SIST EN ISO/IEC 15408-2:2026

• Abstract:

  This document specifies requirements for the required structure and content of security functional components for use during a security evaluation. It includes a catalogue of functional components that meet the common security functionality requirements of many IT products.

• Status: Published
• Public Enquiry End Date: 10-Nov-2024
• Publication Date: 16-Sep-2026
• ICS: 35.030 - IT Security
• Technical Committee: ITC - Information technology
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 13-Aug-2026
• Due Date: 18-Oct-2026
• Completion Date: 17-Sep-2026
• Ref Project: EN ISO/IEC 15408-2:2026 - Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components (ISO/IEC 15408-2:2026)

• Replaces: SIST EN ISO/IEC 15408-2:2024 - Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components (ISO/IEC 15408-2:2022)
• Effective Date: 01-Oct-2026

SIST EN ISO/IEC 15408-2:2026 is the Slovenian adoption of EN ISO/IEC 15408-2:2026, published through SIST and based on ISO/IEC 15408-2:2026. It specifies the required structure and content of security functional components used in IT security evaluation, and it provides a catalogue of common components for many IT security functions. It is written for authors of protection profiles (PP), PP-Modules, functional packages and security targets (ST), and for evaluators who assess those requirements.

What does SIST EN ISO/IEC 15408-2:2026 specify?

SIST EN ISO/IEC 15408-2:2026 specifies how security functional components are structured and what content they contain when they are used during a security evaluation. Clause 1 says the document provides a catalogue of functional components that meet common security functionality needs across many IT products.

Clause 5 explains that the catalogue is a set of well-understood components and not a complete answer to every IT security problem. It is meant to be maintained as needs change, so it supports practical specification work rather than freezing one fixed security model.

The document is organized from general guidance to detailed component catalogues:

• Clauses 2-4 cover normative references, terms and abbreviations.
• Clause 5 gives the overview and document organization.
• Clause 6 sets out the functional requirements paradigm.
• Clause 7 defines the structure of classes, families, components and elements.
• Clauses 8-18 present the functional classes, from FAU through FTP, with detailed component definitions.

What are the key requirements of SIST EN ISO/IEC 15408-2:2026?

How the document models security requirements

Clause 6 says security functional requirements (SFRs) define the rules by which the target of evaluation (TOE) governs access to and use of its resources. The TOE security functionality (TSF) is the hardware, software and firmware that enforce those rules.

Clause 6 also separates user data from TSF data, and it distinguishes subjects, objects, sessions, roles, trusted channels, trusted paths and the TSF interface (TSFI). In practice, this matters because the author of a PP, PP-Module, functional package or ST must decide exactly what is controlled, who can interact with it, and where the TOE boundary lies.

How to select and combine components

Clause 7 defines the hierarchy of class, family, component and element. It also says that when a component is selected for a PP, PP-Module, functional package or ST, the complete set of elements in that component is selected, not just individual elements.

That rule matters because it keeps requirements coherent. A reader specifying a TOE cannot mix and match partial pieces of a component as if they were separate options; the specification must use the component as a whole and apply the assignment, iteration, refinement or selection operations where they are provided.

What the audit class requires

Clause 8, FAU, covers security audit. It includes audit data generation, user identity association, audit analysis, audit review, selective audit, and audit data storage.

In practice, FAU means the TOE should be able to recognize security-relevant events, record them, link them to the responsible user where needed, and protect the audit trail from loss or tampering. The class also includes responses to possible security violations and actions when audit data loss is possible, which is important for products that rely on logs for accountability or incident handling.

What the cryptographic support class covers

Clause 10, FCS, covers cryptographic key management, cryptographic operation, random bit generation and random number generation. It names components for key generation, distribution, access, derivation and destruction, and for several kinds of random bit generation services.

The practical point is that the TOE author must select the component that matches each cryptographic method actually implemented. For FCS_COP.1, the algorithm and key sizes must be specified; for random generation components, the TOE must state how randomness is produced and what quality or seeding approach applies.

How user data protection is organized

Clause 11, FDP, is the main user data protection class. It covers access control policy and functions, information flow control policy and functions, data authentication, export and import, internal TOE transfer, residual information protection, rollback, stored data confidentiality and integrity, and inter-TSF user data confidentiality and integrity transfer protection.

This matters because the class separates policy from mechanism. The author first names the security policy in scope, then chooses the components that define how the TOE enforces that policy over containers, information flows, stored data, transfers and communications with other trusted IT products.

How identity and authentication are handled

Clause 12, FIA, covers authentication failures, proof of identity, user attribute definition, specification of secrets, user authentication, user identification and user-subject binding. It is the class that connects a claimed user identity to the security attributes that the TOE uses.

In practice, this is where login behavior, lockout behavior, secrets such as passwords or other authenticators, and the timing of identification and authentication are specified. It matters because many other security functions depend on the TOE knowing who the user is and what attributes apply to that user or subject.

How security administration is managed

Clause 13, FMT, covers management of security attributes, TSF data, security functions and security roles. It also includes revocation, time-limited authorization, specification of management functions and restrictions on roles.

For a reader, this is the part that defines who can change what, under which role, and for how long. It is the place to specify administrative separation, controlled changes to security attributes, expiry of authorization, and any limits on capabilities or availability that support the intended security policy.

How privacy is addressed

Clause 14, FPR, covers anonymity, pseudonymity, unlinkability and unobservability. These families describe how the TOE can protect users against discovery and misuse of identity by other users.

In practice, this section is useful when a system must hide identity, use aliases, prevent linkage of actions, or prevent observation of activity. The document also notes that these privacy goals can affect audit and accountability, so a PP or ST must balance privacy requirements with the need to trace security-relevant events.

What the later classes add

The contents show later classes for TSF protection, resource utilization, access and trusted path/channels. Their component headings include self-test, physical attack detection and resistance, fault tolerance, priority of service, session locking, access banners, and trusted channel establishment and data protection.

Those clauses matter when the TOE must protect itself, survive failures, control concurrent use, or secure communication with users and trusted products. They round out the catalogue beyond audit, crypto, data protection, identity and privacy.

What terms does SIST EN ISO/IEC 15408-2:2026 define?

• target of evaluation (TOE) - the product or system being evaluated against the security requirements.
• TOE security functionality (TSF) - the hardware, software and firmware relied on to enforce the security functional requirements.
• security functional requirement (SFR) - a requirement that states how the TOE must behave to enforce a security policy.
• security functional policy (SFP) - the set of rules enforced by the TSF for a named scope of control.
• TSF interface (TSFI) - the interactive or programmatic interface through which controlled access to the TSF is provided.
• TSF data - data the TSF relies on for enforcement, such as security attributes, authentication data or internal status variables.
• user data - data handled by the TOE that is meaningful to an external entity but does not affect TSF operation.
• trusted channel - a means for a TOE and another trusted IT product to communicate with necessary confidence.

Who uses SIST EN ISO/IEC 15408-2:2026?

SIST EN ISO/IEC 15408-2:2026 is used by authors of protection profiles (PP), PP-Modules, functional packages and security targets (ST) when they define the security functional requirements for a TOE. It gives them the vocabulary and component structure needed to state what the product must do.

Security evaluators use it to understand what a selected component means and how the component catalogue is organized. That helps them check whether a security target is complete and whether the chosen components match the intended security objectives.

Product architects, security engineers and buyers use it when they need to compare security functions such as audit, authentication, access control, cryptography, privacy and trusted communication. It is especially relevant for IT products where the security claim depends on named policies and clearly scoped interactions.

What changed in SIST EN ISO/IEC 15408-2:2026 from the previous edition?

SIST EN ISO/IEC 15408-2:2026 replaces SIST EN ISO/IEC 15408-2:2024. The European text also supersedes EN ISO/IEC 15408-2:2023, and the adopted ISO/IEC text is approved without modification.

Which standards are used with SIST EN ISO/IEC 15408-2:2026?

• ISO/IEC 15408-1:2026 - provides the introduction and general model, and Clause 5 points to its guidance on SFR structure, component organization, security functional packages, PPs, PP-Modules, PP-Configurations and STs.
• ISO/IEC 15408-3:2026 - provides the security assurance components that complement the functional components in this part.
• ISO/IEC 18045:2026 - provides the requirements and methodology for IT security evaluation.
• ISO/IEC/TS 19249 - is named for architectural and design principles such as least privilege and attack surface minimization.
• ISO/IEC/TS 19608 - is named for selecting and specifying SFRs to protect personally identifiable information (PII) and for coordinating privacy and SFRs.
• ISO/IEC 29100 - is named for privacy principles used when developing privacy functional requirements as extended components.

What does the SIST EN ISO/IEC 15408-2:2026 document contain?

The document contains the class, family, component and element structure used to express security functional requirements. It includes explanatory figures, dependency tables, family behavior, component levelling, component management, component audit, application notes, evaluator notes and component rationale.

It also contains detailed component definitions for classes such as FAU, FCO, FCS, FDP, FIA, FMT and FPR, with later classes shown in the contents for TSF protection, resource utilization, access and trusted path/channels. The component entries are written so that a PP, PP-Module, functional package or ST author can select full components and apply the required operations.

For practical use, the document gives the catalogued building blocks needed to specify audit behavior, cryptographic support, data protection, user identification and authentication, security administration and privacy behavior. That makes it a working reference for specification, evaluation and review of TOE security functions.

SLOVENSKI STANDARD
01-oktober-2026
Nadomešča:
SIST EN ISO/IEC 15408-2:2024
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Merila za
vrednotenje varnosti IT - 2. del: Funkcionalne varnostne komponente (ISO/IEC
15408-2:2026)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT
security - Part 2: Security functional components (ISO/IEC 15408-2:2026)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Evaluationskriterien für IT-Sicherheit - Teil 2: Sicherheitsfunktionskomponenten (ISO/IEC
15408-2:2026)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères
d'évaluation pour la sécurité des technologies de l'information - Partie 2: Composants
fonctionnels de sécurité (ISO/IEC 15408-2:2026)
Ta slovenski standard je istoveten z: EN ISO/IEC 15408-2:2026
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD EN ISO/IEC 15408-2

NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2026
ICS 35.030
Supersedes EN ISO/IEC 15408-2:2023
English version
Information security, cybersecurity and privacy protection
- Evaluation criteria for IT security - Part 2: Security
functional components (ISO/IEC 15408-2:2026)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Critères d'évaluation pour la sécurité der Privatsphäre - Evaluationskriterien für IT-
des technologies de l'information - Partie 2: Sicherheit - Teil 2: Sicherheitsfunktionskomponenten
Composants fonctionnels de sécurité (ISO/IEC 15408- (ISO/IEC 15408-2:2026)
2:2026)
This European Standard was approved by CEN on 1 May 2026.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2026 CEN/CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 15408-2:2026 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3

European foreword
This document (EN ISO/IEC 15408-2:2026) has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology" in collaboration with Technical Committee CEN-CENELEC/ JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by November 2026, and conflicting national standards
shall be withdrawn at the latest by November 2026.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 15408-2:2023.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC
websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 15408-2:2026 has been approved by CEN-CENELEC as EN ISO/IEC 15408-2:2026
without any modification.
International
Standard
ISO/IEC 15408-2
Fifth edition
Information security, cybersecurity
2026-05
and privacy protection —
Evaluation criteria for IT security —
Part 2:
Security functional components
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies
de l'information —
Partie 2: Composants fonctionnels de sécurité
Reference number
ISO/IEC 15408-2:2026(en) © ISO/IEC 2026

ISO/IEC 15408-2:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 15408-2:2026(en)
Contents Page
Foreword . xv
Introduction . xvi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 3
5 Overview . 4
5.1 General .4
5.2 Organization of this document . .4
6 Functional requirements paradigm . . 5
7 Security functional components . 8
7.1 Overview .8
7.2 Functional class structure .8
7.2.1 General .8
7.2.2 Class name .9
7.2.3 Class introduction .9
7.2.4 Class informative notes .9
7.2.5 Functional families .9
7.3 Functional family structure .9
7.3.1 General .9
7.3.2 Family name .10
7.3.3 Family Behaviour .10
7.3.4 Component levelling and description .10
7.3.5 Component management .10
7.3.6 Component audit .11
7.3.7 Family application notes .11
7.3.8 Family evaluator notes.11
7.3.9 Functional components .11
7.4 Functional component structure . 12
7.4.1 General . 12
7.4.2 Component name . 12
7.4.3 Component relationships . 12
7.4.4 Component rationale . 13
7.4.5 Component notes . . 13
7.4.6 Functional elements . 13
7.5 Functional elements. 13
7.6 Component catalogue .14
7.6.1 General .14
7.6.2 Highlighting of component changes . 15
8 Class FAU Security audit .15
8.1 Introduction . 15
8.2 Notes on class FAU .17
8.2.1 General information about audit requirements .17
8.2.2 Audit requirements in a distributed environment .17
8.3 Security audit automatic response (FAU_ARP) .18
8.3.1 Family Behaviour .18
8.3.2 Component levelling and description .18
8.3.3 Component management .18
8.3.4 Component audit .18
8.3.5 Application notes .18
8.3.6 FAU_ARP.1 Security alarms .19
8.4 Security audit data generation (FAU_GEN) .19

© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 15408-2:2026(en)
8.4.1 Family Behaviour .19
8.4.2 Component levelling and description .19
8.4.3 Component management .19
8.4.4 Component audit . 20
8.4.5 Application notes . 20
8.4.6 Evaluator notes .21
8.4.7 FAU_GEN.1 Audit data generation .21
8.4.8 FAU_GEN.2 User identity association . 22
8.5 Security audit analysis (FAU_SAA) . 23
8.5.1 Family Behaviour . 23
8.5.2 Component levelling and description . 23
8.5.3 Component management . 23
8.5.4 Component audit .24
8.5.5 Application notes .24
8.5.6 FAU_SAA.1 Potential violation analysis .24
8.5.7 FAU_SAA.2 Profile based anomaly detection . 25
8.5.8 FAU_SAA.3 Simple attack heuristics . 26
8.5.9 FAU_SAA.4 Complex attack heuristics .27
8.6 Security audit review (FAU_SAR) . 29
8.6.1 Family Behaviour . 29
8.6.2 Component levelling and description . 29
8.6.3 Component management . 29
8.6.4 Component audit . 30
8.6.5 Application notes . 30
8.6.6 FAU_SAR.1 Audit review . 30
8.6.7 FAU_SAR.2 Restricted audit review .31
8.6.8 FAU_SAR.3 Selectable audit review .31
8.7 Security audit event selection (FAU_SEL) .32
8.7.1 Family Behaviour .32
8.7.2 Component levelling and description .32
8.7.3 Component management .32
8.7.4 Component audit .32
8.7.5 Application notes .32
8.7.6 FAU_SEL.1 Selective audit . 33
8.8 Security audit data storage (FAU_STG) . 33
8.8.1 Family Behaviour . 33
8.8.2 Component levelling and description . 33
8.8.3 Component management . 34
8.8.4 Component audit . 35
8.8.5 Application notes . 35
8.8.6 FAU_STG.1 Audit data storage location . 35
8.8.7 FAU_STG.2 Protected audit data storage . 36
8.8.8 FAU_STG.3 Guarantees of audit data availability . 36
8.8.9 FAU_STG.4 Action in case of possible audit data loss .37
8.8.10 FAU_STG.5 Prevention of audit data loss . 38
9 Class FCO Communication .38
9.1 Introduction . 38
9.2 Notes on class FCO . . 39
9.3 Non-repudiation of origin (FCO_NRO) . 39
9.3.1 Family Behaviour . 39
9.3.2 Component levelling and description . 39
9.3.3 Component management . 40
9.3.4 Component audit . 40
9.3.5 Application notes . 40
9.3.6 FCO_NRO.1 Selective proof of origin .41
9.3.7 FCO_NRO.2 Enforced proof of origin .42
9.4 Non-repudiation of receipt (FCO_NRR) .42
9.4.1 Family Behaviour .42

© ISO/IEC 2026 – All rights reserved
iv
ISO/IEC 15408-2:2026(en)
9.4.2 Component levelling and description .43
9.4.3 Component management .43
9.4.4 Component audit .43
9.4.5 Application notes .43
9.4.6 FCO_NRR.1 Selective proof of receipt . 44
9.4.7 FCO_NRR.2 Enforced proof of receipt .45
10 Class FCS Cryptographic support .46
10.1 Introduction . 46
10.2 Notes on class FCS . 48
10.3 Cryptographic key management (FCS_CKM) . 50
10.3.1 Family Behaviour . 50
10.3.2 Component levelling and description . 50
10.3.3 Component management .51
10.3.4 Component audit .51
10.3.5 Application notes .51
10.3.6 Evaluator notes .52
10.3.7 FCS_CKM.1 Cryptographic key generation .52
10.3.8 FCS_CKM.2 Cryptographic key distribution . 53
10.3.9 FCS_CKM.3 Cryptographic key access . 53
10.3.10 FCS_CKM.5 Cryptographic key derivation . 54
10.3.11 FCS_CKM.6 Timing and event of cryptographic key destruction . 55
10.4 Cryptographic operation (FCS_COP) . 56
10.4.1 Family Behaviour . 56
10.4.2 Component levelling and description . 56
10.4.3 Component management . 56
10.4.4 Component audit . 56
10.4.5 Application notes . 56
10.4.6 FCS_COP.1 Cryptographic operation .57
10.5 Random bit generation (FCS_RBG) . 58
10.5.1 Family Behaviour . 58
10.5.2 Component levelling and description . 58
10.5.3 Component management .59
10.5.4 Component audit .59
10.5.5 Application notes .59
10.5.6 FCS_RBG.1 Random bit generation (RBG) .59
10.5.7 FCS_RBG.2 Random bit generation (external seeding) .61
10.5.8 FCS_RBG.3 Random bit generation (internal seeding - single source) .61
10.5.9 FCS_RBG.4 Random bit generation (internal seeding - multiple sources) .62
10.5.10 FCS_RBG.5 Random bit generation (combining entropy sources) .62
10.5.11 FCS_RBG.6 Random bit generation service . 63
10.6 Generation of random numbers (FCS_RNG) . 63
10.6.1 Family Behaviour . 63
10.6.2 Component levelling and description . 64
10.6.3 Component management . 64
10.6.4 Component audit . 64
10.6.5 Application notes . 64
10.6.6 FCS_RNG.1 Random number generation . 64
11 Class FDP User data protection .66
11.1 Introduction . 66
11.2 Notes on class FDP . 69
11.3 Access control policy (FDP_ACC) .71
11.3.1 Family Behaviour .71
11.3.2 Component levelling and description . 72
11.3.3 Component management . 72
11.3.4 Component audit . 72
11.3.5 Application notes . 72
11.3.6 FDP_ACC.1 Subset access control . 73
11.3.7 FDP_ACC.2 Complete access control . 73

© ISO/IEC 2026 – All rights reserved
v
ISO/IEC 15408-2:2026(en)
11.4 Access control functions (FDP_ACF) .74
11.4.1 Family Behaviour .74
11.4.2 Component levelling and description .74
11.4.3 Component management .74
11.4.4 Component audit . 75
11.4.5 Application notes . 75
11.4.6 FDP_ACF.1 Security attribute-based access control . 75
11.5 Data authentication (FDP_DAU) . 77
11.5.1 Family Behaviour . 77
11.5.2 Component levelling and description . 77
11.5.3 Component management . 77
11.5.4 Component audit . 77
11.5.5 Application notes . 78
11.5.6 FDP_DAU.1 Basic Data Authentication . 78
11.5.7 FDP_DAU.2 Data Authentication with Identity of Guarantor . 78
11.6 Export from the TOE (FDP_ETC) . 79
11.6.1 Family Behaviour . 79
11.6.2 Component levelling and description . 79
11.6.3 Component management . 80
11.6.4 Component audit . 80
11.6.5 Application notes . 80
11.6.6 FDP_ETC.1 Export of user data without security attributes . 80
11.6.7 FDP_ETC.2 Export of user data with security attributes . 81
11.7 Information flow control policy (FDP_IFC) . 82
11.7.1 Family Behaviour . 82
11.7.2 Component levelling and description . 82
11.7.3 Component management . 82
11.7.4 Component audit . 82
11.7.5 Application notes . 82
11.7.6 FDP_IFC.1 Subset information flow control. 83
11.7.7 FDP_IFC.2 Complete information flow control . 84
11.8 Information flow control functions (FDP_IFF) . 85
11.8.1 Family Behaviour . 85
11.8.2 Component levelling and description . 85
11.8.3 Component management .
...