SIST EN ISO/IEC 15408-2:2026

• Abstract:

  This document specifies requirements for the required structure and content of security functional components for use during a security evaluation. It includes a catalogue of functional components that meet the common security functionality requirements of many IT products.

• Status: Published
• Public Enquiry End Date: 10-Nov-2024
• Publication Date: 16-Sep-2026
• ICS: 35.030 - IT Security
• Technical Committee: ITC - Information technology
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 13-Aug-2026
• Due Date: 18-Oct-2026
• Completion Date: 17-Sep-2026
• Ref Project: EN ISO/IEC 15408-2:2026 - Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components (ISO/IEC 15408-2:2026)

• Replaces: SIST EN ISO/IEC 15408-2:2024 - Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components (ISO/IEC 15408-2:2022)
• Effective Date: 01-Oct-2026

Overview

SIST EN ISO/IEC 15408-2:2026, titled Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components, is a key international standard published by SIST. This document specifies the structure and content requirements for security functional components used in the security evaluation of IT products. By providing a comprehensive catalogue of functional components, the standard addresses common and essential security functionalities required by a diverse range of IT systems.

Adopting ISO/IEC 15408-2 helps organizations streamline the evaluation of IT security by ensuring consistency, thoroughness, and comparability across products and environments. It is particularly relevant for manufacturers, evaluators, and users seeking to benchmark and improve product security within an internationally recognized framework.

Key Topics

• Security Functional Components: The standard details both the structural organization and content guidelines for security functional components. These components encompass the requirements and functionalities central to IT security.
• Functional Classes and Families: The document organizes requirements into classes (such as security audit, communication, cryptographic support, user data protection, etc.), each containing related families and components.
• Component Cataloguing: A catalogue structure is provided to help select and apply relevant security functionalities, tailored to the specific context of IT products.
• Component Structure and Relationships: Clear guidelines clarify the relationships, rationale, and intended behaviour of each component.
• Evaluation Support: Comprehensive notes and guidelines support both implementers and evaluators, enhancing transparency and consistency during IT security assessments.

Applications

SIST EN ISO/IEC 15408-2:2026 is a valuable reference in various sectors and scenarios, including:

• Product Certification: It forms the backbone of security evaluation for IT products, supporting national and international certification processes and frameworks, such as Common Criteria.
• Security Development Lifecycles: Developers use component guidelines when designing, specifying, and implementing security features in software, hardware, and systems.
• Procurement and Compliance: Procurement professionals and regulators leverage this standard to set clear, objective requirements for product security compliance.
• Custom Security Profiles: The component catalogue enables organizations to develop tailored security profiles and Protection Profiles for specialized environments, such as critical infrastructure, financial systems, or sensitive data management.
• Cross-Industry Interoperability: Its structured approach to security functions promotes interoperability and coherence between solutions in a rapidly evolving digital ecosystem.

Related Standards

For a holistic approach to IT security, consider these related standards:

• ISO/IEC 15408-1: Introduction and general model for IT security evaluation.
• ISO/IEC 15408-3: Security assurance components - provides details on evaluating the assurance of product security.
• ISO/IEC 27001: Requirements for Information Security Management Systems (ISMS).
• ISO/IEC 18045: Methodology for IT security evaluation.
• ISO/IEC 19790: Security requirements for cryptographic modules.

Practical Value

By implementing SIST EN ISO/IEC 15408-2:2026, organizations benefit from:

• A harmonized and recognized baseline for evaluating IT product security functionality
• Greater assurance in procurement and deployment decisions
• Enhanced transparency and communication between stakeholders
• Robust support for meeting regulatory, legal, and industry requirements in information security, cybersecurity, and privacy protection

This standard is integral for both IT product manufacturers aiming for market acceptance and end-users seeking trustworthy, secure technology solutions.

SLOVENSKI STANDARD
01-oktober-2026
Nadomešča:
SIST EN ISO/IEC 15408-2:2024
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Merila za
vrednotenje varnosti IT - 2. del: Funkcionalne varnostne komponente (ISO/IEC
15408-2:2026)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT
security - Part 2: Security functional components (ISO/IEC 15408-2:2026)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Evaluationskriterien für IT-Sicherheit - Teil 2: Sicherheitsfunktionskomponenten (ISO/IEC
15408-2:2026)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères
d'évaluation pour la sécurité des technologies de l'information - Partie 2: Composants
fonctionnels de sécurité (ISO/IEC 15408-2:2026)
Ta slovenski standard je istoveten z: EN ISO/IEC 15408-2:2026
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD EN ISO/IEC 15408-2

NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2026
ICS 35.030
Supersedes EN ISO/IEC 15408-2:2023
English version
Information security, cybersecurity and privacy protection
- Evaluation criteria for IT security - Part 2: Security
functional components (ISO/IEC 15408-2:2026)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Critères d'évaluation pour la sécurité der Privatsphäre - Evaluationskriterien für IT-
des technologies de l'information - Partie 2: Sicherheit - Teil 2: Sicherheitsfunktionskomponenten
Composants fonctionnels de sécurité (ISO/IEC 15408- (ISO/IEC 15408-2:2026)
2:2026)
This European Standard was approved by CEN on 1 May 2026.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2026 CEN/CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 15408-2:2026 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3

European foreword
This document (EN ISO/IEC 15408-2:2026) has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology" in collaboration with Technical Committee CEN-CENELEC/ JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by November 2026, and conflicting national standards
shall be withdrawn at the latest by November 2026.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 15408-2:2023.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC
websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 15408-2:2026 has been approved by CEN-CENELEC as EN ISO/IEC 15408-2:2026
without any modification.
International
Standard
ISO/IEC 15408-2
Fifth edition
Information security, cybersecurity
2026-05
and privacy protection —
Evaluation criteria for IT security —
Part 2:
Security functional components
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies
de l'information —
Partie 2: Composants fonctionnels de sécurité
Reference number
ISO/IEC 15408-2:2026(en) © ISO/IEC 2026

ISO/IEC 15408-2:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 15408-2:2026(en)
Contents Page
Foreword . xv
Introduction . xvi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 3
5 Overview . 4
5.1 General .4
5.2 Organization of this document . .4
6 Functional requirements paradigm . . 5
7 Security functional components . 8
7.1 Overview .8
7.2 Functional class structure .8
7.2.1 General .8
7.2.2 Class name .9
7.2.3 Class introduction .9
7.2.4 Class informative notes .9
7.2.5 Functional families .9
7.3 Functional family structure .9
7.3.1 General .9
7.3.2 Family name .10
7.3.3 Family Behaviour .10
7.3.4 Component levelling and description .10
7.3.5 Component management .10
7.3.6 Component audit .11
7.3.7 Family application notes .11
7.3.8 Family evaluator notes.11
7.3.9 Functional components .11
7.4 Functional component structure . 12
7.4.1 General . 12
7.4.2 Component name . 12
7.4.3 Component relationships . 12
7.4.4 Component rationale . 13
7.4.5 Component notes . . 13
7.4.6 Functional elements . 13
7.5 Functional elements. 13
7.6 Component catalogue .14
7.6.1 General .14
7.6.2 Highlighting of component changes . 15
8 Class FAU Security audit .15
8.1 Introduction . 15
8.2 Notes on class FAU .17
8.2.1 General information about audit requirements .17
8.2.2 Audit requirements in a distributed environment .17
8.3 Security audit automatic response (FAU_ARP) .18
8.3.1 Family Behaviour .18
8.3.2 Component levelling and description .18
8.3.3 Component management .18
8.3.4 Component audit .18
8.3.5 Application notes .18
8.3.6 FAU_ARP.1 Security alarms .19
8.4 Security audit data generation (FAU_GEN) .19

© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 15408-2:2026(en)
8.4.1 Family Behaviour .19
8.4.2 Component levelling and description .19
8.4.3 Component management .19
8.4.4 Component audit . 20
8.4.5 Application notes . 20
8.4.6 Evaluator notes .21
8.4.7 FAU_GEN.1 Audit data generation .21
8.4.8 FAU_GEN.2 User identity association . 22
8.5 Security audit analysis (FAU_SAA) . 23
8.5.1 Family Behaviour . 23
8.5.2 Component levelling and description . 23
8.5.3 Component management . 23
8.5.4 Component audit .24
8.5.5 Application notes .24
8.5.6 FAU_SAA.1 Potential violation analysis .24
8.5.7 FAU_SAA.2 Profile based anomaly detection . 25
8.5.8 FAU_SAA.3 Simple attack heuristics . 26
8.5.9 FAU_SAA.4 Complex attack heuristics .27
8.6 Security audit review (FAU_SAR) . 29
8.6.1 Family Behaviour . 29
8.6.2 Component levelling and description . 29
8.6.3 Component management . 29
8.6.4 Component audit . 30
8.6.5 Application notes . 30
8.6.6 FAU_SAR.1 Audit review . 30
8.6.7 FAU_SAR.2 Restricted audit review .31
8.6.8 FAU_SAR.3 Selectable audit review .31
8.7 Security audit event selection (FAU_SEL) .32
8.7.1 Family Behaviour .32
8.7.2 Component levelling and description .32
8.7.3 Component management .32
8.7.4 Component audit .32
8.7.5 Application notes .32
8.7.6 FAU_SEL.1 Selective audit . 33
8.8 Security audit data storage (FAU_STG) . 33
8.8.1 Family Behaviour . 33
8.8.2 Component levelling and description . 33
8.8.3 Component management . 34
8.8.4 Component audit . 35
8.8.5 Application notes . 35
8.8.6 FAU_STG.1 Audit data storage location . 35
8.8.7 FAU_STG.2 Protected audit data storage . 36
8.8.8 FAU_STG.3 Guarantees of audit data availability . 36
8.8.9 FAU_STG.4 Action in case of possible audit data loss .37
8.8.10 FAU_STG.5 Prevention of audit data loss . 38
9 Class FCO Communication .38
9.1 Introduction . 38
9.2 Notes on class FCO . . 39
9.3 Non-repudiation of origin (FCO_NRO) . 39
9.3.1 Family Behaviour . 39
9.3.2 Component levelling and description . 39
9.3.3 Component management . 40
9.3.4 Component audit . 40
9.3.5 Application notes . 40
9.3.6 FCO_NRO.1 Selective proof of origin .41
9.3.7 FCO_NRO.2 Enforced proof of origin .42
9.4 Non-repudiation of receipt (FCO_NRR) .42
9.4.1 Family Behaviour .42

© ISO/IEC 2026 – All rights reserved
iv
ISO/IEC 15408-2:2026(en)
9.4.2 Component levelling and description .43
9.4.3 Component management .43
9.4.4 Component audit .43
9.4.5 Application notes .43
9.4.6 FCO_NRR.1 Selective proof of receipt . 44
9.4.7 FCO_NRR.2 Enforced proof of receipt .45
10 Class FCS Cryptographic support .46
10.1 Introduction . 46
10.2 Notes on class FCS . 48
10.3 Cryptographic key management (FCS_CKM) . 50
10.3.1 Family Behaviour . 50
10.3.2 Component levelling and description . 50
10.3.3 Component management .51
10.3.4 Component audit .51
10.3.5 Application notes .51
10.3.6 Evaluator notes .52
10.3.7 FCS_CKM.1 Cryptographic key generation .52
10.3.8 FCS_CKM.2 Cryptographic key distribution . 53
10.3.9 FCS_CKM.3 Cryptographic key access . 53
10.3.10 FCS_CKM.5 Cryptographic key derivation . 54
10.3.11 FCS_CKM.6 Timing and event of cryptographic key destruction . 55
10.4 Cryptographic operation (FCS_COP) . 56
10.4.1 Family Behaviour . 56
10.4.2 Component levelling and description . 56
10.4.3 Component management . 56
10.4.4 Component audit . 56
10.4.5 Application notes . 56
10.4.6 FCS_COP.1 Cryptographic operation .57
10.5 Random bit generation (FCS_RBG) . 58
10.5.1 Family Behaviour . 58
10.5.2 Component levelling and description . 58
10.5.3 Component management .59
10.5.4 Component audit .59
10.5.5 Application notes .59
10.5.6 FCS_RBG.1 Random bit generation (RBG) .59
10.5.7 FCS_RBG.2 Random bit generation (external seeding) .61
10.5.8 FCS_RBG.3 Random bit generation (internal seeding - single source) .61
10.5.9 FCS_RBG.4 Random bit generation (internal seeding - multiple sources) .62
10.5.10 FCS_RBG.5 Random bit generation (combining entropy sources) .62
10.5.11 FCS_RBG.6 Random bit generation service . 63
10.6 Generation of random numbers (FCS_RNG) . 63
10.6.1 Family Behaviour . 63
10.6.2 Component levelling and description . 64
10.6.3 Component management . 64
10.6.4 Component audit . 64
10.6.5 Application notes . 64
10.6.6 FCS_RNG.1 Random number generation . 64
11 Class FDP User data protection .66
11.1 Introduction . 66
11.2 Notes on class FDP . 69
11.3 Access control policy (FDP_ACC) .71
11.3.1 Family Behaviour .71
11.3.2 Component levelling and description . 72
11.3.3 Component management . 72
11.3.4 Component audit . 72
11.3.5 Application notes . 72
11.3.6 FDP_ACC.1 Subset access control . 73
11.3.7 FDP_ACC.2 Complete access control . 73

© ISO/IEC 2026 – All rights reserved
v
ISO/IEC 15408-2:2026(en)
11.4 Access control functions (FDP_ACF) .74
11.4.1 Family Behaviour .74
11.4.2 Component levelling and description .74
11.4.3 Component management .74
11.4.4 Component audit . 75
11.4.5 Application notes . 75
11.4.6 FDP_ACF.1 Security attribute-based access control . 75
11.5 Data authentication (FDP_DAU) . 77
11.5.1 Family Behaviour . 77
11.5.2 Component levelling and description . 77
11.5.3 Component management . 77
11.5.4 Component audit . 77
11.5.5 Application notes . 78
11.5.6 FDP_DAU.1 Basic Data Authentication . 78
11.5.7 FDP_DAU.2 Data Authentication with Identity of Guarantor . 78
11.6 Export from the TOE (FDP_ETC) . 79
11.6.1 Family Behaviour . 79
11.6.2 Component levelling and description . 79
11.6.3 Component management . 80
11.6.4 Component audit . 80
11.6.5 Application notes . 80
11.6.6 FDP_ETC.1 Export of user data without security attributes . 80
11.6.7 FDP_ETC.2 Export of user data with security attributes . 81
11.7 Information flow control policy (FDP_IFC) . 82
11.7.1 Family Behaviour . 82
11.7.2 Component levelling and description . 82
11.7.3 Component management . 82
11.7.4 Component audit . 82
11.7.5 Application notes . 82
11.7.6 FDP_IFC.1 Subset information flow control. 83
11.7.7 FDP_IFC.2 Complete information flow control . 84
11.8 Information flow control functions (FDP_IFF) . 85
11.8.1 Family Behaviour . 85
11.8.2 Component levelling and description . 85
11.8.3 Component management .
...