TMWD Tumbleweed Communications Corp (MM)

Tumbleweed(R) Communications Corp. (NASDAQ:TMWD), a leading provider of email security, file transfer security, and identity validation software and appliances, today announced the Tumbleweed Validation Authority(TM) product suite has achieved Common Criteria Evaluation Assurance Level (EAL) 3 certification, the strongest protection profile for public key infrastructure (PKI) products. The certification, which encompasses Tumbleweed Validation Authority responder, repeater, and delegated models of deployment, demonstrates Tumbleweed's commitment to government and commercial requirements worldwide for enterprise-level PKI validation solutions. Based on widely adopted open standards and technologies, the Tumbleweed Validation Authority solution validates the status of digital certificates in real time, ensuring that revoked credentials cannot be used for secure email, smart card login, web access, wireless, VPN, or other electronic transactions. The Tumbleweed Validation Authority solution is the most widely deployed PKI validation solution in the world. The U.S. Department of Defense, all branches of the U.S. military, the U.S. Department of Homeland Security, the U.S. intelligence community, and top financial institutions globally rely on the Tumbleweed Validation Authority solution to secure their PKI transactions. "Government and commercial organizations around the world are confronting increasingly complex threats to their networks, data, and users, and Tumbleweed's identity validation technology offers a proven approach to protecting and preserving the integrity of communications," said Ann Smith, Vice President of Federal Sales for Tumbleweed. "This new certification demonstrates Tumbleweed's continued leadership in PKI and provides Validation Authority(TM) customers with the assurance that their chosen solution has been tested rigorously against a comprehensive list of internationally recognized security requirements." The Common Criteria certification serves as an independent, impartial security evaluation that verifies the functional reliability and security of the Tumbleweed Validation Authority product suite. The National Information Assurance Partnership (NIAP), the Common Criteria Evaluation and Validation Scheme (CCEVS), and the Common Criteria Recognition Arrangement (CCRA) awarded the certification on June 8, 2006. Government agencies and commercial enterprises worldwide use Common Criteria certification as a determining factor in procuring information technology products. To date, 24 countries have adopted and recognize the Common Criteria certification, allowing governmental and commercial organizations operating in these nations to purchase information technology products with the confidence that they are in compliance with widely accepted security standards. Science Applications International Corp. (SAIC), an accredited independent Common Criteria testing lab, evaluated the Tumbleweed Validation Authority product suite against the "Certificate Issuing and Management Components Family of Protection Profiles, Security Level 3", the strongest profile for PKI products. SAIC adheres to strict standards, considers numerous real-world deployment scenarios, and conducts rigorous and exhaustive testing at the source-code level to determine certifications. The Tumbleweed Validation Authority solution has also completed multiple independent security evaluations and certifications, more than any other PKI validation product on the market. For additional information on current evaluations and certifications, go to: http://www.tumbleweed.com/products/validationauthority/compliance.html About Tumbleweed Validation Authority Tumbleweed Validation Authority (VA), the leading identity validation solution, enables banks, governments, and businesses worldwide to secure highly valued and trusted transactions, ranging from corporate network access to multi-million dollar electronic transactions to physical access of military facilities. VA is a fourth-generation product line, offering a comprehensive, scalable, and reliable framework for real-time validation of digital certificates, based on numerous well-accepted international security standards and open technologies. VA is Certificate Authority neutral, FIPS 140-1, DOD JITC, Identrust, and Common Criteria compliant, as well as part of the Identrust, SWIFT Trust Act, BACS and Global Trust Authority financial trust infrastructures. VA has been deployed by hundreds of customers worldwide for over ten years, including the U.S. Department of Defense and all branches of the U.S. military which utilize VA to check the status of more than 3.5 million Common Access Cards used to secure system and network access, email, and other mission-critical resources. SAFE HARBOR STATEMENT Tumbleweed cautions that forward-looking statements contained in this press release are based on current plans and expectations as of the date of this press release, and that a number of factors could cause the actual results to differ materially from the guidance given at this time. These factors are described in the Safe Harbor statement below. Except for the historical information contained herein, the matters discussed in this press release may constitute forward-looking statements that involve risks and uncertainties that could cause actual results to differ materially from those projected, particularly with respect to the functionality and performance of the products in the Tumbleweed Validation Authority product suite, as well as the continued compliance of such products with Common Criteria EAL 3 requirements. In some cases, forward-looking statements can be identified by terminology such as "may," "will," "should," "potential," "continue," "expects," "anticipates," "intends," "plans," "believes," "estimates," and similar expressions. For further cautions about the risks of investing in Tumbleweed, we refer you to the documents Tumbleweed files from time to time with the Securities and Exchange Commission, particularly Tumbleweed's Form 10-K filed March 16, 2006 and Form 10-Q filed August 8, 2006. Tumbleweed assumes no obligation to update information contained in this press release. Although this release may remain available on Tumbleweed's website or elsewhere, its continued availability does not indicate that Tumbleweed is reaffirming or confirming any of the information contained herein. About Tumbleweed Communications Corp. Tumbleweed provides security solutions for email protection, file transfers, and identity validation that allow organizations to safely conduct business over the Internet. Tumbleweed offers these solutions in three comprehensive product suites: MailGate(R), SecureTransport(TM), and Validation Authority(TM). MailGate provides protection against spam, viruses, and attacks, and enables policy-based message filtering, encryption, and routing. SecureTransport enables business to safely exchange large files and transactions without proprietary software. Validation Authority is the world-leading solution for determining the validity of digital certificates. Tumbleweed's enterprise and government customers include ABN Amro, Bank of America Securities, Catholic Healthcare West, JP Morgan Chase & Co., The Regence Group (Blue Cross/Blue Shield), St. Luke's Episcopal Healthcare System, the U.S. Food and Drug Administration, the U.S. Department of Defense, and all four branches of the U.S. Armed Forces. Tumbleweed was founded in 1993 and is headquartered in Redwood City, Calif. For additional information about Tumbleweed go to www.tumbleweed.com or call 650-216-2000. Tumbleweed, the Arrows logo, MailGate, SecureTransport, Tumbleweed Validation Authority and Validation Authority are either registered trademarks or trademarks of Tumbleweed Communications Corp. in the United States and/or other countries. All other trademarks are the property of their respective owners.