ISO/IEC 20243-2:2023

Information technology — Open Trusted Technology ProviderTM Standard (O-TTPS) — Part 2: Assessment procedures for the O-TTPS

ISO/IEC 20243-2:2018 specifies the procedures to be utilized by an assessor when conducting a conformity assessment to the mandatory requirements in the Open Trusted Technology Provider? Standard (O-TTPS).1 These Assessment Procedures are intended to ensure the repeatability, reproducibility, and objectivity of assessments against the O-TTPS. Though the primary audience for this document is the assessor, an Information Technology (IT) provider who is undergoing assessment or preparing for assessment, may also find this document useful.

Titre manque — Partie 2: Titre manque

General Information

• Status: Published
• Publication Date: 23-Nov-2023
• ICS: 13.310 - Protection against crime
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1 - Information technology
• Drafting Committee: ISO/IEC JTC 1 - Information technology
• Current Stage: 6060 - International Standard published
• Start Date: 24-Nov-2023
• Due Date: 11-Jan-2025
• Completion Date: 24-Nov-2023

Relations

• Revises: ISO/IEC 20243-2:2018 - Information technology — Open Trusted Technology ProviderTM Standard (O-TTPS) — Mitigating maliciously tainted and counterfeit products — Part 2: Assessment procedures for the O-TTPS and ISO/IEC 20243-1:2018
• Effective Date: 14-Jan-2023

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 20243-2
Second edition
2023-11
Information technology — Open
TM
Trusted Technology Provider
Standard (O-TTPS) —
Part 2:
Assessment procedures for the O-TTPS
Reference number
ISO/IEC 20243-2:2023(E)
© ISO/IEC 2023

---------------------- Page: 1 ----------------------
ISO/IEC 20243-2:2023(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
  © ISO/IEC 2023 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/IEC 20243-2:2023(E)
Contents Page
Foreword . iv
Preface . vi
Trademarks . viii
Introduction . ix
1 Scope . 1
1.1 Conformance . 1
1.2 Future Directions . 1
2 Normative references . 1
3 Terms and definitions . 2
4 General Concepts . 3
4.1 The O-TTPS . 3
4.2 Assessment Concepts: Relevance of Scope of Assessment and Selected Representative
Products . 4
4.3 Relevance of IT Technology Provider Categories in the Supply Chain . 4
5 Assessment Requirements . 5
5.1 General Requirements for Assessor Activities . 5
5.1.1 General Requirements for Evidence of Conformance . 5
6 Assessor Activities for O-TTPS Requirements . 8
6.1 PD_DES: Software/Firmware/Hardware Design Process . 9
6.2 PD_CFM: Configuration Management . 10
6.3 PD_MPP: Well-Defined Development/Engineering Method Process and Practices . 14
6.4 PD_QAT: Quality and Test Management . 14
6.5 PD_PSM: Product Sustainment Management . 16
6.6 SE_TAM: Threat Analysis and Mitigation . 18
6.7 SE_VAR: Vulnerability Analysis and Response . 20
6.8 SE_PPR: P
...

INTERNATIONAL ISO/IEC
STANDARD 20243-2
Second edition
2023-10
Information technology — Open
Trusted Technology ProviderTM
Standard (O-TTPS) —
Part 2:
Assessment procedures for the O-TTPS
Technologies de l'information — Norme de fournisseur de technologie
de confiance ouverte (O-TTPS) —
Partie 2: Procédures d'évaluation de l'O-TTPS
PROOF/ÉPREUVE
Reference number
ISO/IEC 20243-2:2023(E)
© ISO/IEC 2023

---------------------- Page: 1 ----------------------
ISO/IEC 20243-2:2023(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii
PROOF/ÉPREUVE © ISO/IEC 2023 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/IEC 20243-2:2023(E)
Contents Page
Foreword . iv
Preface . vi
Trademarks . viii
Introduction . ix
1 Scope . 1
1.1 Conformance . 1
1.2 Future Directions . 1
2 Normative references . 1
3 Terms and definitions . 2
4 General Concepts . 3
4.1 The O-TTPS . 3
4.2 Assessment Concepts: Relevance of Scope of Assessment and Selected Representative
Products . 4
4.3 Relevance of IT Technology Provider Categories in the Supply Chain . 4
5 Assessment Requirements . 5
5.1 General Requirements for Assessor Activities . 5
5.1.1 General Requirements for Evidence of Conformance . 5
6 Assessor Activities for O-TTPS Requirements . 8
6.1 PD_DES: Software/Firmware/Hardware Design Process . 9
6.2 PD_CFM: Configuration Management . 10
6.3 PD_MPP: Well-Defined Development/Engineering Method Process and Practices . 14
6.4 PD_QAT: Quality and Test Management . 14
6.5 PD_PSM: Product Sustainment Management . 16
6.6 SE_TAM: Threat Analysis and Mitigation .
...