iTeh StandardsiTeh Standards
EURUSD
Your shopping cart is empty.
ISO

ISO/IEC TS 23532-1:2021

(Main)

Information security, cybersecurity and privacy protection — Requirements for the competence of IT security testing and evaluation laboratories — Part 1: Evaluation for ISO/IEC 15408

Information security, cybersecurity and privacy protection — Requirements for the competence of IT security testing and evaluation laboratories — Part 1: Evaluation for ISO/IEC 15408

This document complements and supplements the procedures and general requirements found in ISO/IEC 17025:2017 for laboratories performing evaluations based on the ISO/IEC 15408 series and ISO/IEC 18045.

Sécurité de l'information, cybersécurité et protection de la vie privée — Exigences relatives aux compétences des laboratoires d'essais et d'évaluation de la sécurité TI — Partie 1: Évaluation pour l'ISO/IEC 15408

General Information

Status
Published
Publication Date
11-Nov-2021
ICS
35.030 - IT Security
Technical Committee
ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
Drafting Committee
ISO/IEC JTC 1/SC 27/WG 3 - Security evaluation, testing and specification
Current Stage
9020 - International Standard under periodical review
Start Date
15-Oct-2024
Completion Date
15-Oct-2024
Ref Project

Buy Standard

ISO/IEC TS 23532-1:2021 - Information security, cybersecurity and privacy protection — Requirements for the competence of IT security testing and evaluation laboratories — Part 1: Evaluation for ISO/IEC 15408 Released:11/12/2021ISO/IEC TS 23532-1:2021 - Information security, cybersecurity and privacy protection — Requirements for the competence of IT security testing and evaluation laboratories — Part 1: Evaluation for ISO/IEC 15408 Released:11/12/2021
PreviousNext
Technical specification
ISO/IEC TS 23532-1:2021 - Information security, cybersecurity and privacy protection — Requirements for the competence of IT security testing and evaluation laboratories — Part 1: Evaluation for ISO/IEC 15408 Released:11/12/2021
English language
20 pages
sale 15% off
Preview
sale 15% off
Preview
ISO/IEC TS 23532-1:2021 - Information security, cybersecurity and privacy protection -- Requirements for the competence of IT security testing and evaluation laboratoriesISO/IEC TS 23532-1:2021 - Information security, cybersecurity and privacy protection -- Requirements for the competence of IT security testing and evaluation laboratories
PreviousNext
Technical specification
ISO/IEC TS 23532-1:2021 - Information security, cybersecurity and privacy protection -- Requirements for the competence of IT security testing and evaluation laboratories
English language
20 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (Sample)


TECHNICAL ISO/IEC TS
SPECIFICATION 23532-1
First edition
2021-11
Information security, cybersecurity
and privacy protection —
Requirements for the competence
of IT security testing and evaluation
laboratories —
Part 1:
Evaluation for ISO/IEC 15408
Sécurité de l'information, cybersécurité et protection de la vie
privée — Exigences relatives aux compétences des laboratoires
d'essais et d'évaluation de la sécurité TI —
Partie 1: Évaluation pour l'ISO/IEC 15408
Reference number
© ISO/IEC 2021
© ISO/IEC 2021
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2021 – All rights reserved

Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 General requirements . 2
4.1 Impartiality . 2
4.2 Confidentiality . 2
5 Structural requirements .3
6 Resource requirements .4
6.1 General . 4
6.2 Personnel . 4
6.3 Facilities and environmental conditions . 5
6.4 Equipment . 6
6.5 Metrological traceability . 7
6.6 Externally provided products and services . 7
7 Process requirements . 8
7.1 Review of requests, tenders and contracts . 8
7.2 Selection, verification and validation of methods . 8
7.2.1 Selection and verification of methods . 8
7.2.2 Validation of methods . 9
7.3 Sampling . 9
7.4 Handling of test or calibration items . 9
7.5 Technical records . 10
7.6 Evaluation of measurement uncertainty . 10
7.7 Ensuring the validity of results . 11
7.8 Reporting of results . 11
7.8.1 General . 11
7.8.2 Common requirements for reports (test, calibration or sampling) . 11
7.8.3 Specific requirements for test reports . 11
7.8.4 Specific requirements for calibration certificates .12
7.8.5 Reporting sampling – specific requirements .12
7.8.6 Reporting statements of conformity .12
7.8.7 Reporting opinions and interpretations .12
7.8.8 Amendments to reports .12
7.9 Complaints.13
7.10 Nonconforming work . 13
7.11 Control of data and information management . 13
8 Management system requirements .14
8.1 Options. 14
8.1.1 General . 14
8.1.2 Option A . 14
8.1.3 Option B . 14
8.2 Management system documentation (Option A). 14
8.3 Control of management system documents (Option A) . 15
8.4 Records (Option A) .15
8.5 Actions to address risks and opportunities (Option A) . 16
8.6 Improvement (Option A) . 16
8.7 Corrective actions (Option A) . . 16
8.8 Internal audits (Option A) . . 16
8.9 Management reviews (Option A) . 16
iii
© ISO/IEC 2021 – All rights reserved

Annex A (informative) Metrological traceability .17
Annex B (informative) Management system options .18
Annex C (informative) Standards relation in IT security evaluation .19
Bibliography .20
iv
© ISO/IEC 2021 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria
needed for the different types of document should be noted. This document was drafted in
accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocs).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC
list of patent declarations received (see https://patents.iec.ch).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see
www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection.
A list of all parts in the ISO/IEC 23532 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
v
© ISO/IEC 2021 – All rights reserved

Introduction
Laboratories performing evaluations for conformance to information security standards including the
ISO/IEC 15408 series may utilize and require conformance to ISO/IEC 17025:2017. ISO/IEC 17025:2017
gives generalized requirements for a broad range of testing and calibration laboratories to enable them
to demonstrate that they operate competently and are able to generate valid results.
Laboratories that perform such evaluations have specific requirements for competence to the
ISO/IEC 15408 series that will enable them
...


TECHNICAL ISO/IEC TS
SPECIFICATION 23532-1
First edition
2021-11
Information security, cybersecurity
and privacy protection —
Requirements for the competence
of IT security testing and evaluation
laboratories —
Part 1:
Evaluation for ISO/IEC 15408
Sécurité de l'information, cybersécurité et protection de la vie
privée — Exigences relatives aux compétences des laboratoires
d'essais et d'évaluation de la sécurité TI —
Partie 1: Évaluation pour l'ISO/IEC 15408
Reference number
© ISO/IEC 2021
© ISO/IEC 2021
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2021 – All rights reserved

Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 General requirements . 2
4.1 Impartiality . 2
4.2 Confidentiality . 2
5 Structural requirements .3
6 Resource requirements .4
6.1 General . 4
6.2 Personnel . 4
6.3 Facilities and environmental conditions . 5
6.4 Equipment . 6
6.5 Metrological traceability . 7
6.6 Externally provided products and services . 7
7 Process requirements . 8
7.1 Review of requests, tenders and contracts . 8
7.2 Selection, verification and validation of methods . 8
7.2.1 Selection and verification of methods . 8
7.2.2 Validation of methods . 9
7.3 Sampling . 9
7.4 Handling of test or calibration items . 9
7.5 Technical records . 10
7.6 Evaluation of measurement uncertainty . 10
7.7 Ensuring the validity of results . 11
7.8 Reporting of results . 11
7.8.1 General . 11
7.8.2 Common requirements for reports (test, calibration or sampling) . 11
7.8.3 Specific requirements for test reports . 11
7.8.4 Specific requirements for calibration certificates .12
7.8.5 Reporting sampling – specific requirements .12
7.8.6 Reporting statements of conformity .12
7.8.7 Reporting opinions and interpretations .12
7.8.8 Amendments to reports .12
7.9 Complaints.13
7.10 Nonconforming work . 13
7.11 Control of data and information management . 13
8 Management system requirements .14
8.1 Options. 14
8.1.1 General . 14
8.1.2 Option A . 14
8.1.3 Option B . 14
8.2 Management system documentation (Option A). 14
8.3 Control of management system documents (Option A) . 15
8.4 Records (Option A) .15
8.5 Actions to address risks and opportunities (Option A) . 16
8.6 Improvement (Option A) . 16
8.7 Corrective actions (Option A) . . 16
8.8 Internal audits (Option A) . . 16
8.9 Management reviews (Option A) . 16
iii
© ISO/IEC 2021 – All rights reserved

Annex A (informative) Metrological traceability .17
Annex B (informative) Management system options .18
Annex C (informative) Standards relation in IT security evaluation .19
Bibliography .20
iv
© ISO/IEC 2021 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria
needed for the different types of document should be noted. This document was drafted in
accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocs).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC
list of patent declarations received (see https://patents.iec.ch).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see
www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection.
A list of all parts in the ISO/IEC 23532 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
v
© ISO/IEC 2021 – All rights reserved

Introduction
Laboratories performing evaluations for conformance to information security standards including the
ISO/IEC 15408 series may utilize and require conformance to ISO/IEC 17025:2017. ISO/IEC 17025:2017
gives generalized requirements for a broad range of testing and calibration laboratories to enable them
to demonstrate that they operate competently and are able to generate valid results.
Laboratories that perform such evaluations have specific requirements for competence to the
ISO/IEC 15408 series that will enable them
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.

This May Also Interest You

ISO
ISO/IEC 27019:2024(Main)
Information security, cybersecurity and privacy protection — Information security controls for the energy utility industry

This document provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes. This includes in particular the following: — central and distributed process control, monitoring and automation technology as well as information systems used for their operation, such as programming and parameterization devices; — digital controllers and automation components such as control and field devices or programmable logic controllers (PLCs), including digital sensor and actuator elements; — all further supporting information systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving, historian logging, reporting and documentation purposes; — communication technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote-control technology; — Advanced metering infrastructure (AMI) components, e.g. smart meters; — measurement devices, e.g. for emission values; — digital protection and safety systems, e.g. protection relays, safety PLCs, emergency governor mechanisms; — energy management systems, e.g. for distributed energy resources (DER), electric charging infrastructures, and for private households, residential buildings or industrial customer installations; — distributed components of smart grid environments, e.g. in energy grids, in private households, residential buildings or industrial customer installations; — all software, firmware and applications installed on above-mentioned systems, e.g. distribution management system (DMS) applications or outage management systems (OMS); — any premises housing the abovementioned equipment and systems; — remote maintenance systems for abovementioned systems. This document does not apply to the process control domain of nuclear facilities. This domain is covered by IEC 63096.

  • Standard
    39 pages
    English language
    sale 15% off
  • Standard
    48 pages
    French language
    sale 15% off
ISO
ISO/IEC 23264-2:2024(Main)
Information security — Redaction of authentic data — Part 2: Redactable signature schemes based on asymmetric mechanisms

This document specifies cryptographic mechanisms to redact authentic data. The mechanisms described in this document offer different combinations of the security properties defined and described in ISO/IEC 23264-1. For all mechanisms, this document describes the processes for key generation, generating the redactable attestation, carrying out redactions and verifying redactable attestations. This document contains mechanisms that are based on asymmetric cryptography using three related transformations: ¾ a public transformation defined by a verification key (verification process for verifying a redactable attestation), ¾ a private transformation defined by a private attestation key (redactable attestation process for generating a redactable attestation), and ¾ a third transformation defined by the redaction key (redaction process) allowing to redact authentic information within the constraints set forth during generation of the attestation such that redacted information cannot be reconstructed. This document contains mechanisms which, after a successful redaction, allow the attestation to remain verifiable using the verification transformation and attest that non-redacted fields of the attested message are unmodified. This document further details that the three transformations have the property whereby it is computationally infeasible to derive the private attestation transformation, given the redaction and or the verification transformation and key(s).

  • Standard
    58 pages
    English language
    sale 15% off
ISO
ISO/IEC 27554:2024(Main)
Information security, cybersecurity and privacy protection — Application of ISO 31000 for assessment of identity-related risk

This document provides guidelines for identity-related risk, as an extension of ISO 31000:2018. More specifically, it uses the process outlined in ISO 31000 to guide users in establishing context and assessing risk, including providing risk scenarios for processes and implementations that are exposed to identity-related risk. This document is applicable to the risk assessment of processes and services that rely on or are related to identity. This document does not include aspects of risk related to general issues of delivery, technology or security.

  • Standard
    18 pages
    English language
    sale 15% off
ISO
ISO/IEC 27403:2024(Main)
Cybersecurity – IoT security and privacy – Guidelines for IoT-domotics

This document provides guidelines to analyse security and privacy risks and identifies controls that can be implemented in Internet of Things (IoT)-domotics systems.

  • Standard
    39 pages
    English language
    sale 15% off
ISO
ISO/IEC 14888-4:2024(Main)
Information security — Digital signatures with appendix — Part 4: Stateful hash-based mechanisms

This document specifies stateful digital signature mechanisms with appendix, where the level of security is determined by the security properties of the underlying hash function. This document also provides requirements for implementing basic state management, which is needed for the secure deployment of the stateful schemes described in this document.

  • Standard
    56 pages
    English language
    sale 15% off
ISO
ISO/IEC TR 5891:2024(Main)
Information security, cybersecurity and privacy protection — Hardware monitoring technology for hardware security assessment

This document surveys and summarizes the existing hardware monitoring methods, including research efforts and industrial applications. The explored monitoring technologies are classified by applied area, carrier type, target entity, objective pattern, and method of deployment. Moreover, this document summarizes the possible ways of utilizing monitoring technologies for hardware security assessment with some existing state-of-the-art security assessment approaches. The hardware mentioned in this document refers only to the core processing hardware, such as the central processing unit (CPU), microcontroller unit (MCU), and system on a chip (SoC), in the von Neumann system and does not include single-input or single-output devices such as memory or displays. The hardware monitoring technology discussed in this document has the following considerations and restrictions: — the monitored target is for the post-silicon phase, not for the design-house phase (e.g. an RTL or netlist design); — monitoring is only applied to the runtime system.

  • Technical report
    32 pages
    English language
    sale 15% off
ISO
ISO/IEC 27011:2024(Main)
Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for telecommunications organizations

This document provides guidelines supporting the implementation of information security controls in telecommunications organizations. The adoption of this document will allow telecommunications organizations to meet baseline information security management requirements of confidentiality, integrity, availability and any other relevant information security property.

  • Standard
    28 pages
    English language
    sale 15% off
ISO
ISO/IEC DIS 27561(Main)
Information security, cybersecurity and privacy protection — Privacy operationalisation model and method for engineering (POMME)

This document describes a model and method to operationalize ISO/IEC 29100 privacy principles into sets of controls and functional capabilities. The method is described as a process following ISO/IEC/IEEE It is designed for use with other standards and privacy It supports networked, interdependent applications and This document is intended for engineers and other practitioners developing systems controlling or processing PII.

  • Standard
    29 pages
    English language
    sale 15% off
ISO
ISO/IEC 4922-2:2024(Main)
Information security — Secure multiparty computation — Part 2: Mechanisms based on secret sharing

This document specifies the processes for secure multiparty computation mechanisms based on the secret sharing techniques which are specified in ISO/IEC 19592-2. Secure multiparty computation based on secret sharing can be used for confidential data processing. Examples of possible applications include collaborative data analytics or machine learning where data are kept secret, secure auctions where each bidding price is hidden, and performing cryptographic operations where the secrecy of the private keys is maintained. This document specifies the mechanisms including but not limited to addition, subtraction, multiplication by a constant, shared random number generation, and multiplication with their parameters and properties. This document describes how to perform a secure function evaluation using these mechanisms and secret sharing techniques.

  • Standard
    33 pages
    English language
    sale 15% off
ISO
ISO/IEC 27006-1:2024(Main)
Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General

This document specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing ISMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing ISMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.

  • Standard
    47 pages
    English language
    sale 15% off
  • Standard
    53 pages
    French language
    sale 15% off