ISO/DIS 14298

Graphic technology -- Management of security printing processes

Technologie graphique -- Management des procédés d'impression de sécurité

Standards Content (sample)

DRAFT INTERNATIONAL STANDARD
ISO/DIS 14298
ISO/TC 130 Secretariat: SAC
Voting begins on: Voting terminates on:
2021-01-15 2021-04-09
Graphic technology — Management of security printing
processes
Technologie graphique — Management des procédés d'impression de sécurité
ICS: 37.100.01
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
This document is circulated as received from the committee secretariat.
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/DIS 14298:2021(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION. ISO 2021
---------------------- Page: 1 ----------------------
ISO/DIS 14298:2021(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2021

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO 2021 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/DIS 14298:2021(E)
Contents Page

Foreword ........................................................................................................................................................................................................................................iv

Introduction ..................................................................................................................................................................................................................................v

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

4 Context of the organization ....................................................................................................................................................................... 6

4.1 Understanding the organization and its context ....................................................................................................... 6

4.2 Understanding the needs and expectations of interested parties .............................................................. 6

4.3 Determining the scope of the security printing management system .................................................... 6

4.4 Security printing management system .............................................................................................................................. 6

5 Leadership .................................................................................................................................................................................................................. 7

5.1 Leadership and commitment ..................................................................................................................................................... 7

5.2 Policy ............................................................................................................................................................................................................... 8

5.3 Organization roles, responsibilities and authorities .............................................................................................. 8

6 Planning ......................................................................................................................................................................................................................... 9

6.1 Actions to address risk and opportunities ...................................................................................................................... 9

6.2 Security objectives and planning to achieve them ................................................................................................... 9

6.3 Security printing management system planning ...................................................................................................10

7 Support ........................................................................................................................................................................................................................10

7.1 Resources ..................................................................................................................................................................................................10

7.2 Competence ............................................................................................................................................................................................10

7.3 Awareness ................................................................................................................................................................................................11

7.4 Communication ...................................................................................................................................................................................11

7.5 Documented information ............................................................................................................................................................11

7.5.1 General...................................................................................................................................................................................11

7.5.2 Creating and updating ..............................................................................................................................................12

7.5.3 Control of documented information ............................................................................................................12

8 Operation ..................................................................................................................................................................................................................13

9 Performance evaluation ............................................................................................................................................................................13

9.1 Monitoring, measurement, analysis and evaluation ............................................................................................13

9.2 Internal audit .........................................................................................................................................................................................14

9.3 Management review ........................................................................................................................................................................14

10 Improvement .........................................................................................................................................................................................................15

10.1 Nonconformity, security breaches and corrective actions .............................................................................15

10.2 Preventive actions .............................................................................................................................................................................15

10.3 Continual improvement ...............................................................................................................................................................16

Annex A (normative) Determination of security requirements related to the security

printing management system ..............................................................................................................................................................17

Bibliography .............................................................................................................................................................................................................................21

© ISO 2021 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/DIS 14298:2021(E)
Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of ISO documents should be NOTEd. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

on the ISO list of patent declarations received (see www .iso .org/ patents).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www .iso .org/

iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC130, Graphic Technology.

This second edition cancels and replaces the first edition (ISO 14298:2013), which has been editorially

revised.
The main changes compared to the previous edition are as follows:

— Update of definitions according to the latest version of ISO/IEC Directives, Part 1, Consolidated ISO

Supplement;
— Editorial changes based on previous comments from ISO;
— Update of the lay-out.
A list of all parts in the ISO 14298 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A

complete listing of these bodies can be found at www .iso .org/ members .html.
iv © ISO 2021 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/DIS 14298:2021(E)
Introduction
General

This International Standard specifies requirements for a security printing management system for

security printers.

Current security printing management practices lack sufficient guarantees that effective security

controls are maintained to protect the interest of the customer as well as the general public. Using this

International Standard the organization establishes, documents, implements and maintains a security

printing management system. This security printing management system is regularly reviewed to

continually improve its effectiveness. It is recognized that customer requirements sometimes exceed

the requirements of this International Standard so the security printing management system also

addresses customer requirements that are beyond the scope of this International Standard.

The adoption of a security printing management system is a strategic decision of an organization. The

design and implementation of an organization’s security printing management system is influenced by

varying needs, particular objectives, products provided, processes employed, security environment,

cultural issues, legal limitations, risk assessment and by size and structure of the organization.

To achieve the objectives of this security printing management system standard measures are taken to

mitigate all of the security threats determined by an organizational risk assessment. Such controls focus

upon reducing, eliminating and preventing acts that compromise the security printing management

system of the organization.

It is not the intent of this International Standard to obtain uniformity in the structure of the security

printing management system or uniformity of documented information. The security printing

management system complies with laws and regulations in force. The requirements specified in

this International Standard are supplementary to requirements for products and processes of an

organization and allow for additional specific requirements from the customer.

This International Standard is intended to apply to security printers. It contains requirements that

when implemented by a security printer may be objectively audited for certification/registration

purposes.
Process approach

This International Standard promotes the adoption of a process approach when developing,

implementing and improving the effectiveness of a security printing management system.

The application of a system of processes within an organization, together with the identification

and interaction of these processes, and their management, is referred to as a “process approach”. An

advantage of a “process approach” is the ongoing control that it provides over the interaction between

individual processes within the system of processes, as well as over their combination.

Basic principles
When implemented, the security printing management system:

a) achieves the security of products, processes, means of production, premises, information, raw

material supplies;

b) is used to continue to meet demonstrably the requirements, and naturally, the needs of customers;

c) affords management the confidence that the targeted degree of security is actually achieved and

remains effective;

d) affords the customers the confidence that the agreed nature and degree of security is or will be

attained.
© ISO 2021 – All rights reserved v
---------------------- Page: 5 ----------------------
ISO/DIS 14298:2021(E)

This International Standard prescribes which elements a security printing management system

contains and not how a specific organization implements these elements.
vi © ISO 2021 – All rights reserved
---------------------- Page: 6 ----------------------
DRAFT INTERNATIONAL STANDARD ISO/DIS 14298:2021(E)
Graphic technology — Management of security printing
processes
1 Scope

This International Standard specifies requirements for a security printing management system for

security printers.

This International Standard specifies a minimum set of security printing management system

requirements. Organizations ensure that customer security requirements are met as appropriate

provided these do not conflict with the requirements of this International Standard.

2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at http:// www .electropedia .org/
3.1
organization

person or group of people that has its own functions with responsibilities, authorities and relationships

to achieve its objectives (3.8)

Note 1 to entry: The concept of organization includes but is not limited to sole-trader, company, corporation, firm,

enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated

or not, public or private.
3.2
interested party
stakeholder

person or organization (3.1) that can affect, be affected by, or perceive itself to be affected by a decision

or activity
3.3
requirement
need or expectation that is stated, generally implied or obligatory

Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization and

interested parties that the need or expectation under consideration is implied.

Note 2 to entry: A specified requirement is one that is stated, for example in documented information.

© ISO 2021 – All rights reserved 1
---------------------- Page: 7 ----------------------
ISO/DIS 14298:2021(E)
3.4
management system

set of interrelated or interacting elements of an organization (3.1) to establish policies (3.7) and

objectives (3.8), and processes (3.12) to achieve those objectives

Note 1 to entry: A management system can address a single discipline or several disciplines.

Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning

and operation.

Note 3 to entry: The scope of a management system may include the whole of the organization, specific and

identified functions of the organization, specific and identified sections of the organization, or one or more

functions across a group of organizations.
3.5
top management

person or group of people who directs and controls an organization (3.1) at the highest level

Note 1 to entry: Top management has the power to delegate authority and provide resources within the

organization.

Note 2 to entry: If the scope of the management system (3.4) covers only part of an organization then top

management refers to those who direct and control that part of the organization.
3.6
effectiveness
extent to which planned activities are realized and planned results achieved
3.7
policy

intentions and direction of an organization (3.1) as formally expressed by its top management (3.5)

3.8
objective
result to be achieved
Note 1 to entry: An objective can be strategic, tactical, or operational.

Note 2 to entry: Objectives can relate to different disciplines (such as financial, health and safety, and

environmental goals) and can apply at different levels [such as strategic, organization-wide, project, product and

process (3.12)].

Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an

operational criterion, as a security objective (3.32) or by the use of other words with similar meaning (e.g. aim,

goal, or target).

Note 4 to entry: In the context of security printing management systems security objectives (3.32) are set by the

organization, consistent with the security policy, to achieve specific results.
3.9
risk
effect of uncertainty

Note 1 to entry: An effect is a deviation from the expected — positive or negative.

Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or

knowledge of, an event, its consequence, or likelihood.

Note 3 to entry: Risk is often characterized by reference to potential “events” (SOURCE: ISO Guide 73:2009,

3.5.1.3) and “consequences” (SOURCE: ISO Guide 73:2009, 3.6.1.3), or a combination of these.

Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including

changes in circumstances) and the associated “likelihood” (SOURCE: ISO Guide 73:2009, 3.6.1.1) of occurrence.

2 © ISO 2021 – All rights reserved
---------------------- Page: 8 ----------------------
ISO/DIS 14298:2021(E)
3.10
competence
ability to apply knowledge and skills to achieve intended results
3.11
documented information

information required to be controlled and maintained by an organization (3.1) and the medium on

which it is contained

Note 1 to entry: Documented information can be in any format and media and from any source.

Note 2 to entry: Documented information can refer to the management system (3.4), including related processes

(3.12); information created in order for the organization to operate (documentation); and evidence of results

achieved (records).
3.12
process

set of interrelated or interacting activities which transforms inputs into outputs

3.13
performance
measurable result

Note 1 to entry: Performance can relate either to quantitative or qualitative findings.

Note 2 to entry: Performance can relate to the management of activities, processes (3.12), products (including

services), systems or organizations (3.1).
3.14
outsource (verb)

make an arrangement where an external organization (3.1) performs part of an organization’s function

or process (3.12)

Note 1 to entry: An external organization is outside the scope of the management system (3.4), although the

outsourced function or process is within the scope.
3.15
monitoring
determining the status of a system, a process (3.12) or an activity

Note 1 to entry: To determine the status there may be a need to check, measure, supervise or critically observe.

3.16
measurement
process (3.12) to determine a value
3.17
audit

systematic, independent and documented process (3.12) for obtaining audit evidence and evaluating it

objectively to determine the extent to which the audit criteria are fulfilled

Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),

and it can be a combined audit (combining two or more disciplines).

Note 2 to entry: An internal audit is conducted by the organization itself, or by an external party on its behalf.

Note 3 to entry: “Audit evidence” and “audit criteria” (SOURCE: ISO 19011).
3.18
conformity
fulfilment of a requirement (3.3)
© ISO 2021 – All rights reserved 3
---------------------- Page: 9 ----------------------
ISO/DIS 14298:2021(E)
3.19
nonconformity
non-fulfilment of a requirement (3.3)
3.20
correction
action to eliminate a detected nonconformity (3.19)
3.21
corrective action

action to eliminate the cause of a nonconformity (3.19) and to prevent recurrence

3.22
continual improvement
recurring activity to enhance performance (3.13)
3.23
risk assessment
overall process of risk identification, risk analysis and risk evaluation
[SOURCE: ISO Guide 73:2009, 3.4.1 ]
3.24
security printer

producer of printed documents or products of value or entitlement, ID documents or security foils (3.26)

which are physically protected against forgery, counterfeiting and alteration by security features (3.27)

3.25
security printing

set of processes (3.12) which transform raw materials into documents or products of value or

entitlement, ID documents or security foils (3.26) physically protected by security features (3.27)

3.26
security foil

thin film material that contains an optical variable element or similar security feature (3.27), which

is applied onto documents or products to physically protect them against forgery, counterfeiting and

alteration
3.27
security feature

component integrated in the product to protect against forgery, counterfeiting and alteration

3.28
security

protection of products, processes, information, means of production, security features and the

supply chain
3.29
threat

action or potential occurrence, whether or not malicious, to breach the security (3.28) of the system

3.30
security breach
infraction or violation of security
3.31
documented procedure
established way of working, documented, implemented and maintained
4 © ISO 2021 – All rights reserved
---------------------- Page: 10 ----------------------
ISO/DIS 14298:2021(E)
3.32
security objective
result to be achieved with regard to security (3.28)

Note 1 to entry: Security objectives are in general based on the security policy of the organization.

Note 2 to entry: Security objectives are in general specified for relevant functions and levels in the organization.

3.33
security management

coordinated activities to direct and control an organization with regard to security (3.28)

Note 1 to entry: “Direct and control” in general entails the establishment of the policy, objectives, planning,

control, security assurance and improvements with regards to security (3.28). Security assurance represents all

planned and systematic actions needed to give a sufficient degree of confidence that a product or process (3.12)

meets the security requirements.
3.34
security plan

documented information that specifies the procedures and resources to satisfy the security

requirements of the organization
3.35
security control

aspect of security management (3.33) aimed at the fulfilment of the security requirements

3.36
preventive action
action to prevent the cause of a nonconformity (3.19)
3.37
traceability
ability to trace the history, application or location of an object

Note 1 to entry: When considering a product or a service, traceability can relate to the origin of materials and

parts, the processing history and the distribution and location of the product or service after delivery.

(SOURCE: ISO 9000:2015, 3.6.13 modified)
3.38
resource

personnel, information, premises, process equipment (software and hardware) and tools

3.39
supply chain

set of interconnected processes (3.12) and resources (3.38) that starts with the sourcing of raw materials

and ends with the delivery of products and services to the customer

Note 1 to entry: Supply chains include producers, suppliers, manufacturers, distributors, wholesalers, vendors,

and logistics providers. They include facilities, plants, offices, warehouses, and branches and can be both internal

and external to an organization.

Note 2 to entry: Supply chain management as related to this International Standard includes the vetting of

suppliers and customers from the point of initial security value, which is the point at which security is added to

the product.
© ISO 2021 – All rights reserved 5
---------------------- Page: 11 ----------------------
ISO/DIS 14298:2021(E)
4 Context of the organization
4.1 Understanding the organization and its context

The organization shall determine external and internal issues that are relevant to its purpose and that

affect its ability to achieve the intended outcome(s) of its security printing management system.

4.2 Understanding the needs and expectations of interested parties
The organization shall determine:

— the interested parties that are relevant to the security printing management system;

— the relevant requirements of these interested parties.

Certification is only possible if the organization has followed the regulations of the certification

procedure and if it has established a security printing management system in accordance with the

specifications of this procedure. Furthermore the security printing management system has to comply

with laws and regulations in force.
4.3 Determining the scope of the security printing management system

The organization shall determine the boundaries and applicability of the security printing management

system to establish its scope.
When determining this scope, the organization shall consider:
— the external and internal issues referred to in 4.1;
— the requirements referred to in 4.2.
The scope shall be available as documented information.
4.4 Security printing management system

The organization shall establish, implement, maintain and continually improve a security printing

management system including the processes needed and their interactions in accordance with the

requirements of this International Standard including the processes needed as outlined in normative

Annex A and their interactions.

It is recognized that customer requirements may exceed the requirements of this International

Standard so the security printing management system also addresses customer requirements that are

beyond the scope of this International Standard.
The organization shall conduct a risk assessment on at least the following:
a) Customer-related risk

EXAMPLE Unauthorized purchase, distribution or illegal use of a product by a customer.

b) Information-related risk
EXAMPLE Unwanted, unintended, prompted or unprompted disclosure of information.
c) Security material, product and waste-related risk
EXAMPLE Theft, damage, sabotage or loss of security materials.
d) Supply chain-related risk

EXAMPLE Any subversion or compromise of the security of the organization's security products and

related services at any point in the supply chain.
6 © ISO 2021 – All rights reserved
---------------------- Page: 12 ----------------------
ISO/DIS 14298:2021(E)
e) Physical intrusion and access-related risk
EXAMPLE Intrusion into sensitive physical areas.
f) Personnel-related risk
EXAMPLE Personnel fraud or unauthorized actions.
g) Disaster-related risk
EXAMPLE Security breakdowns that result from either
...