In the United States, for example, the National Security Telecommunications and Information Systems Security Policy #11 stipulates that departments and agencies within the Executive Branch, such as the Department of Defense, may only employ within national security systems Common Criteria certified technology.