ### Documentation The following documents are available to the consumer to assist in the configuration and installation of the TOE: - a) Symantec Privileged Access Manager 4.3.0 Common Criteria Guidance Supplement, Version 2.5, 13 September 2026 All other PAM Operational User Guidance is available to customers at: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/privilegedaccess-manager/4-3.html Communications Security Establishment Canada ; ; Centre de lasecurite des telecommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 10 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Evaluation Analysis Activities The evaluation activities comprised a structured assessment of the TOE. Documentation and processes related to Development, Guidance Documentation, and Life-Cycle Support were reviewed and analyzed. ### Development The evaluators analyzed the documentation provided by the vendor; they determined that the design completely and accurately describes the TOE security functionality (TSF) interfaces and how the TSF implements the security functional requirements. The evaluators determined that the initialization process is secure, that the security functions are protected against tamper and bypass, and that security domains are maintained. ### Guidance Documents The evaluators examined the TOE preparative user guidance and operational user guidance and determined that it sufficiently and unambiguously describes how to securely transform the TOE into its evaluated configuration and how to use and administer the product. The evaluators exercised the preparative and operational guidance and determined that they are complete and sufficiently detailed to result in a secure configuration. ### Life-Cycle Support An analysis of the TOE configuration management system and associated documentation was performed. The evaluators found that the TOE configuration items were clearly marked. The evaluators examined the delivery documentation and determined that it described all the procedures required to maintain the integrity of the TOE during distribution to the consumer. Communications Security Establishment Canada Canadian Centre for Cyber Security ; ; Centre de lasecurite des telecommunications Canada Centre canadien pour la cybersécurité 11 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Testing Activities Testing consists of the following three steps: assessing developer tests, performing independent tests, and performing a vulnerability analysis. ### Assessment of Developer tests The evaluators verified that the developer has met their testing responsibilities by examining their test evidence, and reviewing their test results, as documented in the Evaluation Test Report (ETR). The correspondence between the tests identified in the developer's test documentation and the functional specification was complete. ### Conduct of Testing The TOE was subjected to a comprehensive suite of formally documented, independent functional and penetration tests. The detailed testing activities, including configurations, procedures, test cases, expected results and observed results are documented in a separate proprietary test results document. ### Independent Testing During this evaluation, the evaluator developed independent functional & penetration tests by examining design and guidance documentation. All testing was planned and documented to a sufficient level of detail to allow repeatability of the testing procedures and results. The following testing activities were performed: - a. PP Assurance Activities: The evaluator performed the assurance activities listed in the claimed PP; - b. Independent Evaluator Testing: Verification of cryptographic implementation; - c. Independent Evaluator Testing: Verification of LDAP integration. #### Independent Testing Results The testing produced the expected results, supporting the conclusion that the TOE correctly implements the functional requirements specified in the ST and the TOE functional specification. Communications Security Establishment Canada Canadian Centre for Cyber Security ; ; Centre de lasecurite des telecommunications Canada Centre canadien pour la cybersécurité 12 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Vulnerability Analysis The evaluators conducted an independent review of all evaluation evidence, public domain vulnerability databases, and technical community sources. Additionally, the evaluators used automated vulnerability scanning tools to discover potential network, platform, and application layer vulnerabilities. Based upon this review, the evaluators formulated flaw hypotheses, which they used in their vulnerability analysis. Public domain searches were conducted on 8 September 2026 and included the following search terms: | Broadcom Privileged Access Manager 4.3 | wolfSSL wolfCrypt 5.2.3 | wolfSSL wolfCrypt 5.9.1 | |------------------------------------------|---------------------------------|---------------------------| | Debian 12.11 | Bouncy Castle bctls-fips 2.1.20 | Intel Xeon E3-1275 v6 | | QEMU 7.2.0 | OpenSSH 9.2p1 | OpenSSL 3.0.13 | | Apache ActiveMQ 5.18.3 | Apache Commons BeanUtils 1.9.2 | Apache HttpClient 4.5.6 | | Apache Tomcat 9.0.83 | Bouncy Castle bc-java 1.70 | OpenLDAP 2.3.39 | | OpenLDAP 2.4.46 | OpenSSL 1.0.2k | PHP 8.2.29 | | Symantec | PAM | Privileged Access Manager | Vulnerability searches were conducted using the following sources: | NIST National Vulnerability Database | CISA Known Exploited Vulnerabilities Catalog | |----------------------------------------|--------------------------------------------------------------| | https://nvd.nist.gov/vuln/search | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | | CVE Program | Broadcom Security Advisories | | https://www.cve.org/ | https://support.broadcom.com/web/ecx/security-advisory | ### Vulnerability Analysis Results The vulnerability analysis did not uncover any security relevant residual exploitable vulnerabilities in the intended operating environment. Communications Security Establishment Canada ; ; Centre de lasecurite des telecommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 13 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Results of the Evaluation The Information Technology product identified in this certification report, and its associated certificate, has been evaluated at an approved testing laboratory established under the Canadian Centre for Cyber Security. This certification report, and its associated certificate, apply only to the specific version and release of the product in its evaluated configuration. The overall verdict for this evaluation is PASS . These results are supported by evidence in the ETR. ### Recommendations/Comments It is recommended that all guidance be followed to configure the TOE in the evaluated configuration. | YY Communications Security Establishment Canada Centre de la sécurité des télécommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 14 UNCLASSIFIED / NON CLASSIFIÉ//TLP:CLEAR ## Supporting Content ### List of Abbreviations | Term | Definition | |--------|---------------------------------------------| | ACVP | Automated Cryptographic Validation Protocol | | CAVP | Cryptographic Algorithm Validation Program | | CCTL | Common Criteria Testing Laboratory | | CMVP | Cryptographic Module Validation Program | | CSE | Communications Security Establishment | | ESV | Entropy Source Validation | | ETR | Evaluation Technical Report | | IT | Information Technology | | PP | Protection Profile | | SFR | Security Functional Requirement | | ST | Security Target | | TOE | Target of Evaluation | | TSF | TOE Security Function | ### References | Reference | |----------------------------------------------------------------------------------------------------------------------------------| | Common Criteria for Information Technology Security Evaluation, 2022 Release 1. | | Common Methodology for Information Technology Security Evaluation, CEM, 2022 Release 1 | | Symantec Privileged Access Manager 4.3.0 Security Target, Version 2.11, 8 October 2026 | | Evaluation Technical Report Common Criteria Evaluation of Symantec Privileged Access Manager 4.3.0, Version 0.14, 9 October 2026 | | Assurance Activity Report Symantec Privileged Access Manager 4.3.0, Version 0.14, 9 October 2026 | Communications Security Establishment Canada Centre de la sécurité des télécommunications Canada Canadian Centre for Cyber Security Centre canadien pour la cybersécurité 15