ISO/IEC 19896-2

Information security, cybersecurity and privacy protection — Requirements for the competence of IT security conformance assessment body personnel — Part 2: Knowledge and skills requirements for testers and validators according to ISO/IEC 19790 and ISO/IEC 24759

This document provides the minimum requirements for the knowledge, skills and effectiveness requirements of individuals performing testing activities for a conformance scheme using ISO/IEC 19790 and ISO/IEC 24759.

Sécurité de l'information, cybersécurité et sécurité de la vie privée ― Exigences relatives aux compétences du personnel des organismes d'évaluation de la conformité de la sécurité TI — Partie 2: Exigences en matière de connaissances et de compétences pour les testeurs et les validateurs conformément à la série ISO/IEC 19790 et à l'ISO/IEC 24759

General Information

• Status: Not Published
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Current Stage: 6000 - International Standard under publication
• Start Date: 04-Dec-2025
• Completion Date: 13-Dec-2025

Relations

• Consolidates: ISO 3600:2022 - Tractors, machinery for agriculture and forestry, powered lawn and garden equipment — Operator's manuals — Content and format
• Effective Date: 21-Sep-2024
• Revises: ISO/IEC 19896-2:2018 - IT security techniques — Competence requirements for information security testers and evaluators — Part 2: Knowledge, skills and effectiveness requirements for ISO/IEC 19790 testers
• Effective Date: 06-Jun-2022

Standards Content (Sample)

FINAL DRAFT
International
Standard
ISO/IEC
FDIS
19896-2
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection —
Voting begins on:
Requirements for the competence
2025-10-08
of IT security conformance
Voting terminates on:
assessment body personnel —
2025-12-03
Part 2:
Knowledge and skills requirements
for testers and validators according
to ISO/IEC 19790 and ISO/IEC
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
ISO/CEN PARALLEL PROCESSING LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
ISO/IEC FDIS 19896­2:2025(en) © ISO/IEC 2025

FINAL DRAFT
ISO/IEC FDIS 19896-2:2025(en)
International
Standard
ISO/IEC
FDIS
19896-2
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection —
Voting begins on:
Requirements for the competence
of IT security conformance
Voting terminates on:
assessment body personnel —
Part 2:
Knowledge and skills requirements
for testers and validators according
to ISO/IEC 19790 and ISO/IEC 24759
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
ISO/CEN PARALLEL PROCESSING
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
ISO/IEC FDIS 19896­2:2025(en) © ISO/IEC 2025

© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC FDIS 19896-2:2025(en)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms . 2
5 Structure of this document . 3
6 Knowledge . 3
6.1 General .3
6.2 Requirements for testers.3
6.2.1 Tertiary education .3
6.2.2 Knowledge of standards .7
6.2.3 Knowledge of the validation programme.9
6.2.4 Knowledge of the requirements of ISO/IEC TS 23532-2 .10
6.3 Requirements for validators .10
6.3.1 Tertiary education .10
6.3.2 Knowledge of standard . . .11
6.3.3 Knowledge of the validation programme.11
6.3.4 Knowledge of the requirements of ISO/IEC TS 23532-2 . 12
7 Skills .12
7.1 Requirements for testers. 12
7.1.1 General . 12
7.1.2 Algorithm testing. 12
7.1.3 Physical security testing . 12
7.1.4 Side channel analysis . 12
7.1.5 Technology types . 13
7.2 Requirements for validators . 13
8 Recording a log for testers and validators .13
Annex A (informative) Example of log for testers and validators . 14
Annex B (informative) Ontology of technology types .15
Bibliography . 17

© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC FDIS 19896-2:2025(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection, in collaboration with the
European Committee for Standardization (CEN) Technical Committee CEN/CLC/JTC 13, Cybersecurity and
data protection, in accordance with the Agreement on technical cooperation between ISO and CEN (Vienna
Agreement).
This second edition cancels and replaces the first edition (ISO/IEC 19896-2:2018), which has been technically
revised.
The main changes are as follows:
— the document has been restructured:
— deleted subclauses related to experience, education and effectiveness;
— technical changes have been introduced:
— deleted elements of competence, experience, education and effectiveness, except for knowledge and
skill, according to comments from ISO/CASCO;
— added competence requirements for the validators;
— Annex C has been removed.
A list of all parts in the ISO/IEC 19896 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.

© ISO/IEC 2025 – All rights reserved
iv
ISO/IEC FDIS 19896-2:2025(en)
Introduction
This document specifies the specialized knowledge and skills requirements for testers and validators, who
perform security testing projects according to ISO/IEC 19790 and ISO/IEC 24759. ISO/IEC 19790 specifies
security requirements for cryptographic modules. Many validation schemes and recognition arrangements
have been developed using ISO/IEC 19790 as a basis. ISO/IEC 19790 permits comparability between the
results of independent security testing projects. ISO/IEC 24759 supports this by providing a common set of
testing requirements for testing a cryptographic module for conformance with ISO/IEC 19790.
One of the important factors in assuring comparability of the results of such validations is the knowledge
and skills requirements of the individual testers responsible for performing testing projects.
Another important factor in assuring comparability of the results of such validations is the knowledge and
skills requirements of the individual validators responsible for validating the results of testing projects.
ISO/IEC TS 23532-2, which is often specified as a standard to which the testing laboratory conforms, states
in ISO/IEC TS 23532-2:2021, 6.2 that the competence requirements for each function influencing the results
of laboratory activities are documented, including requirements for education, qualification, training,
technical knowledge, skills and experience. The document provides the requirement that the personnel
have the competence to perform laboratory activities for which they are responsible and to evaluate the
significance of deviations specified in ISO/IEC TS 23532-2:2021, 6.2.
The audience for this document includes validation authorities, testing laboratories, testers, validators and
organizations offering professional credentials and recognitions.
This document establishes a baseline for the knowledge and skills requirements of:
— testers, to ensure harmonized requirements for cryptographic module conformance testing
programmers, and
— validators, to ensure harmonized requirements for cryptographic module validation programmes.

© ISO/IEC 2025 – All rights reserved
v
FINAL DRAFT International Standard ISO/IEC FDIS 19896-2:2025(en)
Information security, cybersecurity and privacy protection —
Requirements for the competence of IT security conformance
assessment body personnel —
Part 2:
Knowledge and skills requirements for testers and validators
according to ISO/IEC 19790 and ISO/IEC 24759
1 Scope
This document provides the minimum requirements for the knowledge and skills of assessment body
testers and validators performing testing activities and validating activities for a conformance scheme using
ISO/IEC 19790 and ISO/IEC 24759.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 17825, Information technology — Security techniques — Testing methods for the mitigation of non-
invasive attack classes against cryptographic modules
ISO/IEC 18367, Information technology — Security techniques — Cryptographic algorithms and security
mechanisms conformance testing
ISO/IEC 19790:2025, Information security, cybersecurity and privacy protection — Security requirements for
cryptographic modules
ISO/IEC 19896-1, IT security techniques — Competence requirements for information security testers and
evaluators — Part 1: Introduction, concepts and general requirements
ISO/IEC 20085-1, IT Security techniques — Test tool requirements and test tool calibration methods for use in
testing non-invasive attack mitigation techniques in cryptographic modules — Part 1: Test tools and techniques
ISO/IEC 20085-2, IT Security techniques — Test tool requirements and test tool calibration methods for use in
testing non-invasive attack mitigation techniques in cryptographic modules — Part 2: Test calibration methods
and apparatus
ISO/IEC 20543, Information technology — Security techniques — Test and analysis methods for random bit
generators within ISO/IEC 19790 and ISO/IEC 15408
ISO/IEC TS 23532-2:2021, Information security, cybersecurity and privacy protection — Requirements for the
competence of IT security testing and evaluation laboratories — Part 2: Testing for ISO/IEC 19790
ISO/IEC 24759:2025, Information security, cybersecurity and privacy protection — Test requirements for
cryptographic modules
© ISO/IEC 2025 – All rights reserved
ISO/IEC FDIS 19896-2:2025(en)
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 19896-1, ISO/IEC TS 23532-2
and ISO/IEC 19790 apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
runtime environment
environment in which a program or application is executed
Note 1 to entry: It can pertain to the operating system itself, or the software that runs beneath it. The primary purpose
is to accomplish the objective of “platform independent” programming.
[SOURCE: ISO/IEC 19790:2025, 3.121]
3.2
split knowledge
process by which a cryptographic key is split into multiple key components, individually sharing no
knowledge of the original key, which can be subsequently input, or output from, a cryptographic module by
separate operators and combined to recreate the original key
Note 1 to entry: All or a subset of the components are required to recover the original split-key.
[SOURCE: ISO/IEC 19790:2025, 3.144]
3.3
user
operator that accesses a cryptographic module in order to perform general security services, including
cryptographic operations and other approved security function
[SOURCE: ISO/IEC 19790:2025, 3.154]
Note 1 to entry: a user is an operator who assumes the user role
3.4
vendor
entity, group or association that submits the cryptographic module for testing and validation
[SOURCE: ISO/IEC 19790:2025, 3.156]
4 Abbreviated terms
DPA differential power analysis
DEMA differential electromagnetic analysis
IUT implementation under test
RSA Rivest-Shamir-Adleman
SEMA simple electromagnetic analysis
SPA simple power analysis
© ISO/IEC 2025 – All rights reserved
ISO/IEC FDIS 19896-2:2025(en)
5 Structure of this document
This document is divided into the following clauses:
— Knowledge (Clause 6), and
— Skills (Clause 7).
Each clause corresponds to an aspect of the knowledge and skills requirements of personnel performing
testing activities or validating activities as introduced in ISO/IEC 19896-1 for a conformance scheme using
ISO/IEC 19790 and ISO/IEC 24759.
6 Knowledge
6.1 General
6.2 and 6.3 provide knowledge requirements that a tester or a validator knows and describe the differences
between a validator and tester, and the relevant requirements for validators and testers.
6.2 Requirements for testers
6.2.1 Tertiary education
6.2.1.1 General
Testers shall have educational qualifications such as an associate, bachelor, or higher degree that is relevant
to the security requirements addressed in ISO/IEC 19790 and the test requirements in ISO/IEC 24759. The
testers shall at a minimum demonstrate they have either:
a) successfully completed appropriate tertiary education with at least three years of study in disciplines
related to IT or IT security; or
b) experience equivalent to the tertiary education in disciplines related to IT, IT security or IT system
administration.
6.2.1.2 Technical specialities
In addition to the minimum level of educational requirements in 6.2.1.1, testers shall have educational
qualifications such as an associate, bachelor, or higher degree that addresses the specific technical
specialities. Examples of specific technical specialities include:
— cryptographic concepts;
— engineering technology;
— electrical engineering;
— mechanical engineering;
— material engineering;
— chemical engineering;
— computer information technology;
— computer engineering;
— computer science;
— computer networks;
© ISO/IEC 2025 – All rights reserved
ISO/IEC FDIS 19896-2:2025(en)
— cybersecurity;
— information systems;
— laboratory management;
— mathematics and physics;
— software development and security; or
— software engineering.
6.2.1.3 Speciality topics
A tester shall, at a minimum, demonstrate knowledge in at least one specific speciality topic described in
ISO/IEC 19790 and ISO/IEC 24759.
A testing laboratory shall have knowledge in the speciality areas specified in ISO/IEC 19790 and
ISO/IEC 24759 as an aggregate of its technical staff.
The speciality areas specified in ISO/IEC 19790 and ISO/IEC 24759 are as follows:
a) software and firmware development:
1) programming languages (e.g. assembler and high-level);
2) compilers;
3) debugging tools;
4) product testing performed by vendor:
i) unit testing;
ii) integration testing;
iii) regression testing;
b) operating systems:
1) installation;
2) configuration;
3) operation;
4) architecture;
5) system hardening;
6) virtual machines;
7) java runtime environment;
c) hardware development:
1) hardware embodiments:
i) single-chip;
ii) multi-chip;
2) technology:
i) single-chip fabrication;
© ISO/IEC 2025 – All rights reserved
ISO/IEC FDIS 19896-2:2025(en)
ii) electrical components and design, schematics and concepts including logic design and HDL
representations;
iii) mechanical design and packaging;
3) manufacturing:
...

ISO/IEC FDIS 19896--2:2025(en)
Style Definition: Heading 1
Style Definition: Heading 2
ISO/IEC JTC 1/SC 27/WG 3
Style Definition: Heading 3
Date: 2025-06-0109-23
Style Definition: Heading 4
Style Definition: Heading 5
Secretariat: DIN
Style Definition: Heading 6
Information security, cybersecurity and privacy protection ― Requirements for the
Style Definition: Default Paragraph Font
competence of IT security conformance assessment body personnel ― Part 2:
Style Definition: ANNEX
Knowledge and skills requirements for ISO/IEC 19790 testers and validators according
Style Definition: AMEND Terms Heading
to ISO/IEC 19790 and ISO/IEC 24759
Style Definition: AMEND Heading 1 Unnumbered

Formatted: Font: Cambria
Formatted: Font: 12 pt, English (United Kingdom)
Formatted: Font: 12 pt, Bold, English (United Kingdom)
Formatted: Font: 12 pt, English (United Kingdom)
Formatted: Font: Cambria
ISO/IEC FDIS 19896-2:2025(en)
Formatted
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part
of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or
mechanical, including photocopying, or posting on the internet or an intranet, without prior written
permission. Permission can be requested from either ISO at the address below or ISO’s member body
in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.orgwww.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC FDIS 19896-2:2025(en)
Formatted: Font: Not Bold
Contents Page
Foreword . v
Introduction . vii
1 Scope .1
2 Normative references .1
3 Terms and definitions .2
4 Abbreviated terms .3
5 Structure of this document .3
6 Knowledge .4
6.1 General .4
6.2 Requirements for testers .4
6.2.1 Tertiary education .4
6.2.2 Knowledge of standards .9
6.2.3 Knowledge of the validation program . 10
6.2.4 Knowledge of the requirements of ISO/IEC 23532-2 . 12
6.3 Requirements for validators . 12
6.3.1 Tertiary education . 12
6.3.2 Knowledge of standard . 13
6.3.3 Knowledge of the validation program . 13
6.3.4 Knowledge of the requirements of ISO/IEC 23532-2 . 14
7 Skills . 14
7.1 Requirements for testers . 14
7.1.1 General . 14
7.1.2 Algorithm testing . 14
© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC FDIS 19896-2:2025(en)
7.1.3 Physical security testing . 14
7.1.4 Side channel analysis . 14
7.1.5 Technology types. 14
7.2 Requirements for validators . 15
8 Recording a log for testers and validators . 15
Annex A (informative) Example of a log for ISO/IEC 24759 testers and validators . 16
Annex B (informative) Ontology of technology types . 18
B.1 General . 18
B.2 Technology types. 18
B.2.1 General . 18
B.2.2 Software/firmware . 18
B.2.3 Hardware . 18
Bibliography . 20
Foreword .vi
Introduction . viii
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms . 3
5 Structure of this document . 3
6 Knowledge . 4
6.1 General . 4
6.2 Requirements for testers . 4
6.2.1 Tertiary education . 4
6.2.2 Knowledge of standards . 9
© ISO/IEC 2025 – All rights reserved
iv
ISO/IEC FDIS 19896-2:2025(en)
6.2.3 Knowledge of the validation programme . 10
6.2.4 Knowledge of the requirements of ISO/IEC TS 23532-2 . 12
6.3 Requirements for validators. 12
6.3.1 Tertiary education . 12
6.3.2 Knowledge of standard . 13
6.3.3 Knowledge of the validation programme . 13
6.3.4 Knowledge of the requirements of ISO/IEC TS 23532-2 . 14
7 Skills . 14
7.1 Requirements for testers . 14
7.1.1 General . 14
7.1.2 Algorithm testing . 14
7.1.3 Physical security testing . 14
7.1.4 Side channel analysis . 15
7.1.5 Technology types . 15
7.2 Requirements for validators. 15
8 Recording a log for testers and validators . 15
Annex A (informative) Example of log for testers and validators . 16
Annex B (informative) Ontology of technology types . 18
Bibliography . 20

© ISO/IEC 2025 – All rights reserved
v
ISO/IEC FDIS 19896-2:2025(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of document should be noted. This document was drafted in accordance with the editorial
rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocswww.iso.org/directives or
www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had
Formatted: Font color: Auto
not received notice of (a) patent(s) which may be required to implement this document. However,
implementers are cautioned that this may not represent the latest information, which may be obtained
from the patent database available at www.iso.org/patents and
https://patents.iec.ch.www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the World
Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see
www.iso.org/iso/foreword.htmlwww.iso.org/iso/foreword.html. In the IEC, see
www.iec.ch/understanding-standardswww.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, informationInformation security, cybersecurity and privacy protection., in
collaboration with the European Committee for Standardization (CEN) Technical Committee
CEN/CLC/JTC 13, Cybersecurity and data protection, in accordance with the Agreement on technical
cooperation between ISO and CEN (Vienna Agreement).
This second edition cancels and replaces the first edition (ISO/IEC 19896-2:2018), which has been
Formatted: Default Paragraph Font
technically revised.
Formatted: std_year
The main changes are as follows:
— the document has been restructured:
— deleted subclauses related to experience, education and effectiveness;
— technical changes have been introduced:
© ISO/IEC 2025 – All rights reserved
vi
ISO/IEC FDIS 19896-2:2025(en)
— deleted elements of competence; knowledge, skills, experience, education and effectiveness,
except for knowledge and skill, according to CASCO’s comments from ISO/CASCO;
— added competence requirements for the validators;
— updated Annex C to be aligned with ISO/IEC 19790 and to avoid duplicationhas been removed.
Formatted: Default Paragraph Font
A list of all parts in the ISO/IEC 19896 series can be found on the ISO and IEC websites.
Formatted: Don't adjust space between Latin and Asian
text, Don't adjust space between Asian text and
Any feedback or questions on this document should be directed to the user’s national standards body. A numbers
complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-
Formatted: std_docPartNumber
committeeswww.iso.org/members.html and www.iec.ch/national-committees.
© ISO/IEC 2025 – All rights reserved
vii
ISO/IEC FDIS 19896-2:2025(en)
Introduction
This document specifies the specialized knowledge and skills requirements for testers and validators of
ISO/IEC 19790 performing, who perform security testing projects according to ISO/IEC 19790 and
ISO/IEC 24759. ISO/IEC 19790 specifies security requirements for cryptographic modules. Many
validation schemes and recognition arrangements have been developed using ISO/IEC 19790 as a basis.
ISO/IEC 19790 permits comparability between the results of independent security testing projects.
ISO/IEC 24759 supports this by providing a common set of testing requirements for testing a
cryptographic module for conformance with ISO/IEC 19790.
One of the important factors in assuring comparability of the results of such validations is the knowledge
and skills requirements of the individual testers responsible for performing testing projects.
Another important factor in assuring comparability of the results of such validations is the knowledge
and skills requirements of the individual validators responsible for validating the results of testing
projects.
ISO/IEC TS 23532-2, which is often specified as a standard to which the testing laboratory conforms,
Formatted: Default Paragraph Font
states in ISO/IEC TS 23532-2:2021, 6.2 that the competence requirements for each function influencing
Formatted: std_documentType
the results of laboratory activities are documented, including requirements for education, qualification,
Formatted: std_publisher
training, technical knowledge, skills and experience are documented. The document provides the
requirement that the personnel have the competence to perform laboratory activities for which they are
Formatted: std_documentType
responsible and to evaluate the significance of deviations specified in ISO/IEC TS 23532-2:2021, 6.2.
Formatted: std_docNumber
The audience for this document includes validation authorities, testing laboratories, testers, validators
Formatted: std_docPartNumber
and organizations offering professional credentials and recognitions.
Formatted: std_section
This document establishes a baseline for the knowledge and skills requirements of testers of
Formatted: std_publisher
ISO/IEC 19790 with the goal of establishing conformity in the requirements for the training of testers of
ISO/IEC 19790 associated with cryptographic module conformance testing programmes and validators Formatted: std_documentType
of ISO/IEC 19790 with the goal of establishing conformity in the requirements of validators of ISO/IEC
Formatted: std_docNumber
19790 associated with cryptographic module validation programme.:
Formatted: std_docPartNumber
— testers, to ensure harmonized requirements for cryptographic module conformance testing
Formatted: std_section
programmers, and
— validators, to ensure harmonized requirements for cryptographic module validation programmes.
© ISO/IEC 2025 – All rights reserved
viii
FINAL DRAFT International Standard ISO/IEC DISFDIS 19896-2:2025(en)
Formatted: Font: 11.5 pt, Bold

Formatted Table
Formatted: Font: Bold
Formatted: Font: 11.5 pt, Bold
Formatted: Font: 11.5 pt, Bold
Information security, cybersecurity and privacy security —
Formatted: Normal, Line spacing: Exactly 11 pt, Tab
stops: 0.71 cm, Left
Requirements for the competence of IT security conformance
Formatted: Font: Bold
assessment body personnel—Part 2: Knowledge and skills
Formatted: Font: Cambria
requirements for ISO/IEC 19790 testers and validators according to
ISO/IEC 19790 and ISO/IEC 24759
1 Scope
This document provides the minimum requirements for the knowledge and skills of assessment body testers
and validators performing testing activities and validating activities for a conformance scheme using
ISO/IEC 19790 and ISO/IEC 24759.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 17825, Information technology — Security techniques — Testing methods for the mitigation of non-
invasive attack classes against cryptographic modules
ISO/IEC 18367, Information technology — Security techniques — Cryptographic algorithms and security
mechanisms conformance testing
ISO/IEC 19790:2025, Information technology — Security techniques security, cybersecurity and privacy
Formatted: Default Paragraph Font
protection — Security requirements for cryptographic modules
Formatted: std_year
ISO/IEC 19896--1, IT security techniques — Competence requirements for information security testers and
evaluators — Part 1: Introduction, concepts and general requirements
ISO/IEC 20085--1, IT Security techniques — Test tool requirements and test tool calibration methods for use
in testing non-invasive attack mitigation techniques in cryptographic modules — Part 1: Test tools and
techniques
ISO/IEC 20085--2, IT Security techniques — Test tool requirements and test tool calibration methods for use
in testing non-invasive attack mitigation techniques in cryptographic modules — Part 2: Test calibration
methods and apparatus
ISO/IEC 20543, Information technology — Security techniques — Test and analysis methods for random bit
generators within ISO/IEC 19790 and ISO/IEC 15408
ISO/IEC TS 23532--2:2021, Information security, cybersecurity and privacy protection — Requirements for
Formatted: std_documentType
the competence of IT security testing and evaluation laboratories — Part 2: Testing for ISO/IEC 19790
ISO/IEC 24759:2025, Information technology — Security techniques security, cybersecurity and privacy
Formatted: Default Paragraph Font
protection — Test requirements for cryptographic modules
Formatted: std_year
© ISO/IEC 2025 – All rights reserved
ISO/IEC FDIS 19896-2:2025(en)
Formatted: Font: Cambria
Formatted: 머리말, Centered
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 19896--1, ISO/IEC TS 23532-
Formatted: std_documentType
2 and ISO/IEC 19790 apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
Formatted: English (United Kingdom)
— ISO Online browsing platform: available at https://www.iso.org/obphttps://www.iso.org/obp Formatted: Don't adjust space between Latin and Asian
text, Don't adjust space between Asian text and
— IEC Electropedia: available at https://www.electropedia.org/https://www.electropedia.org/ numbers
Formatted: English (United Kingdom)
3.1
Formatted: Don't adjust space between Latin and Asian
critical security parameter
text, Don't adjust space between Asian text and
CSP
numbers, Tab stops: 0.7 cm, Left + 1.4 cm, Left + 2.1
security related information whose unauthorized access, use, disclosure, modification and substitution can
cm, Left + 2.8 cm, Left + 3.5 cm, Left + 4.2 cm, Left +
cause a compromise of the security of a cryptographic module
4.9 cm, Left + 5.6 cm, Left + 6.3 cm, Left + 7 cm, Left
Formatted: English (United Kingdom)
Note 1 to entry: A CSP can be plaintext or encrypted.
Formatted: No underline, Font color: Auto, English
[SOURCE: ISO/IEC 19790:2025, 3.29]
(United Kingdom)
3.2
public security parameter
PSP
security related public information whose modification can cause a compromise of the security of a
cryptographic module
[SOURCE: ISO/IEC 19790:2025, 3.115]
Formatted: Font color: Auto
3.3
Formatted: Term(s), Left, Don't adjust space between
runtime environment
Latin and Asian text, Don't adjust space between Asian
environment in which a program or application is executed
text and numbers
Note 1 to entry: It can pertain to the operating system itself, or the software that runs beneath it. The primary purpose Formatted: Note, Tab stops: 0.7 cm, Left + 1.4 cm, Left
is to accomplish the objective of “platform independent” programming.
+ 2.1 cm, Left + 2.8 cm, Left + 3.5 cm, Left + 4.2 cm,
Left + 4.9 cm, Left + 5.6 cm, Left + 6.3 cm, Left + 7
[SOURCE: ISO/IEC 19790:2025, 3.121] cm, Left
Formatted: Default Paragraph Font
3.42
Formatted: Source
sensitive security parameter
SSP
Formatted: std_publisher
critical security parameter (3.1) or public security parameter (3.2)
Formatted: Default Paragraph Font
Formatted: Default Paragraph Font
[SOURCE: ISO/IEC 19790:2025, 3.131]
Formatted: std_year
3.5
Formatted: Default Paragraph Font
split knowledge
process by which a cryptographic key is split into multiple key components, individually sharing no Formatted: std_section
knowledge of the original key, which can be subsequently input, or output from, a cryptographic module by
Formatted: Default Paragraph Font
separate operators and combined to recreate the original key
Formatted: Note, Tab stops: 0.7 cm, Left + 1.4 cm, Left
+ 2.1 cm, Left + 2.8 cm, Left + 3.5 cm, Left + 4.2 cm,
Note 1 to entry: All or a subset of the components are required to recover the original split-key.
Left + 4.9 cm, Left + 5.6 cm, Left + 6.3 cm, Left + 7
cm, Left
[SOURCE: ISO/IEC 19790:2025, 3.144]
Formatted: Source
© ISO/IEC 2025 – All rights reserved
ISO/IEC FDIS 19896-2:2025(en)
Formatted: Font: Cambria
Formatted: 머리말, Centered
3.63
user
operatoroperator that accesses a cryptographic modulecryptographic module in order to perform general
security services, including cryptographic operations and other approved security functionapproved
security function
[SOURCE: ISO/IEC 19790:2025, 3.154]
Formatted: Source, Tab stops: Not at 0.7 cm + 1.4 cm
+ 2.1 cm + 2.8 cm + 3.5 cm + 4.2 cm + 4.9 cm + 5.6
Note 1 to entry: a user is an operator who assumes the user role
cm + 6.3 cm + 7 cm
3.74
Formatted: Don't adjust space between Latin and Asian
validated text, Don't adjust space between Asian text and
numbers
assurance of tested conformance to this document by a validation authority
[SOURCE: ISO/IEC 19790:2025, 3.155, modified — certification body has been replaced by validation
authority]
3.7
vendor
entity,entity, group or association that submits the cryptographic modulecryptographic module for testing
and validation
[SOURCE: ISO/IEC 19790:2025, 3.156]
Formatted: Source, Don't adjust space between Latin
and Asian text, Don't adjust space between Asian text
and numbers
4 Abbreviated terms
API application programming interface
CPU central processing unit
DPA differential power analysis
DEMA differential electromagnetic analysis
DRBG determined random bit generator
HDD hard disk drive
IUT implementation under test
RSA rivest-shamir-adlemanRivest-Shamir-Adleman
SEMA simple electromagnetic analysis
SHA secure hash algorithm
SPA simple power analysis
SSD solid state drive
5 Structure of this document
This document is divided into the following clauses:
 — Knowledge (Clause 6), and
Formatted: List Continue 1, No bullets or numbering,
Tab stops: 0.7 cm, Left + 1.4 cm, Left + 2.1 cm, Left +
2.8 cm, Left + 3.5 cm, Left + 4.2 cm, Left + 4.9 cm, Left
 — Skills (Clause 7).
+ 5.6 cm, Left + 6.3 cm, Left + 7 cm, Left
© ISO/IEC 2025 – All rights reserved
ISO/IEC FDIS 19896-2:2025(en)
Formatted: 머리말, Centered
Formatted: Font: Cambria
Each clause corresponds to an aspect of the knowledge and skills requirements of personnel performing
testing activities or validating activities as introduced in ISO/IEC 19896-1 for a conformance scheme using
ISO/IEC 19790 and ISO/IEC 24759.
6 Knowledge
6.1 General
6.2 and 6.3 provide knowledge requirements that a tester or a validator knows and describe the differences
Formatted: cite_sec
between a validator and tester, and the relevant requirements for validators and testers .
Formatted: Indent: Left: 0 cm, First line: 0 ch
6.2 Requirements for testers
6.2.1 Tertiary education
6.2.1.1 General
Testers shall have educational qualifications such as an associate, bachelor, or higher degree that is relevant
to the security requirements addressed in ISO/IEC 19790 and the test requirements in ISO/IEC 24759. The
testers shall at a minimum demonstrate they have either:
a) successfully completed appropriate tertiary education with at least three years of study in disciplines
related to IT or IT security; or
b) experience equivalent to the tertiary education in disciplines related to IT, IT security or IT system
administration.
6.2.1.2 Technical specialtiesspecialities
In addition to the minimum level of educational requirements in 6.2.1.1, testers shall have educational
qualifications such as an associate, bachelor,
...

PROJET FINAL
Norme
internationale
ISO/IEC
FDIS
19896-2
ISO/IEC JTC 1/SC 27
Sécurité de l'information,
Secrétariat: DIN
cybersécurité et sécurité de la
Début de vote:
vie privée ― Exigences relatives
2025-10-08
aux compétences du personnel
Vote clos le:
des organismes d'évaluation de la
2025-12-03
conformité de la sécurité TI —
Partie 2:
Exigences en matière de
connaissances et de compétences
pour les testeurs et les validateurs
conformément à la série ISO/IEC
19790 et à l'ISO/IEC 24759
Information security, cybersecurity and privacy protection —
Requirements for the competence of IT security conformance
assessment body personnel —
Part 2: Knowledge and skills requirements for testers and
validators according to ISO/IEC 19790 and ISO/IEC 24759
LES DESTINATAIRES DU PRÉSENT PROJET SONT
INVITÉS À PRÉSENTER, AVEC LEURS OBSERVATIONS,
NOTIFICATION DES DROITS DE PROPRIÉTÉ DONT ILS
AURAIENT ÉVENTUELLEMENT CONNAISSANCE ET À
FOURNIR UNE DOCUMENTATION EXPLICATIVE.
OUTRE LE FAIT D’ÊTRE EXAMINÉS POUR
ÉTABLIR S’ILS SONT ACCEPTABLES À DES FINS
INDUSTRIELLES, TECHNOLOGIQUES ET COM-MERCIALES,
AINSI QUE DU POINT DE VUE DES UTILISATEURS, LES
PROJETS DE NORMES
TRAITEMENT PARALLÈLE ISO/CEN
INTERNATIONALES DOIVENT PARFOIS ÊTRE CONSIDÉRÉS
DU POINT DE VUE DE LEUR POSSI BILITÉ DE DEVENIR DES
NORMES POUVANT
SERVIR DE RÉFÉRENCE DANS LA RÉGLEMENTATION
NATIONALE.
Numéro de référence
ISO/IEC FDIS 19896-2:2025(fr) © ISO/IEC 2025

PROJET FINAL
ISO/IEC FDIS 19896-2:2025(fr)
Norme
internationale
ISO/IEC
FDIS
19896-2
ISO/IEC JTC 1/SC 27
Sécurité de l'information,
Secrétariat: DIN
cybersécurité et sécurité de la
Début de vote:
vie privée ― Exigences relatives
2025-10-08
aux compétences du personnel
Vote clos le:
des organismes d'évaluation de la
2025-12-03
conformité de la sécurité TI —
Partie 2:
Exigences en matière de
connaissances et de compétences
pour les testeurs et les validateurs
conformément à la série ISO/IEC
19790 et à l'ISO/IEC 24759
Information security, cybersecurity and privacy protection —
Requirements for the competence of IT security conformance
assessment body personnel —
Part 2: Knowledge and skills requirements for testers and
validators according to ISO/IEC 19790 and ISO/IEC 24759
LES DESTINATAIRES DU PRÉSENT PROJET SONT
INVITÉS À PRÉSENTER, AVEC LEURS OBSERVATIONS,
NOTIFICATION DES DROITS DE PROPRIÉTÉ DONT ILS
AURAIENT ÉVENTUELLEMENT CONNAISSANCE ET À
FOURNIR UNE DOCUMENTATION EXPLICATIVE.
DOCUMENT PROTÉGÉ PAR COPYRIGHT
OUTRE LE FAIT D’ÊTRE EXAMINÉS POUR
ÉTABLIR S’ILS SONT ACCEPTABLES À DES FINS
© ISO/IEC 2025
INDUSTRIELLES, TECHNOLOGIQUES ET COM-MERCIALES,
AINSI QUE DU POINT DE VUE DES UTILISATEURS, LES
Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en œuvre, aucune partie de cette
PROJETS DE NORMES
publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, TRAITEMENT PARALLÈLE ISO/CEN
INTERNATIONALES DOIVENT PARFOIS ÊTRE CONSIDÉRÉS
y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut DU POINT DE VUE DE LEUR POSSI BILITÉ DE DEVENIR DES
NORMES POUVANT
être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
SERVIR DE RÉFÉRENCE DANS LA RÉGLEMENTATION
NATIONALE.
ISO copyright office
Case postale 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Genève
Tél.: [phone]
E-mail: [e-mail]
Web: www.iso.org
Publié en Suisse
Numéro de référence
ISO/IEC FDIS 19896-2:2025(fr) © ISO/IEC 2025

© ISO/IEC 2025 – Tous droits réservés
ii
ISO/IEC FDIS 19896-2:2025(fr)
Sommaire Page
Avant-propos .iv
Introduction .vi
1 Domaine d'application . 1
2 Références normatives . 1
3 Termes et définitions . 2
4 Abréviations . 2
5 Structure du présent document. 3
6 Connaissances . . 3
6.1 Généralités .3
6.2 Exigences relatives aux testeurs .3
6.2.1 Enseignement tertiaire .3
6.2.2 Connaissance des normes .8
6.2.3 Connaissance du programme de validation .9
6.2.4 Connaissance des exigences de l'ISO/IEC TS 23532-2 .10
6.3 Exigences relatives aux validateurs .11
6.3.1 Enseignement tertiaire .11
6.3.2 Connaissance des normes .11
6.3.3 Connaissance du programme de validation .11
6.3.4 Connaissance des exigences de l'ISO/IEC TS 23532-2 . 12
7 Savoir-faire .13
7.1 Exigences relatives aux testeurs . 13
7.1.1 Généralités . 13
7.1.2 Essais des algorithmes . 13
7.1.3 Essais de sécurité physique . 13
7.1.4 Analyse des canaux secondaires . 13
7.1.5 Types de technologie . 13
7.2 Exigences relatives aux validateurs . 13
8 Enregistrement d'un journal pour les testeurs et les validateurs.13
Annexe A (informative) Exemple de journal pour les testeurs et les validateurs . 14
Annexe B (informative) Ontologie des types de technologie .15
Bibliographie . 17

© ISO/IEC 2025 – Tous droits réservés
iii
ISO/IEC FDIS 19896-2:2025(fr)
Avant-propos
L'ISO (Organisation internationale de normalisation) et l'IEC (Commission électrotechnique internationale)
forment le système spécialisé de la normalisation mondiale. Les organismes nationaux membres de l'ISO
ou de l'IEC participent au développement de Normes Internationales par l'intermédiaire des comités
techniques créés par l'organisation concernée afin de s'occuper des domaines particuliers de l'activité
technique. Les comités techniques de l'ISO et de l'IEC collaborent dans des domaines d'intérêt commun.
D'autres organisations internationales, gouvernementales et non gouvernementales, en liaison avec l'ISO et
l'IEC participent également aux travaux.
Les procédures utilisées pour élaborer le présent document et celles destinées à sa mise à jour sont décrites
dans les Directives ISO/IEC, Partie 1. Il convient, en particulier, de prendre note des différents critères
d'approbation requis pour les différents types de documents. Le présent document a été rédigé conformément
aux règles de rédaction données dans les Directives ISO/IEC, Partie 2 (voir www.iso.org/directives ou
www.iec.ch/members_experts/refdocs).
L'ISO et l'IEC attirent l'attention sur le fait que la mise en application du présent document peut entraîner
l'utilisation d'un ou de plusieurs brevets. L'ISO et L'IEC ne prennent pas position quant à la preuve, à la
validité et à l'applicabilité de tout droit de propriété revendiqué à cet égard. À la date de publication du
présent document, l'ISO et l'IEC n'avaient pas reçu notification qu'un ou plusieurs brevets pouvaient être
nécessaires à sa mise en application. Toutefois, il y a lieu d'avertir les responsables de la mise en application
du présent document que des informations plus récentes sont susceptibles de figurer dans la base de données
de brevets, disponible à l'adresse www.iso.org/brevets et https://patents.iec.ch. L'ISO et l'IEC ne sauraient
être tenues pour responsables de ne pas avoir identifié de tels droits de propriété et averti de leur existence.
Les appellations commerciales éventuellement mentionnées dans le présent document sont données pour
information, par souci de commodité, à l'intention des utilisateurs et ne sauraient constituer un engagement.
Pour une explication de la nature volontaire des normes, la signification des termes et expressions
spécifiques de l'ISO liés à l'évaluation de la conformité, ou pour toute information au sujet de l'adhésion de
l'ISO aux principes de l'Organisation mondiale du commerce (OMC) concernant les obstacles techniques au
commerce (OTC), voir www.iso.org/avant-propos. Pour l'IEC, voir www.iec.ch/understanding-standards.
Le présent document a été élaboré par le comité technique ISO/IEC JTC 1, Technologies de l'information,
sous-comité SC 27, Sécurité de l'information, cybersécurité et protection de la vie privée, en collaboration
avec le comité technique CEN/CLC/JTC 13, Cybersécurité et protection des données, du Comité européen de
normalisation (CEN), conformément à l'Accord de coopération technique entre l'ISO et le CEN (Accord de
Vienne).
Cette deuxième édition annule et remplace la première édition (ISO/IEC 19896-2:2018), qui fait l'objet d'une
révision technique.
Les principales modifications sont les suivantes:
— le document a été restructuré:
— suppression de paragraphes liés à l'expérience, à l'instruction et à l'efficacité;
— des modifications techniques ont été introduites:
— suppression des éléments de compétence, d'expérience, d'instruction et d'efficacité, conformément
aux commentaires de l'ISO/du CASCO, à l'exception des éléments de connaissance et de savoir-faire.
— ajout des exigences de compétence pour les validateurs;
— l'Annexe C a été supprimée.
Une liste de toutes les parties de la série ISO/IEC 19896 se trouve sur les sites Web de l'ISO et de l'IEC.

© ISO/IEC 2025 – Tous droits réservés
iv
ISO/IEC FDIS 19896-2:2025(fr)
Il convient que l’utilisateur adresse tout retour d’information ou toute question concernant le présent
document à l’organisme national de normalisation de son pays. Une liste exhaustive desdits organismes se
trouve aux adresses www.iso.org/fr/members.html et www.iec.ch/national-committees.

© ISO/IEC 2025 – Tous droits réservés
v
ISO/IEC FDIS 19896-2:2025(fr)
Introduction
Le présent document spécifie les exigences spécialisées en matière de connaissances et de compétences pour
les testeurs et les validateurs, qui réalisent des projets de tests de sécurité conformément à l'ISO/IEC 19790
et à l'ISO/IEC 24759. L'ISO/IEC 19790 spécifie des exigences en matière de sécurité pour les modules
cryptographiques. L'ISO/IEC 19790 a servi de base à l'élaboration de nombreux schémas de validation et
d'accords de reconnaissance. L'ISO/IEC 19790 permet une comparabilité entre les résultats des projets de
tests de sécurité indépendants. L'ISO/IEC 24759 soutient cette approche en fournissant un ensemble commun
d'exigences de test pour soumettre à essai la conformité à l'ISO/IEC 19790 d'un module cryptographique.
Les exigences en matière de connaissance et de savoir-faire des testeurs individuels chargés de la réalisation
des projets de test sont des facteurs essentiels pour assurer la comparaison des résultats de ces validations.
Les exigences en matière de connaissance et de savoir-faire des validateurs individuels chargés de la
réalisation des projets de validation sont également des facteurs essentiels pour la validation des résultats
des projets detests.
L'ISO/IEC TS 23532-2, qui est souvent spécifiée comme une norme à laquelle le laboratoire de test est
conforme, indique dans l'ISO/IEC TS 23532-2:2021, 6.2 que les exigences de compétence pour chaque
fonction influant sur les résultats des activités du laboratoire sont documentées, y compris les exigences
relatives à l'éducation, à la qualification, à la formation, aux connaissances techniques, aux compétences
et à l'expérience. Le document fournit l'exigence selon laquelle le personnel a la compétence d'exécuter
les activités de laboratoire dont il est responsable et d'évaluer l'importance des écarts spécifiés dans
l'ISO/IEC TS 23532-2:2021, 6.2.
Le présent document s'adresse aux autorités de validation, aux laboratoires de test, aux testeurs, aux
validateurs et aux organisations proposant des qualifications et des reconnaissances professionnelles.
Le présent document établit une base de référence pour les exigences en matière de connaissances et de
savoir-faire des:
— testeurs, pour garantir l'harmonisation des exigences relatives aux programmes de tests de conformité
des modules cryptographiques; et
— validateurs, pour garantir l'harmonisation des exigences relatives aux programmes de validation de
modules cryptographiques.
© ISO/IEC 2025 – Tous droits réservés
vi
PROJET FINAL Norme internationale ISO/IEC FDIS 19896-2:2025(fr)
Sécurité de l'information, cybersécurité et sécurité de la vie
privée ― Exigences relatives aux compétences du personnel des
organismes d'évaluation de la conformité de la sécurité TI —
Partie 2:
Exigences en matière de connaissances et de compétences
pour les testeurs et les validateurs conformément à la série
ISO/IEC 19790 et à l'ISO/IEC 24759
1 Domaine d'application
Le présent document fournit les exigences minimales en matière de connaissances et de savoir-faire des
testeurs et validateurs des organismes d'évaluation chargé de réaliser des activités de test et de validation
dans le cadre d'un schéma de conformité utilisant l'ISO/IEC 19790 et l'ISO/IEC 24759.
2 Références normatives
Les documents suivants sont cités dans le texte de sorte qu'ils constituent, pour tout ou partie de leur
contenu, des exigences du présent document. Pour les références datées, seule l'édition citée s'applique. Pour
les références non datées, la dernière édition du document de référence s’applique (y compris les éventuels
amendements).
ISO/IEC 17825, Technologie de l'information — Techniques de sécurité — Méthodes de test pour la protection
contre les attaques non intrusives des modules cryptographiques
ISO/IEC 18367, Technologie de l'information — Techniques de sécurité — Essais de conformité des algorithmes
cryptographiques et des mécanismes de sécurité
ISO/IEC 19790:2025, Sécurité de l’information, cybersécurité et protection de la vie privée — Exigences de
sécurité pour les modules cryptographiques
ISO/IEC 19896-1, Techniques de sécurité IT — Exigences de compétence pour les testeurs et les évaluateurs en
matière de sécurité de l’information — Partie 1: Introduction, concepts et exigences générales
ISO/IEC 20085-1, Techniques de sécurité IT — Exigences de l'outil de test et méthodes d'étalonnage de
l'outil de test utilisées pour tester les techniques d'atténuation des attaques non invasives dans les modules
cryptographiques — Partie 1: Outils et techniques de test
ISO/IEC 20085-2, Techniques de sécurité IT — Exigences de l'outil de test et méthodes d'étalonnage de
l'outil de test utilisées pour tester les techniques d'atténuation des attaques non invasives dans les modules
cryptographiques — Partie 2: Méthodes et appareillage d'étalonnage et d'essai
ISO/IEC 20543, Technologies de l'information — Techniques de sécurité — Méthodes d'essai et d'analyse des
générateurs de bits aléatoires dans l'ISO/IEC 19790 et l'ISO/IEC 15408
ISO/IEC/TS 23532-2:2021, Sécurité de l'information, cybersécurité et protection de la vie privée — Exigences
relatives aux compétences des laboratoires d'essais et d'évaluation de la sécurité TI — Partie 2: Essais pour
l'ISO/IEC 19790
ISO/IEC 24759:2025, Sécurité de l’information, cybersécurité et protection de la vie privée — Exigences d'essai
pour modules cryptographiques
© ISO/IEC 2025 – Tous droits réservés
ISO/IEC FDIS 19896-2:2025(fr)
3 Termes et définitions
Pour les besoins du présent document, les termes et les définitions de l'ISO/IEC 19896-1, de
l'ISO/IEC TS 23532-2 et de l'ISO/IEC 19790 s'appliquent.
L'ISO et l'IEC tiennent à jour des bases de données terminologiques destinées à être utilisées en normalisation,
consultables aux adresses suivantes:
— ISO Online browsing platform: disponible à l'adresse https:// www .iso .org/ obp
— IEC Electropedia: disponible à l'adresse https:// www .electropedia .org/
3.1
environnement d'exécution
environnement dans lequel un programme ou une application est exécuté
Note 1 à l'article: Cela peut concerner le système d'exploitation lui-même ou le logiciel qui fonctionne sous celui-ci.
L'objectif principal est d'atteindre l'objectif de la programmation «indépendante de la plate-forme».
[SOURCE: ISO/IEC 19790:2025, 3.121]
3.2
connaissance répartie
processus par lequel une clé cryptographique est divisée en plusieurs composants de clé, qui ne partagent
entre eux aucune connaissance de la clé d'origine, qui peuvent ultérieurement être entrés par des opérateurs
distincts dans un module cryptographique, ou en sortir, et être assemblés afin de recréer la clé d'origine
Note 1 à l'article: La totalité ou un sous-ensemble des composants est requis pour récupérer la clé divisée d'origine.
[SOURCE: ISO/IEC 19790:2025, 3.144]
3.3
utilisateur
opérateur qui accède à un module cryptographique afin d'effectuer des services de sécurité généraux, y
compris les opérations cryptographiques et toute autre fonction de sécurité approuvée
[SOURCE: ISO/IEC 19790:2025, 3.154]
Note 1 à l'article: un utilisateur est un opérateur qui assume le rôle d'utilisateur
3.4
fournisseur
entité, groupe ou association qui soumet le module cryptographique à des fins d'essai et de validation
[SOURCE: ISO/IEC 19790:2025, 3.156]
4 Abréviations
DPA analyse de la puissance différentielle
DEMA analyse électromagnétique différentielle
IUT mise en œuvre soumise à l'essai
RSA Rivest-Shamir-Adleman
SEMA simple analyse électromagnétique
SPA simple analyse de la puissance

© ISO/IEC 2025 – Tous droits réservés
ISO/IEC FDIS 19896-2:2025(fr)
5 Structure du présent document
Le présent document est composé des articles suivants:
— Connaissances (Article 6); et
— Compétences (Article 7).
Chaque article correspond à un aspect des exigences en matière de connaissances et de savoir-faire du
personnel chargé de réaliser les activités de test ou de validation, telles qu'elles sont introduites dans
l'ISO/IEC 19896-1 pour un schéma de conformité utilisant l'ISO/IEC 19790 et l'ISO/IEC 24759.
6 Connaissances
6.1 Généralités
Les 6.2 et 6.3 fournissent des exigences relatives aux connaissances qu'un testeur ou un validateur connaît
et décrit les différences entre un validateur et un testeur, ainsi que les exigences applicables aux validateurs
et aux testeurs.
6.2 Exigences relatives aux testeurs
6.2.1 Enseignement tertiaire
6.2.1.1 Généralités
Les testeurs doivent disposer d'un niveau d'instruction tel qu'un diplôme associé, une licence ou un diplôme
supérieur en rapport avec les exigences de sécurité traitées dans l'ISO/IEC 19790 et les exigences de test de
l'ISO/IEC 24759. Les testeurs doivent démontrer qu'ils ont au moins:
a) terminé avec succès un cycle d'instruction supérieure approprié comprenant au moins trois ans d'études
dans des disciplines liées aux TI ou à la sécurité des TI; ou
b) une expérience équivalente à un niveau d'instruction supérieure dans des disciplines liées aux TI, à la
sécurité des TI ou à l'administration des systèmes TI.
6.2.1.2 Spécialités techniques
En plus du niveau d'instruction minimal requis en 6.2.1.1, les testeurs doivent posséder des qualifications en
matière d'instruction telles qu'un diplôme associé, une licence ou un diplôme supérieur correspondant aux
spécialités techniques spécifiques. Voici quelques exemples de spécialités techniques spécifiques:
— concepts cryptographiques;
— technologie de l'ingénierie;
— ingénierie électrique;
— ingénierie mécanique;
— ingénierie des matériaux;
— ingénierie chimique;
— technologie du traitement de l’information;
— ingénierie informatique;
— sciences de l'informatique;
© ISO/IEC 2025 – Tous droits réservés
ISO/IEC FDIS 19896-2:2025(fr)
— réseaux informatiques;
— cybersécurité;
— systèmes d'information;
— gestion de laboratoire;
— mathématiques et physique;
— développement et sécurité des logiciels; ou
— ingénierie des logiciels.
6.2.1.3 Domaines de spécialité
Un testeur doit au minimum démontrer ses connaissances sur au moins un sujet de spécialité spécifique
décrit dans l'ISO/IEC 19790 et l'ISO/IEC 24759.
Un laboratoire de test doit avoir des connaissances dans les domaines de spécialisation spécifiés dans
l'ISO/IEC 19790 et l'ISO/IEC 24759 en tant qu'agrégat de son personnel technique.
Les domaines de spécialité spécifiés dans l'ISO/IEC 19790 et l'ISO/IEC 24759 sont les suivants:
a) développement de logiciel et micrologiciel:
1) langages de programmation (par exemple, assembleur et langage de haut niveau);
2) compilateurs;
3) outils de débogage;
4) tests de produit réalisés par le fournisseur:
i) tests unitaires;
ii) tests d'intégration;
iii) tests de régression;
b) systèmes d'exploitation:
1) installation;
2) configuration;
3) fonctionnement;
4) architecture;
5) durcissement du système;
6) machines virtuelles;
7) environnement d'exécution java;
c) développement de matériel:
1) réalisations matérielles:
i) mono composant;
© ISO/IEC 2025 – Tous droits réservés
ISO/IEC FDIS 19896-2:2025(fr)
ii) multi-composants;
2) technologie:
i) fabrication à un seul composant;
ii) composants électriques et conception, schémas et concepts, y compris la conception logique et les
représentations en langage de description de matériel (Hardware Description Language, HDL);
iii) conception mécanique et conditionnement;
3) fabrication:
i) intégrité de la chaîne d'approvisionnement;
ii) méthodes de fabrication;
iii) initialisation des paramètres;
iv) conditionnement et expédition;
v) tests et caractérisation;
4) fonctions de sécurité du matériel;
d) environnements opérationnels:
1) chargeur de démarrage (boot loader);
2) charge
...