ISO/IEC TS 20540:2025

Information security, cybersecurity and privacy protection — Testing cryptographic modules in their field

This document provides recommendations, requirements and checklists which can be used to support the specification and field testing of cryptographic modules in their field within an organization’s security system. The cryptographic modules have an overall security rating commensurate with the four security levels defined in ISO/IEC 19790:2025, to provide for: — a wide spectrum of data sensitivity (e.g. low-value administrative data, million-dollar funds transfers, life-protecting data, personal identity information, and sensitive information used by government), and — a diversity of application environments (e.g. a guarded facility, an office, removable media, and a completely unprotected location). This document is limited to the security related to the cryptographic module. It does not include assessing the security of the field or application environment. It does not define techniques for the identification, assessment and acceptance of the organization’s operational risk. This document applies to the field testers who perform the field testing for the cryptographic modules in their field and the authorizing officials of cryptographic modules.

Sécurité de l'information, cybersécurité et protection de la vie privée — Test de modules cryptographiques dans leur domaine

General Information

• Status: Published
• Publication Date: 29-May-2025
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Current Stage: 6060 - International Standard published
• Start Date: 30-May-2025
• Due Date: 08-May-2026
• Completion Date: 30-May-2025

Relations

• Revises: ISO/IEC TS 20540:2018 - Information technology — Security techniques — Testing cryptographic modules in their operational environment
• Effective Date: 06-Jun-2022

Standards Content (Sample)

Technical
Specification
ISO/IEC TS 20540
Second edition
Information security, cybersecurity
2025-05
and privacy protection — Testing
cryptographic modules in their field
Sécurité de l'information, cybersécurité et protection de la vie
privée — Test de modules cryptographiques dans leur domaine
Reference number
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 5
5 Document organization . 5
6 Developing, validating and field testing . 6
7 Cryptographic modules . 7
7.1 General .7
7.2 Types of cryptographic modules .7
7.2.1 General .7
7.2.2 Software module .8
7.2.3 Firmware module .8
7.2.4 Hardware module .8
7.2.5 Hybrid software module .8
7.2.6 Hybrid firmware module .8
7.3 Security requirements for cryptographic modules .9
7.3.1 General .9
7.3.2 Security level 1 .9
7.3.3 Security level 2 .10
7.3.4 Security level 3 .10
7.3.5 Security level 4 .11
7.4 Life-cycle assurance of cryptographic modules .11
7.5 Security policy of the module . . 12
7.5.1 General . 12
7.5.2 Cryptographic module specification . 12
7.5.3 Cryptographic module interfaces . 12
7.5.4 Roles, services, and authentication . 12
7.5.5 Software/firmware security . 13
7.5.6 Operational environment . 13
7.5.7 Physical security . 13
7.5.8 Non-invasive security . 13
7.5.9 Sensitive security parameters management.14
7.5.10 Self-tests . . .14
7.5.11 Life-cycle assurance .14
7.5.12 Mitigation of other attacks .14
7.6 Intended purpose or use of the validated cryptographic modules . 15
8 Application environment .15
8.1 Organizational security . 15
8.2 Architecture of the application environment .16
8.3 Application environments for the cryptographic modules .16
8.4 Security products with cryptographic modules .17
9 Field .18
9.1 Security requirements related to cryptographic modules for their field .18
9.1.1 General .18
9.1.2 Entropy sources .19
9.1.3 Audit mechanism .19
9.1.4 Physically unclonable function .19
9.2 Security assumptions for the field .19
9.2.1 General .19

© ISO/IEC 2025 – All rights reserved
iii
9.2.2 Security level 1 .19
9.2.3 Security level 2 . 20
9.2.4 Security level 3 .21
9.2.5 Security level 4 .21
10 How to select cryptographic modules .22
10.1 General . 22
10.2 Use policy. 23
10.3 Cryptographic module assurance .24
10.4 Interoperability.24
10.5 Selection of security rating for SSP protection.24
11 Principles for field testing .25
11.1 General . 25
11.2 Assumptions . 26
11.3 Field testing activities . 26
11.4 Competence for field testers .27
11.5 Use of validated evidence .27
11.6 Documentations .27
11.7 Field testing procedure .
...