SIST EN ISO/IEC 15408-1:2024
(Main)Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 1: Introduction and general model (ISO/IEC 15408-1:2022)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 1: Introduction and general model (ISO/IEC 15408-1:2022)
This document establishes the general concepts and principles of IT security evaluation and specifies the general model of evaluation given by various parts of the standard which in its entirety is meant to be used as the basis for evaluation of security properties of IT products.
This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various parts of the ISO/IEC 15408 series; defines the terms and abbreviations to be used in all parts of the standard; establishes the core concept of a Target of Evaluation (TOE); describes the evaluation context and describes the audience to which the evaluation criteria is addressed. An introduction to the basic security concepts necessary for evaluation of IT products is given.
This document introduces:
— the key concepts of Protection Profiles (PP), PP-Modules, PP-Configurations, packages, Security Targets (ST), and conformance types;
— a description of the organization of security components throughout the model;
— the various operations by which the functional and assurance components given in ISO/IEC 15408‑2 and ISO/IEC 15408‑3 can be tailored through the use of permitted operations;
— general information about the evaluation methods given in ISO/IEC 18045;
— guidance for the application of ISO/IEC 15408‑4 in order to develop evaluation methods (EM) and evaluation activities (EA) derived from ISO/IEC 18045;
— general information about the pre-defined Evaluation Assurance Levels (EALs) defined in ISO/IEC 15408‑5;
— information in regard to the scope of evaluation schemes.
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre - Evaluationskriterien für IT-Sicherheit - Teil 1: Einführung und allgemeines Modell (ISO/IEC 15408-1:2022)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères d'évaluation pour la sécurité des technologies de l'information - Partie 1: Introduction et modèle général (ISO/IEC 15408-1:2022)
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Merila za vrednotenje varnosti IT - 1. del: Uvod in splošni model (ISO/IEC 15408-1:2022)
Ta dokument določa splošne pojme in načela vrednotenja varnosti IT ter splošni model vrednotenja, ki ga podajajo različni deli standarda in ki je celostno namenjen kot osnova za vrednotenje varnostnih lastnosti izdelkov IT.
Ta dokument podaja pregled vseh delov standarda ISO/IEC 15408 (vsi deli). Opisuje različne dele standarda; opredeljuje izraze in kratice, ki se jih uporablja v vseh delih standarda; vzpostavlja temeljni koncept ciljev vrednotenja (TOE); opisuje okvir vrednotenja in ciljne skupine, katerim so namenjena merila vrednotenja. Podan je uvod v osnovne varnostne koncepte, ki so potrebni za vrednotenje izdelkov IT.
Ta dokument uvaja:
– ključne koncepte varnostnih profilov (PP), module varnostnih profilov, konfiguracije varnostnih profilov, varnostne cilje (ST), vrste skladnosti;
– opis organizacije varnostnih komponent v modelu;
– različne operacije, s katerimi je mogoče z dovoljenimi operacijami prilagoditi elemente delovanja in zanesljivosti, podane v standardu ISO/IEC 15408-2 in ISO/IEC 15408-3;
– splošne informacije o metodah vrednotenja so podane v standardu ISO/IEC 18045;
– smernice za uporabo standarda ISO/IEC 15408-4 za razvijanje metod vrednotenja (EM) in dejavnosti vrednotenja (EA), ki izhajajo iz standarda ISO/IEC 18045;
– splošne informacije o vnaprej določenih nivojih zanesljivosti vrednotenj (EAL), opredeljenih v standardu ISO/IEC 15408-5; in
– informacije v zvezi s področjem uporabe shem vrednotenja.
General Information
- Status
- Published
- Public Enquiry End Date
- 13-Oct-2023
- Publication Date
- 11-Apr-2024
- Technical Committee
- ITC - Information technology
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 20-Mar-2024
- Due Date
- 25-May-2024
- Completion Date
- 12-Apr-2024
Relations
- Effective Date
- 01-May-2024
- Effective Date
- 22-May-2024
Overview
SIST EN ISO/IEC 15408-1:2024 (ISO/IEC 15408-1:2022) establishes the general model and foundational concepts for evaluating IT security, cybersecurity and privacy protection. Part 1 provides the introduction to the ISO/IEC 15408 series (commonly known as the Common Criteria) and defines the vocabulary, core constructs and evaluation context used across the suite. It is intended as the basis for assessing the security properties of IT products and systems.
Key topics and technical requirements
- Target of Evaluation (TOE): definition, boundary identification, configurations and operational environments that determine what is evaluated.
- Security Problem Definition (SPD): description of threats, organizational security policies (OSPs) and assumptions that drive requirements.
- Security Objectives: objectives for the TOE and for its operational environment, with guidance on tracing and justification.
- Security Requirements: introduction to Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs) that are developed in ISO/IEC 15408‑2 and ISO/IEC 15408‑3.
- Security Components Model: hierarchical organization (class → family → component → element), dependency rules and permitted operations (assignment, selection, refinement, iteration) used to tailor components.
- Packages and Conformance Types: use of functional and assurance packages, Protection Profiles (PP), PP‑Modules, PP‑Configurations and Security Targets (ST) to express and claim compliance.
- Evaluation Methods and Assurance Levels: overview of evaluation methods (see ISO/IEC 18045) and pre‑defined Evaluation Assurance Levels (EALs) (covered in ISO/IEC 15408‑5).
- Guidance for Evaluators: scope of evaluation schemes, how to apply ISO/IEC 15408‑4 to develop evaluation methods and activities.
Practical applications and who uses it
This Part 1 standard is essential for:
- Security evaluators and certification bodies - establishing evaluation scope, selecting SFRs/SARs and interpreting conformance claims.
- Product vendors and developers - preparing Security Targets and aligning product design to evaluatable requirements (PPs/STs).
- Procurement and risk owners - specifying measurable security requirements in tenders and assessing vendor claims.
- Security architects and privacy officers - mapping threats and OSPs to technical and assurance objectives.
Typical uses include product certification, development of Protection Profiles, compliance assessments and procurement-driven assurance comparisons.
Related standards
- ISO/IEC 15408‑2 (security functional components)
- ISO/IEC 15408‑3 (security assurance components)
- ISO/IEC 15408‑4 (developing evaluation methods)
- ISO/IEC 15408‑5 (EALs)
- ISO/IEC 18045 (evaluation methods)
Keywords: ISO/IEC 15408, Common Criteria, evaluation criteria, IT security, cybersecurity, privacy protection, Target of Evaluation, Protection Profile, Security Target, SFR, SAR, EAL, evaluation methods.
Frequently Asked Questions
SIST EN ISO/IEC 15408-1:2024 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 1: Introduction and general model (ISO/IEC 15408-1:2022)". This standard covers: This document establishes the general concepts and principles of IT security evaluation and specifies the general model of evaluation given by various parts of the standard which in its entirety is meant to be used as the basis for evaluation of security properties of IT products. This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various parts of the ISO/IEC 15408 series; defines the terms and abbreviations to be used in all parts of the standard; establishes the core concept of a Target of Evaluation (TOE); describes the evaluation context and describes the audience to which the evaluation criteria is addressed. An introduction to the basic security concepts necessary for evaluation of IT products is given. This document introduces: — the key concepts of Protection Profiles (PP), PP-Modules, PP-Configurations, packages, Security Targets (ST), and conformance types; — a description of the organization of security components throughout the model; — the various operations by which the functional and assurance components given in ISO/IEC 15408‑2 and ISO/IEC 15408‑3 can be tailored through the use of permitted operations; — general information about the evaluation methods given in ISO/IEC 18045; — guidance for the application of ISO/IEC 15408‑4 in order to develop evaluation methods (EM) and evaluation activities (EA) derived from ISO/IEC 18045; — general information about the pre-defined Evaluation Assurance Levels (EALs) defined in ISO/IEC 15408‑5; — information in regard to the scope of evaluation schemes.
This document establishes the general concepts and principles of IT security evaluation and specifies the general model of evaluation given by various parts of the standard which in its entirety is meant to be used as the basis for evaluation of security properties of IT products. This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various parts of the ISO/IEC 15408 series; defines the terms and abbreviations to be used in all parts of the standard; establishes the core concept of a Target of Evaluation (TOE); describes the evaluation context and describes the audience to which the evaluation criteria is addressed. An introduction to the basic security concepts necessary for evaluation of IT products is given. This document introduces: — the key concepts of Protection Profiles (PP), PP-Modules, PP-Configurations, packages, Security Targets (ST), and conformance types; — a description of the organization of security components throughout the model; — the various operations by which the functional and assurance components given in ISO/IEC 15408‑2 and ISO/IEC 15408‑3 can be tailored through the use of permitted operations; — general information about the evaluation methods given in ISO/IEC 18045; — guidance for the application of ISO/IEC 15408‑4 in order to develop evaluation methods (EM) and evaluation activities (EA) derived from ISO/IEC 18045; — general information about the pre-defined Evaluation Assurance Levels (EALs) defined in ISO/IEC 15408‑5; — information in regard to the scope of evaluation schemes.
SIST EN ISO/IEC 15408-1:2024 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
SIST EN ISO/IEC 15408-1:2024 has the following relationships with other standards: It is inter standard links to SIST EN ISO/IEC 15408-1:2020, oSIST prEN ISO/IEC 15408-1:2024. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
You can purchase SIST EN ISO/IEC 15408-1:2024 directly from iTeh Standards. The document is available in PDF format and is delivered instantly after payment. Add the standard to your cart and complete the secure checkout process. iTeh Standards is an authorized distributor of SIST standards.
Standards Content (Sample)
SLOVENSKI STANDARD
01-maj-2024
Nadomešča:
SIST EN ISO/IEC 15408-1:2020
Informacijska varnost, kibernetska varnost in varovanje zasebnosti - Merila za
vrednotenje varnosti IT - 1. del: Uvod in splošni model (ISO/IEC 15408-1:2022)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT
security - Part 1: Introduction and general model (ISO/IEC 15408-1:2022)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Evaluationskriterien für IT-Sicherheit - Teil 1: Einführung und allgemeines Modell
(ISO/IEC 15408-1:2022)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères
d'évaluation pour la sécurité des technologies de l'information - Partie 1: Introduction et
modèle général (ISO/IEC 15408-1:2022)
Ta slovenski standard je istoveten z: EN ISO/IEC 15408-1:2023
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN ISO/IEC 15408-1
NORME EUROPÉENNE
EUROPÄISCHE NORM
December 2023
ICS 35.030
Supersedes EN ISO/IEC 15408-1:2020
English version
Information security, cybersecurity and privacy protection
- Evaluation criteria for IT security - Part 1: Introduction
and general model (ISO/IEC 15408-1:2022)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Critères d'évaluation pour la sécurité der Privatsphäre - Evaluationskriterien für IT-
des technologies de l'information - Partie 1: Sicherheit - Teil 1: Einführung und allgemeines Modell
Introduction et modèle général (ISO/IEC 15408- (ISO/IEC 15408-1:2022)
1:2022)
This European Standard was approved by CEN on 20 November 2023.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2023 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN ISO/IEC 15408-1:2023 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3
European foreword
The text of ISO/IEC 15408-1:2022 has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology” of the International Organization for Standardization (ISO) and has been
taken over as EN ISO/IEC 15408-1:2023 by Technical Committee CEN-CENELEC/ JTC 13 “Cybersecurity
and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by June 2024, and conflicting national standards shall be
withdrawn at the latest by June 2024.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 15408-1:2020.
Any feedback and questions on this document should be directed to the users’ national standards body.
A complete listing of these bodies can be found on the CEN and CENELEC websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 15408-1:2022 has been approved by CEN-CENELEC as EN ISO/IEC 15408-1:2023
without any modification.
INTERNATIONAL ISO/IEC
STANDARD 15408-1
Fourth edition
2022-08
Information security, cybersecurity
and privacy protection — Evaluation
criteria for IT security —
Part 1:
Introduction and general model
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies de
l'information —
Partie 1: Introduction et modèle général
Reference number
ISO/IEC 15408-1:2022(E)
© ISO/IEC 2022
ISO/IEC 15408-1:2022(E)
© ISO/IEC 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Contents Page
Foreword . vi
Introduction .viii
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms .13
5 Overview .15
5.1 General . 15
5.2 ISO/IEC 15408 series description . 15
5.2.1 General .15
5.2.2 Audience . . 16
5.3 Target of evaluation (TOE) . 19
5.3.1 General . 19
5.3.2 TOE boundaries . 19
5.3.3 Different representations of the TOE . 20
5.3.4 Different configurations of the TOE . 20
5.3.5 Operational environment of the TOE . 20
5.4 Presentation of material in this document . 21
6 General model .21
6.1 Background . 21
6.2 Assets and security controls . 21
6.3 Core constructs of the paradigm of the ISO/IEC 15408 series . 24
6.3.1 General . 24
6.3.2 Conformance types . 24
6.3.3 Communicating security requirements. 24
6.3.4 Meeting the needs of consumers (risk owners) . 27
7 Specifying security requirements .29
7.1 Security problem definition (SPD) .29
7.1.1 General .29
7.1.2 Threats .29
7.1.3 Organizational security policies (OSPs) .30
7.1.4 Assumptions . 30
7.2 Security objectives . 31
7.2.1 General . 31
7.2.2 Security objectives for the TOE . 31
7.2.3 Security objectives for the operational environment . 31
7.2.4 Relation between security objectives and the SPD . 32
7.2.5 Tracing between security objectives and the SPD . 32
7.2.6 Providing a justification for the tracing . 33
7.2.7 On countering threats.33
7.2.8 Security objectives: conclusion . 33
7.3 Security requirements . . 33
7.3.1 General . 33
7.3.2 Security Functional Requirements (SFRs) .34
7.3.3 Security assurance requirements (SARs) .36
7.3.4 Security requirements: conclusion . 37
8 Security components .38
8.1 Hierarchical structure of security components .38
8.1.1 General .38
8.1.2 Class .38
8.1.3 Family .39
iii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
8.1.4 Component . 39
8.1.5 Element . 39
8.2 Operations . 39
8.2.1 General .39
8.2.2 Iteration .40
8.2.3 Assignment .40
8.2.4 Selection . 41
8.2.5 Refinement . . 43
8.3 Dependencies between components .44
8.4 Extended components.44
8.4.1 General .44
8.4.2 Defining extended components . 45
9 Packages .45
9.1 General . 45
9.2 Package types .46
9.2.1 General .46
9.2.2 Assurance packages .46
9.2.3 Functional packages . 47
9.3 Package dependencies . 47
9.4 Evaluation method(s) and activities. 47
10 Protection Profiles (PPs) .48
10.1 General .48
10.2 PP introduction .48
10.3 Conformance claims and conformance statements.48
10.4 Security assurance requirements (SARs) . 51
10.5 Additional requirements common to strict and demonstrable conformance . 51
10.5.1 Conformance claims and conformance statements . 51
10.5.2 Security problem definition (SPD) . 51
10.5.3 Security objectives . 52
10.6 Additional requirements specific to strict conformance . 52
10.6.1 Requirements for the security problem definition (SPD) . 52
10.6.2 Requirements for the security objectives . 52
10.6.3 Requirements for the security requirements . . 52
10.7 Additional requirements specific to demonstrable conformance .53
10.8 Additional requirements specific to exact conformance . 53
10.8.1 General .53
10.8.2 Conformance claims and statements . 53
10.9 Using PPs .54
10.10 Conformance statements and claims in the case of multiple PPs .54
10.10.1 General .54
10.10.2 Where strict or demonstrable conformance is specified .54
10.10.3 Where exact conformance is specified .54
11 Modular requirements construction .54
11.1 General .54
11.2 PP-Modules. 55
11.2.1 General . 55
11.2.2 PP-Module Base .55
11.2.3 Requirements for PP-Modules . 55
11.3 PP-Configurations . . 59
11.3.1 General . 59
11.3.2 Requirements for PP-Configurations . 59
11.3.3 Usage of PP-Configurations .65
12 Security Targets (STs) .68
12.1 General .68
12.2 Conformance claims and statements .68
12.3 Assurance requirements . 71
iv
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
12.4 Additional requirements in the exact conformance case . 71
12.4.1 Additional requirements for the conformance claim . 71
12.4.2 Additional requirements for the SPD . 71
12.4.3 Additional requirements for the security objectives.72
12.4.4 Additional requirements for the security requirements .72
12.5 Additional requirements in the multi-assurance case .72
13 Evaluation and evaluation results .74
13.1 General .74
13.2 Evaluation context . 76
13.3 Evaluation of PPs and PP-Configurations .77
13.4 Evaluation of STs .77
13.5 Evaluation of TOEs .77
13.6 Evaluation methods and evaluation activities . 78
13.7 Evaluation results . 78
13.7.1 Results of a PP evaluation . 78
13.7.2 Results of a PP-Configuration evaluation . 78
13.7.3 Results of a ST/TOE evaluation . 78
13.8 Multi-assurance evaluation .79
14 Composition of assurance .80
14.1 General .80
14.2 Composition models .81
14.2.1 Layered composition model . 81
14.2.2 Network or bi-directional composition model .82
14.2.3 Embedded composition model .82
14.3 Evaluation techniques for providing assurance in composition models .83
14.3.1 General .83
14.3.2 ACO class for composed TOEs .83
14.3.3 Composite evaluation for composite products .84
14.4 Requirements for evaluations using composition techniques . 95
14.4.1 Re-use of evaluation results . 95
14.4.2 Composition evaluation issues .96
14.5 Evaluation by composition and multi-assurance.97
Annex A (normative) Specification of packages .98
Annex B (normative) Specification of Protection Profiles (PPs) . 102
Annex C (normative) Specification of PP-Modules and PP-Configurations . 112
Annex D (normative) Specification of Security Targets (STs) and Direct Rationale STs . 125
Annex E (normative) PP/PP-Configuration conformance . 136
Bibliography .141
v
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria
needed for the different types of document should be noted. This document was drafted in
accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocs).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC
list of patent declarations received (see https://patents.iec.ch).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see
www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection.
This fourth edition cancels and replaces the third edition (ISO/IEC 15408-1:2009), which has been
technically revised.
The main changes are as follows:
— the document has been restructured;
— technical changes have been introduced:
— the terminology has been reviewed and updated;
— the exact conformance type has been introduced;
— low assurance protection profiles (PPs) have been removed and direct rationale PPs have been
introduced;
— PP-Modules and PP-Configurations for modular evaluations have been introduced;
— multi-assurance evaluation has been introduced.
A list of all parts in the ISO/IEC 15408 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
vi
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Legal notice
The governmental organizations listed below contributed to the development of this version of the
Common Criteria for Information Technology Security Evaluations. As the joint holders of the copyright
in the Common Criteria for Information Technology Security Evaluations (called CC), they hereby
grant non-exclusive license to ISO/IEC to use CC in the continued development/maintenance of the
ISO/IEC 15408 series of standards. However, these governmental organizations retain the right to use,
copy, distribute, translate or modify CC as they see fit.
Australia The Australian Signals Directorate
Canada Communications Security Establishment
France Agence Nationale de la Sécurité des Systèmes d'Information
Germany Bundesamt für Sicherheit in der Informationstechnik
Japan Information-technology Promotion Agency
Netherlands Netherlands National Communications Security Agency
New Zealand Government Communications Security Bureau
Republic of Korea National Security Research Institute
Spain Ministerio de Asuntos Económicos y Transformación Digital
Sweden FMV, Swedish Defence Materiel Administration
United Kingdom National Cyber Security Centre
United States The National Security Agency
vii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Introduction
The ISO/IEC 15408 series permits comparability between the results of independent security
evaluations by providing a common set of requirements for the security functionality of IT products and
for assurance measures applied to these IT products during a security evaluation. These IT products
may be implemented in hardware, firmware, or software.
The evaluation process establishes a level of confidence that the security functionality of these IT
products and the assurance measures applied to these IT products meet these requirements. The
evaluation results may help consumers to determine whether these IT products fulfil their security
needs.
The ISO/IEC 15408 series is useful as a guide for the development, evaluation and/or procurement of IT
products with security functionality.
The ISO/IEC 15408 series is intentionally flexible, enabling a range of evaluation approaches to be
applied to a range of security properties of a range of IT products. Therefore, users of the standard are
cautioned to exercise care that this flexibility is not misused. For example, using the ISO/IEC 15408
series in conjunction with unsuitable evaluation methods/activities, irrelevant security properties, or
inappropriate IT products, can result in meaningless evaluation results.
Consequently, the fact that an IT product has been evaluated has meaning only in the context of the
security properties that were evaluated and the evaluation methods that were used. Evaluation
authorities are advised to carefully check the products, properties, and methods to determine that an
evaluation provides meaningful results. Additionally, purchasers of evaluated products are advised to
carefully consider this context to determine whether the evaluated product is useful and applicable to
their specific situation and needs.
The ISO/IEC 15408 series addresses the protection of assets from unauthorized disclosure, modification,
or loss of use. The categories of protection relating to these three types of failure of security are
commonly called confidentiality, integrity, and availability, respectively. The ISO/IEC 15408 series may
also be applicable to aspects of IT security outside of these three categories. The ISO/IEC 15408 series
is applicable to risks arising from human activities (malicious or otherwise) and to risks arising from
non-human activities. The ISO/IEC 15408 series may be applied in other areas of IT but makes no claim
of applicability in these areas.
Certain topics, because they involve specialized techniques or because they are somewhat peripheral
to IT security, are considered to be outside the scope of the ISO/IEC 15408 series. Some of these are
identified below:
a) the ISO/IEC 15408 series does not contain security evaluation criteria pertaining to administrative
security measures not related directly to the IT security functionality. However, it is recognized
that significant security can often be achieved through or supported by administrative measures
such as organizational, personnel, physical, and procedural controls;
b) the ISO/IEC 15408 series does not address the evaluation methodology under which the criteria
should be applied;
NOTE 1 The baseline methodology is defined in ISO/IEC 18045. ISO/IEC 15408-4 can be used to further
derive evaluation activities and methods from ISO/IEC 18045.
c) the ISO/IEC 15408 series does not address the administrative and legal framework under which the
criteria may be applied by evaluation authorities. However, it is expected that the ISO/IEC 15408
series is intended to be used for evaluation purposes in the context of such a framework;
d) the procedures for use of evaluation results in accreditation are outside the scope of the
ISO/IEC 15408 series. Accreditation is the administrative process whereby authority is granted for
the operation of an IT product (or collection thereof) in its full operational environment including
all of its non-IT parts. The results of the evaluation process are an input to the accreditation process.
However, as other techniques are more appropriate for the assessments of non-IT related properties
viii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
and their relationship to the IT security parts, accreditors must make separate provisions for those
aspects;
e) the subject of criteria for the assessment of the inherent qualities of cryptographic algorithms is
not covered in the ISO/IEC 15408 series. In the case that independent assessment of mathematical
properties of cryptography is required, the evaluation scheme under which the ISO/IEC 15408
series is applied shall make provision for such assessments.
NOTE 2 This document uses bold and italic type in some cases to distinguish terms from the rest of the text.
The relationship between components within a family is highlighted using a bolding convention. This convention
calls for the use of bold type for all new requirements. For hierarchical components, requirements are presented
in bold type when they are enhanced or modified beyond the requirements of the previous component. In
addition, any new or enhanced permitted operations beyond the previous component are also highlighted using
bold type.
The use of italics indicates text that has a precise meaning. For security assurance requirements the convention
is for special verbs relating to evaluation.
ix
© ISO/IEC 2022 – All rights reserved
INTERNATIONAL STANDARD ISO/IEC 15408-1:2022(E)
Information security, cybersecurity and privacy
protection — Evaluation criteria for IT security —
Part 1:
Introduction and general model
1 Scope
This document establishes the general concepts and principles of IT security evaluation and specifies
the general model of evaluation given by various parts of the standard which in its entirety is meant to
be used as the basis for evaluation of security properties of IT products.
This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various
parts of the ISO/IEC 15408 series; defines the terms and abbreviations to be used in all parts of the
standard; establishes the core concept of a Target of Evaluation (TOE); describes the evaluation context
and describes the audience to which the evaluation criteria is addressed. An introduction to the basic
security concepts necessary for evaluation of IT products is given.
This document introduces:
— the key concepts of Protection Profiles (PP), PP-Modules, PP-Configurations, packages, Security
Targets (ST), and conformance types;
— a description of the organization of security components throughout the model;
— the various operations by which the functional and assurance components given in ISO/IEC 15408-2
and ISO/IEC 15408-3 can be tailored through the use of permitted operations;
— general information a
...
SLOVENSKI STANDARD
01-maj-2024
Nadomešča:
SIST EN ISO/IEC 15408-1:2020
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Merila za
vrednotenje varnosti IT - 1. del: Uvod in splošni model (ISO/IEC 15408-1:2022)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT
security - Part 1: Introduction and general model (ISO/IEC 15408-1:2022)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Evaluationskriterien für IT-Sicherheit - Teil 1: Einführung und allgemeines Modell
(ISO/IEC 15408-1:2022)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères
d'évaluation pour la sécurité des technologies de l'information - Partie 1: Introduction et
modèle général (ISO/IEC 15408-1:2022)
Ta slovenski standard je istoveten z: EN ISO/IEC 15408-1:2023
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN ISO/IEC 15408-1
NORME EUROPÉENNE
EUROPÄISCHE NORM
December 2023
ICS 35.030
Supersedes EN ISO/IEC 15408-1:2020
English version
Information security, cybersecurity and privacy protection
- Evaluation criteria for IT security - Part 1: Introduction
and general model (ISO/IEC 15408-1:2022)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Critères d'évaluation pour la sécurité der Privatsphäre - Evaluationskriterien für IT-
des technologies de l'information - Partie 1: Sicherheit - Teil 1: Einführung und allgemeines Modell
Introduction et modèle général (ISO/IEC 15408- (ISO/IEC 15408-1:2022)
1:2022)
This European Standard was approved by CEN on 20 November 2023.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2023 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN ISO/IEC 15408-1:2023 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3
European foreword
The text of ISO/IEC 15408-1:2022 has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology” of the International Organization for Standardization (ISO) and has been
taken over as EN ISO/IEC 15408-1:2023 by Technical Committee CEN-CENELEC/ JTC 13 “Cybersecurity
and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by June 2024, and conflicting national standards shall be
withdrawn at the latest by June 2024.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 15408-1:2020.
Any feedback and questions on this document should be directed to the users’ national standards body.
A complete listing of these bodies can be found on the CEN and CENELEC websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 15408-1:2022 has been approved by CEN-CENELEC as EN ISO/IEC 15408-1:2023
without any modification.
INTERNATIONAL ISO/IEC
STANDARD 15408-1
Fourth edition
2022-08
Information security, cybersecurity
and privacy protection — Evaluation
criteria for IT security —
Part 1:
Introduction and general model
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies de
l'information —
Partie 1: Introduction et modèle général
Reference number
ISO/IEC 15408-1:2022(E)
© ISO/IEC 2022
ISO/IEC 15408-1:2022(E)
© ISO/IEC 2022
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Contents Page
Foreword . vi
Introduction .viii
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms .13
5 Overview .15
5.1 General . 15
5.2 ISO/IEC 15408 series description . 15
5.2.1 General .15
5.2.2 Audience . . 16
5.3 Target of evaluation (TOE) . 19
5.3.1 General . 19
5.3.2 TOE boundaries . 19
5.3.3 Different representations of the TOE . 20
5.3.4 Different configurations of the TOE . 20
5.3.5 Operational environment of the TOE . 20
5.4 Presentation of material in this document . 21
6 General model .21
6.1 Background . 21
6.2 Assets and security controls . 21
6.3 Core constructs of the paradigm of the ISO/IEC 15408 series . 24
6.3.1 General . 24
6.3.2 Conformance types . 24
6.3.3 Communicating security requirements. 24
6.3.4 Meeting the needs of consumers (risk owners) . 27
7 Specifying security requirements .29
7.1 Security problem definition (SPD) .29
7.1.1 General .29
7.1.2 Threats .29
7.1.3 Organizational security policies (OSPs) .30
7.1.4 Assumptions . 30
7.2 Security objectives . 31
7.2.1 General . 31
7.2.2 Security objectives for the TOE . 31
7.2.3 Security objectives for the operational environment . 31
7.2.4 Relation between security objectives and the SPD . 32
7.2.5 Tracing between security objectives and the SPD . 32
7.2.6 Providing a justification for the tracing . 33
7.2.7 On countering threats.33
7.2.8 Security objectives: conclusion . 33
7.3 Security requirements . . 33
7.3.1 General . 33
7.3.2 Security Functional Requirements (SFRs) .34
7.3.3 Security assurance requirements (SARs) .36
7.3.4 Security requirements: conclusion . 37
8 Security components .38
8.1 Hierarchical structure of security components .38
8.1.1 General .38
8.1.2 Class .38
8.1.3 Family .39
iii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
8.1.4 Component . 39
8.1.5 Element . 39
8.2 Operations . 39
8.2.1 General .39
8.2.2 Iteration .40
8.2.3 Assignment .40
8.2.4 Selection . 41
8.2.5 Refinement . . 43
8.3 Dependencies between components .44
8.4 Extended components.44
8.4.1 General .44
8.4.2 Defining extended components . 45
9 Packages .45
9.1 General . 45
9.2 Package types .46
9.2.1 General .46
9.2.2 Assurance packages .46
9.2.3 Functional packages . 47
9.3 Package dependencies . 47
9.4 Evaluation method(s) and activities. 47
10 Protection Profiles (PPs) .48
10.1 General .48
10.2 PP introduction .48
10.3 Conformance claims and conformance statements.48
10.4 Security assurance requirements (SARs) . 51
10.5 Additional requirements common to strict and demonstrable conformance . 51
10.5.1 Conformance claims and conformance statements . 51
10.5.2 Security problem definition (SPD) . 51
10.5.3 Security objectives . 52
10.6 Additional requirements specific to strict conformance . 52
10.6.1 Requirements for the security problem definition (SPD) . 52
10.6.2 Requirements for the security objectives . 52
10.6.3 Requirements for the security requirements . . 52
10.7 Additional requirements specific to demonstrable conformance .53
10.8 Additional requirements specific to exact conformance . 53
10.8.1 General .53
10.8.2 Conformance claims and statements . 53
10.9 Using PPs .54
10.10 Conformance statements and claims in the case of multiple PPs .54
10.10.1 General .54
10.10.2 Where strict or demonstrable conformance is specified .54
10.10.3 Where exact conformance is specified .54
11 Modular requirements construction .54
11.1 General .54
11.2 PP-Modules. 55
11.2.1 General . 55
11.2.2 PP-Module Base .55
11.2.3 Requirements for PP-Modules . 55
11.3 PP-Configurations . . 59
11.3.1 General . 59
11.3.2 Requirements for PP-Configurations . 59
11.3.3 Usage of PP-Configurations .65
12 Security Targets (STs) .68
12.1 General .68
12.2 Conformance claims and statements .68
12.3 Assurance requirements . 71
iv
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
12.4 Additional requirements in the exact conformance case . 71
12.4.1 Additional requirements for the conformance claim . 71
12.4.2 Additional requirements for the SPD . 71
12.4.3 Additional requirements for the security objectives.72
12.4.4 Additional requirements for the security requirements .72
12.5 Additional requirements in the multi-assurance case .72
13 Evaluation and evaluation results .74
13.1 General .74
13.2 Evaluation context . 76
13.3 Evaluation of PPs and PP-Configurations .77
13.4 Evaluation of STs .77
13.5 Evaluation of TOEs .77
13.6 Evaluation methods and evaluation activities . 78
13.7 Evaluation results . 78
13.7.1 Results of a PP evaluation . 78
13.7.2 Results of a PP-Configuration evaluation . 78
13.7.3 Results of a ST/TOE evaluation . 78
13.8 Multi-assurance evaluation .79
14 Composition of assurance .80
14.1 General .80
14.2 Composition models .81
14.2.1 Layered composition model . 81
14.2.2 Network or bi-directional composition model .82
14.2.3 Embedded composition model .82
14.3 Evaluation techniques for providing assurance in composition models .83
14.3.1 General .83
14.3.2 ACO class for composed TOEs .83
14.3.3 Composite evaluation for composite products .84
14.4 Requirements for evaluations using composition techniques . 95
14.4.1 Re-use of evaluation results . 95
14.4.2 Composition evaluation issues .96
14.5 Evaluation by composition and multi-assurance.97
Annex A (normative) Specification of packages .98
Annex B (normative) Specification of Protection Profiles (PPs) . 102
Annex C (normative) Specification of PP-Modules and PP-Configurations . 112
Annex D (normative) Specification of Security Targets (STs) and Direct Rationale STs . 125
Annex E (normative) PP/PP-Configuration conformance . 136
Bibliography .141
v
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria
needed for the different types of document should be noted. This document was drafted in
accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or
www.iec.ch/members_experts/refdocs).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC
list of patent declarations received (see https://patents.iec.ch).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see
www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection.
This fourth edition cancels and replaces the third edition (ISO/IEC 15408-1:2009), which has been
technically revised.
The main changes are as follows:
— the document has been restructured;
— technical changes have been introduced:
— the terminology has been reviewed and updated;
— the exact conformance type has been introduced;
— low assurance protection profiles (PPs) have been removed and direct rationale PPs have been
introduced;
— PP-Modules and PP-Configurations for modular evaluations have been introduced;
— multi-assurance evaluation has been introduced.
A list of all parts in the ISO/IEC 15408 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
vi
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Legal notice
The governmental organizations listed below contributed to the development of this version of the
Common Criteria for Information Technology Security Evaluations. As the joint holders of the copyright
in the Common Criteria for Information Technology Security Evaluations (called CC), they hereby
grant non-exclusive license to ISO/IEC to use CC in the continued development/maintenance of the
ISO/IEC 15408 series of standards. However, these governmental organizations retain the right to use,
copy, distribute, translate or modify CC as they see fit.
Australia The Australian Signals Directorate
Canada Communications Security Establishment
France Agence Nationale de la Sécurité des Systèmes d'Information
Germany Bundesamt für Sicherheit in der Informationstechnik
Japan Information-technology Promotion Agency
Netherlands Netherlands National Communications Security Agency
New Zealand Government Communications Security Bureau
Republic of Korea National Security Research Institute
Spain Ministerio de Asuntos Económicos y Transformación Digital
Sweden FMV, Swedish Defence Materiel Administration
United Kingdom National Cyber Security Centre
United States The National Security Agency
vii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
Introduction
The ISO/IEC 15408 series permits comparability between the results of independent security
evaluations by providing a common set of requirements for the security functionality of IT products and
for assurance measures applied to these IT products during a security evaluation. These IT products
may be implemented in hardware, firmware, or software.
The evaluation process establishes a level of confidence that the security functionality of these IT
products and the assurance measures applied to these IT products meet these requirements. The
evaluation results may help consumers to determine whether these IT products fulfil their security
needs.
The ISO/IEC 15408 series is useful as a guide for the development, evaluation and/or procurement of IT
products with security functionality.
The ISO/IEC 15408 series is intentionally flexible, enabling a range of evaluation approaches to be
applied to a range of security properties of a range of IT products. Therefore, users of the standard are
cautioned to exercise care that this flexibility is not misused. For example, using the ISO/IEC 15408
series in conjunction with unsuitable evaluation methods/activities, irrelevant security properties, or
inappropriate IT products, can result in meaningless evaluation results.
Consequently, the fact that an IT product has been evaluated has meaning only in the context of the
security properties that were evaluated and the evaluation methods that were used. Evaluation
authorities are advised to carefully check the products, properties, and methods to determine that an
evaluation provides meaningful results. Additionally, purchasers of evaluated products are advised to
carefully consider this context to determine whether the evaluated product is useful and applicable to
their specific situation and needs.
The ISO/IEC 15408 series addresses the protection of assets from unauthorized disclosure, modification,
or loss of use. The categories of protection relating to these three types of failure of security are
commonly called confidentiality, integrity, and availability, respectively. The ISO/IEC 15408 series may
also be applicable to aspects of IT security outside of these three categories. The ISO/IEC 15408 series
is applicable to risks arising from human activities (malicious or otherwise) and to risks arising from
non-human activities. The ISO/IEC 15408 series may be applied in other areas of IT but makes no claim
of applicability in these areas.
Certain topics, because they involve specialized techniques or because they are somewhat peripheral
to IT security, are considered to be outside the scope of the ISO/IEC 15408 series. Some of these are
identified below:
a) the ISO/IEC 15408 series does not contain security evaluation criteria pertaining to administrative
security measures not related directly to the IT security functionality. However, it is recognized
that significant security can often be achieved through or supported by administrative measures
such as organizational, personnel, physical, and procedural controls;
b) the ISO/IEC 15408 series does not address the evaluation methodology under which the criteria
should be applied;
NOTE 1 The baseline methodology is defined in ISO/IEC 18045. ISO/IEC 15408-4 can be used to further
derive evaluation activities and methods from ISO/IEC 18045.
c) the ISO/IEC 15408 series does not address the administrative and legal framework under which the
criteria may be applied by evaluation authorities. However, it is expected that the ISO/IEC 15408
series is intended to be used for evaluation purposes in the context of such a framework;
d) the procedures for use of evaluation results in accreditation are outside the scope of the
ISO/IEC 15408 series. Accreditation is the administrative process whereby authority is granted for
the operation of an IT product (or collection thereof) in its full operational environment including
all of its non-IT parts. The results of the evaluation process are an input to the accreditation process.
However, as other techniques are more appropriate for the assessments of non-IT related properties
viii
© ISO/IEC 2022 – All rights reserved
ISO/IEC 15408-1:2022(E)
and their relationship to the IT security parts, accreditors must make separate provisions for those
aspects;
e) the subject of criteria for the assessment of the inherent qualities of cryptographic algorithms is
not covered in the ISO/IEC 15408 series. In the case that independent assessment of mathematical
properties of cryptography is required, the evaluation scheme under which the ISO/IEC 15408
series is applied shall make provision for such assessments.
NOTE 2 This document uses bold and italic type in some cases to distinguish terms from the rest of the text.
The relationship between components within a family is highlighted using a bolding convention. This convention
calls for the use of bold type for all new requirements. For hierarchical components, requirements are presented
in bold type when they are enhanced or modified beyond the requirements of the previous component. In
addition, any new or enhanced permitted operations beyond the previous component are also highlighted using
bold type.
The use of italics indicates text that has a precise meaning. For security assurance requirements the convention
is for special verbs relating to evaluation.
ix
© ISO/IEC 2022 – All rights reserved
INTERNATIONAL STANDARD ISO/IEC 15408-1:2022(E)
Information security, cybersecurity and privacy
protection — Evaluation criteria for IT security —
Part 1:
Introduction and general model
1 Scope
This document establishes the general concepts and principles of IT security evaluation and specifies
the general model of evaluation given by various parts of the standard which in its entirety is meant to
be used as the basis for evaluation of security properties of IT products.
This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various
parts of the ISO/IEC 15408 series; defines the terms and abbreviations to be used in all parts of the
standard; establishes the core concept of a Target of Evaluation (TOE); describes the evaluation context
and describes the audience to which the evaluation criteria is addressed. An introduction to the basic
security concepts necessary for evaluation of IT products is given.
This document introduces:
— the key concepts of Protection Profiles (PP), PP-Modules, PP-Configurations, packages, Security
Targets (ST), and conformance types;
— a description of the organization of security components throughout the model;
— the various operations by which the functional and assurance components given in ISO/IEC 15408-2
and ISO/IEC 15408-3 can be tailored through the use of permitted operations;
— general information abo
...
Le document SIST EN ISO/IEC 15408-1:2024 s'avère être une référence essentielle dans le domaine de la sécurité de l'information, de la cybersécurité et de la protection de la vie privée. Ce standard établit des concepts généraux et des principes de l’évaluation de la sécurité informatique, fournissant ainsi un cadre solide pour l'évaluation des propriétés de sécurité des produits informatiques. L'étendue du standard comprend une vue d'ensemble complète de toutes les parties de la série ISO/IEC 15408, garantissant que les utilisateurs aient accès à des définitions claires des termes et abréviations utilisés dans l'ensemble du standard. L'introduction du concept de "Target of Evaluation" (TOE) est particulièrement pertinente, car elle permet de structurer l'évaluation de manière cohérente et compréhensible. Parmi les forces du document, on note l'introduction des concepts clés tels que les Profils de Protection (PP), les Modules PP, les Configurations PP et les Cibles de Sécurité (ST). Cela renforce la pertinence du standard dans l'élaboration de plans d'évaluation adaptés aux besoins d'évaluation spécifiques, favorisant ainsi une meilleure compréhension et application des critères d'évaluation. De plus, la description de l'organisation des composants de sécurité au sein du modèle permet une meilleure clarté et une application plus efficace des méthodes d'évaluation, telles que celles décrites dans ISO/IEC 18045. La façon dont les composants fonctionnels et d'assurance peuvent être adaptés grâce à des opérations permises souligne la flexibilité et l'adaptabilité fournies par le standard, répondant aux divers besoins des professionnels de la sécurité. La mention des Niveaux d'Assurance d'Évaluation (EALs) pré-définis et des informations concernant la portée des schémas d'évaluation sont également des ajouts précieux qui apportent une structure et une assurance quant à la qualité des évaluations menées. En somme, le SIST EN ISO/IEC 15408-1:2024 se positionne comme un pilier fondamental pour toute organisation cherchant à établir des normes élevées de sécurité informatique et à naviguer dans le paysage complexe de la cybersécurité et de la protection des données.
The SIST EN ISO/IEC 15408-1:2024 standard is a pivotal document in the realm of information security, cybersecurity, and privacy protection. Its scope encompasses the foundational concepts and principles of IT security evaluation, providing a comprehensive overview that is critical for stakeholders involved in the assessment of IT product security properties. One of the strengths of this standard is its clarity in defining essential terminology and concepts, such as the Target of Evaluation (TOE), Protection Profiles (PP), and Security Targets (ST). By establishing a clear vocabulary, it ensures consistency across different parts of the ISO/IEC 15408 series, which enhances the effectiveness of the evaluation criteria for IT security. This clarity is vital for both evaluators and developers, facilitating a common understanding that is essential for accurate assessments. Moreover, the document organizes the security components effectively, outlining how functional and assurance components can be tailored through various operations. This flexibility is crucial for adapting the evaluation processes to meet specific requirements of different products while maintaining the rigor of security assessments. The standard also introduces the concept of Evaluation Assurance Levels (EALs) and provides general information about evaluation methods outlined in ISO/IEC 18045, which adds depth to the evaluation criteria. By including guidance for applying ISO/IEC 15408-4 to develop tailored evaluation methods and activities, the document supports practitioners in ensuring that their evaluation approaches are both robust and applicable. Additionally, the inclusion of information regarding the scope of evaluation schemes is significant, as it helps define the boundaries within which evaluations can occur. This is particularly relevant for organizations looking to align their security assessments with recognized standards, thereby boosting confidence among stakeholders. Overall, the SIST EN ISO/IEC 15408-1:2024 standard is a foundational piece that significantly contributes to the standardization of IT security evaluations. Its comprehensive nature, clarity in terminology, and detailed approach to security component organization and evaluation methodologies make it a valuable asset for practitioners in the field of information security and cybersecurity.
SIST EN ISO/IEC 15408-1:2024は情報セキュリティ、サイバーセキュリティ、プライバシー保護におけるITセキュリティ評価のための基礎文書であり、評価基準とその一般的なモデルを提供しています。この標準の主な強みは、IT製品のセキュリティ特性を評価するための統一された枠組みを確立している点です。 この文書は、ISO/IEC 15408シリーズの全体的な概念を包括的に紹介し、セキュリティ評価に必要不可欠な基本的なセキュリティ概念を説明しています。特に、「評価対象（TOE）」のコアコンセプトを定義し、評価文脈を明確にすることにより、さまざまな利害関係者に対して適切な評価基準を提供しています。 また、保護プロファイル（PP）、PPモジュール、PP構成などの重要な概念を導入し、ISO/IEC 15408シリーズ内でのセキュリティコンポーネントの組織を詳細に説明しています。これにより、評価方法と信頼性コンポーネントの調整が可能になり、ISO/IEC 15408-2およびISO/IEC 15408-3における機能と保証に関するコンポーネントがどのように適用されるかが示されています。 さらに、ISO/IEC 18045に基づく評価方法に関する一般的な情報や、ISO/IEC 15408-4を適用しての評価方法（EM）及び評価活動（EA）の開発に関するガイダンスも含まれています。このように、評価保証レベル（EAL）についての予め定義された情報も提供され、評価スキームの範囲に関する情報も含まれています。 SIST EN ISO/IEC 15408-1:2024は、情報セキュリティの評価における基礎的な指針を確立し、IT製品のセキュリティを高めるための有効な手段を提供しているため、現代のサイバーセキュリティの要求に対して非常に関連性の高い標準といえます。
SIST EN ISO/IEC 15408-1:2024 문서는 IT 보안 평가에 대한 일반 개념과 원칙을 정립하고 있으며, 다양한 표준 부분에서 제공되는 평가의 일반 모델을 명시합니다. 이 표준은 IT 제품의 보안 특성 평가를 위한 기초로 사용되도록 설계되었습니다. 이 문서는 ISO/IEC 15408 시리즈의 모든 부분에 대한 개요를 제공하며, 모든 표준 부분에서 사용될 용어와 약어를 정의합니다. 핵심 개념으로 손꼽히는 평가 대상(Target of Evaluation, TOE)의 정의와 평가 맥락을 설명하고, 평가 기준이 대상하는 청중에 대해 구체적으로 다루고 있습니다. IT 제품 평가에 필요한 기본 보안 개념을 소개하여 사용자가 이해할 수 있도록 돕습니다. 또한 이 문서는 다음과 같은 주요 개념을 소개합니다: - 보호 프로파일(Protection Profiles, PP), PP 모듈, PP 구성, 패키지, 보안 목표(Security Targets, ST) 및 적합성 유형이다. - 모델 전반에 걸쳐 보안 구성 요소의 구성에 대한 설명. - ISO/IEC 15408-2 및 ISO/IEC 15408-3에서 제공하는 기능 및 보증 구성 요소가 허용된 운영 방식을 통해 조정될 수 있는 다양한 작업. - ISO/IEC 18045에서 제공하는 평가 방법에 대한 일반 정보. - ISO/IEC 15408-4의 적용 지침으로, ISO/IEC 18045에서 파생된 평가 방법(EM) 및 평가 활동(EA)을 개발하기 위한 안내. - ISO/IEC 15408-5에서 정의된 미리 정의된 평가 보증 수준(EAL)에 관한 일반 정보. - 평가 제도에 대한 범위 정보. 이 문서는 IT 보안, 사이버 보안 및 개인정보 보호의 평가 기준을 제공하는 데 있어 핵심적인 역할을 하며, 보안 평가의 기초를 닦는 중요한 표준으로 자리잡고 있습니다. 따라서 IT 제품의 보안 특성을 평가하고자 하는 조직이나 전문가들에게 필수적인 자료입니다.
SIST EN ISO/IEC 15408-1:2024 표준 문서는 IT 보안 평가를 위한 일반 개념 및 원칙을 수립하며, 다양한 부분에서 제공하는 평가의 일반 모델을 명시합니다. 이 표준은 IT 제품의 보안 속성을 평가하는 기본으로 사용되며, 인포메이션 보안, 사이버 보안 및 프라이버시 보호와 관련된 핵심 요소를 포괄적으로 다루고 있습니다. 이 문서는 ISO/IEC 15408 시리즈의 모든 부분에 대한 개요를 제공하며, 모든 부분에서 사용될 용어 및 약어를 정의합니다. 특히, 평가 대상(Target of Evaluation, TOE)의 핵심 개념을 확립하고 평가 맥락을 설명합니다. 또한, 이 문서는 평가 기준이 대상하는 청중에 대해서도 상세히 설명하고 있어 독자의 이해를 돕습니다. 문서에서 소개되는 주요 개념으로는 보호 프로필(Protection Profiles, PP), PP 모듈, PP 구성, 패키지, 보안 목표(Security Targets, ST) 및 적합성 유형이 포함됩니다. 보안 구성 요소의 조직 구조를 설명하며, ISO/IEC 15408-2 및 ISO/IEC 15408-3에서 제공하는 기능 및 보증 구성 요소를 허용된 작업을 통해 조정하는 다양한 작업을 다룹니다. 또한, ISO/IEC 18045에서 제공하는 평가 방법에 대한 일반 정보와 ISO/IEC 15408-4를 적용하여 ISO/IEC 18045에서 파생된 평가 방법(EM) 및 평가 활동(EA)을 개발하기 위한 지침이 포함되어 있습니다. ISO/IEC 15408-5에서 정의된 사전 정의된 평가 보증 수준(EALs)에 대한 일반 정보도 제공하며, 평가 체계의 범위에 대한 정보도 담고 있습니다. 이 표준은 IT 보안 제품에 대한 평가를 위한 기초적인 자료를 제공함으로써, 사이버 보안 및 개인정보 보호 분야의 발전에 기여할 수 있는 중요한 역할을 합니다.
The SIST EN ISO/IEC 15408-1:2024 standard serves as a foundational document for the evaluation of IT security, establishing critical concepts and principles for effective assessment. Its scope is comprehensive, encompassing the introduction of a general model for IT security evaluation through the ISO/IEC 15408 series, which is essential for validating the security properties of IT products. One of the notable strengths of this standard is its detailed exploration of key concepts, including Protection Profiles (PP), Security Targets (ST), and the various conformance types, which are vital for understanding the classification and evaluation of security mechanisms. The clear delineation of terms and abbreviations ensures a standardized approach to communication among stakeholders, enhancing the clarity and efficacy of discussions related to IT security evaluations. Additionally, the standard offers a well-structured framework for evaluating security components, outlining operations that can tailor functional and assurance components. This flexibility allows organizations to adapt evaluation methods to fit specific contexts while ensuring compliance with the overarching objectives of IT security. The inclusion of guidance for the application of ISO/IEC 15408-4 in developing Evaluation Methods (EM) and Evaluation Activities (EA) derived from ISO/IEC 18045 further underscores the practical relevance of this standard in real-world applications. The reference to predefined Evaluation Assurance Levels (EALs) and the detailed information regarding evaluation schemes expand the applicability of this standard across various sectors, making it an indispensable resource for organizations seeking to implement robust cybersecurity measures. Overall, the SIST EN ISO/IEC 15408-1:2024 standard effectively lays the groundwork for a cohesive evaluation framework, promoting consistency and transparency in the assessment of IT security. Its comprehensive scope, clarity of concepts, and practical guidance position it as a critical document for professionals in the fields of information security, cybersecurity, and privacy protection.
Die SIST EN ISO/IEC 15408-1:2024 ist ein essentielles Dokument im Bereich der Informationssicherheit, Cybersecurity und Datenschutz. Es legt die grundlegenden Konzepte und Prinzipien der IT-Sicherheitsbewertung fest und stellt ein allgemeines Bewertungsmodell vor. Dieses Modell bildet die Basis für die Bewertung von Sicherheitsmerkmalen von IT-Produkten, was besonders wichtig ist, um eine umfassende Evaluierungssicherheit zu gewährleisten. Eine der größten Stärken dieses Standards ist die detaillierte Übersicht über alle Teile der ISO/IEC 15408-Serie, die es den Anwendern ermöglicht, die Struktur und den Kontext der Bewertungskriterien besser zu verstehen. Durch die Definition zentraler Begriffe wie Target of Evaluation (TOE) und die Beschreibung der Bewertungsumgebung wird den Nutzern ein klarer Rahmen zur Verfügung gestellt, der das Verständnis und die Anwendung der Evaluierungskriterien fördert. Darüber hinaus bietet das Dokument wertvolle Informationen zu den Schutzprofilen (PP), sowie zu den verschiedenen Operationen, die es ermöglichen, funktionale und sicherheitsrelevante Komponenten gemäß den Teilen ISO/IEC 15408-2 und ISO/IEC 15408-3 anzupassen. Die festgelegten Bewertungsmethoden, die in ISO/IEC 18045 behandelt werden, und die Richtlinien zur Anwendung von ISO/IEC 15408-4 zur Entwicklung von Evaluierungsmethoden (EM) und Evaluierungsaktivitäten (EA) ergänzen die Anwendbarkeit des Standards. Die Beschreibung der vordefinierten Evaluation Assurance Levels (EALs) in ISO/IEC 15408-5 sowie die Informationen zu den Bewertungsprogrammen tragen zur Klarheit und Verständlichkeit des gesamten Evaluierungsprozesses bei. Die umfassende Natur und die Relevanz dieses Dokuments machen es zu einem unverzichtbaren Leitfaden für Fachleute, die im Bereich IT-Sicherheit tätig sind. Es stellt sicher, dass Sicherheitsbewertungen nicht nur konsistent, sondern auch von höchster Qualität sind, was in der heutigen digitalen Welt von entscheidender Bedeutung ist.
Die SIST EN ISO/IEC 15408-1:2024 ist ein grundlegendes Dokument, das die allgemeinen Konzepte und Prinzipien der IT-Sicherheitsevaluation festlegt und ein allgemeines Evaluierungsmodell für die Sicherheitsmerkmale von IT-Produkten bietet. Der Umfang dieser Norm ist von großer Bedeutung, da sie als Basis für die Bewertung der Sicherheitsanforderungen und Eigenschaften von IT-Produkten dient. Die Stärken dieser Norm liegen in ihrer umfassenden Übersicht über alle Teile der ISO/IEC 15408-Serie. Sie definiert wichtige Begriffe und Abkürzungen, die in allen Teilen der Norm verwendet werden, und etabliert das zentrale Konzept des Target of Evaluation (TOE). Darüber hinaus beschreibt sie den Evaluierungskontext und die Zielgruppe, an die sich die Evaluierungskriterien richten. Dies sorgt für Klarheit und ein besseres Verständnis der Norm, was für Fachleute im Bereich IT-Sicherheit von entscheidender Bedeutung ist. Ein weiterer wesentlicher Aspekt sind die Schlüsselkonzepte wie Protection Profiles (PP), PP-Module, PP-Konfigurationen, Security Targets (ST) und Konformitätstypen, die detailliert beschrieben werden. Diese Grundlagen sind essenziell für die Entwicklung und Umsetzung effektiver Sicherheitsstrategien. Zudem gibt das Dokument wertvolle Informationen zu den Evaluierungsmethoden, die in ISO/IEC 18045 definiert sind, und bietet Leitlinien zur Anwendung von ISO/IEC 15408-4, um Evaluierungsmethoden (EM) und Evaluierungsaktivitäten (EA) zu entwickeln. Die Norm behandelt auch die vorkonfigurierten Evaluation Assurance Levels (EALs) und informiert über die Anwendungsbereiche der Evaluierungsschemata, was die Relevanz der Norm weiter unterstreicht. Insgesamt stellt die SIST EN ISO/IEC 15408-1:2024 ein unverzichtbares Fundament für die Evaluierung der IT-Sicherheitsprodukte dar und trägt entscheidend zur Verbesserung der Informationssicherheit, Cybersicherheit und des Datenschutzes bei.
SIST EN ISO/IEC 15408-1:2024は、ITセキュリティ評価の一般的な概念と原則を確立し、標準の各部分によって提供される評価の一般モデルを特定する重要な文書です。この標準は、IT製品のセキュリティ特性の評価を行うための基盤として利用されることを目指しています。 この文書は、ISO/IEC 15408シリーズ全体の概要を提供し、標準のすべての部分で使用される用語や略語の定義を行っています。また、評価対象(Term of Evaluation, TOE)というコアコンセプトの確立により、評価のコンテキストを明確にし、評価基準が対象とする聴衆を示しています。IT製品の評価に必要な基本的なセキュリティ概念を導入することにより、利用者に対して非常に有用な情報を提供しています。 具体的には、次の重要な概念を紹介しています： - 保護プロファイル(Protection Profiles, PP)、PPモジュール、PP構成、パッケージ、セキュリティターゲット(Security Targets, ST)、ならびに適合性の種類の定義。 - モデル全体にわたるセキュリティコンポーネントの組織に関する詳しい説明。 - ISO/IEC 15408-2及びISO/IEC 15408-3で示された機能的および保証コンポーネントを許可された操作を通じて調整するための様々な操作。 - ISO/IEC 18045で規定されている評価方法に関する一般情報。 - ISO/IEC 15408-4の適用に関する指針を提供し、ISO/IEC 18045に基づいて評価方法(EM)や評価活動(EA)の開発を支援します。 - ISO/IEC 15408-5で定義された事前定義された評価保証レベル(EALs)に関する一般情報。 - 評価スキームの範囲に関する情報。 この標準は、IT セキュリティにおけるサイバーセキュリティやプライバシー保護の観点から、評価基準の理解を深めるための基盤を提供するものであり、その内容は現代の情報社会において非常に重要です。セキュリティ評価を行う際の指針として使用されることで、ISO/IEC 15408シリーズの他の部分との整合性を持たせつつ、IT製品の安全性を確保することに寄与しています。
Le document SIST EN ISO/IEC 15408-1:2024 constitue une ressource essentielle dans le domaine de la sécurité des informations, de la cybersécurité et de la protection de la vie privée. En tant qu'introduction et modèle général, ce standard définit des concepts fondamentaux et des principes d'évaluation de la sécurité des technologies de l'information (IT), posant ainsi les bases pour l'évaluation des propriétés de sécurité des produits informatiques. L'un des points forts de cette norme est son étendue ; elle offre un aperçu complet des différentes parties de la série ISO/IEC 15408, ce qui permet une compréhension approfondie des critères d'évaluation de la sécurité. Elle explicite des termes et abréviations clé qui seront utilisés dans toutes les parties de la norme, garantissant ainsi une cohérence et une clarté dans l'application des critères d'évaluation. La norme introduit des concepts essentiels tels que les Profils de Protection (PP), les modules PP, les cibles de sécurité (ST) et les niveaux d'assurance d'évaluation (EAL), et décrit l'organisation des composants de sécurité tout au long du modèle. Ces éléments sont cruciaux pour le développement de produits IT sécurisés et facilitent l'utilisation des méthodes d'évaluation définies dans ISO/IEC 18045. En outre, le document fournit des orientations précieuses pour la mise en œuvre de la norme ISO/IEC 15408-4, qui aide au développement des méthodes d'évaluation (EM) et des activités d'évaluation (EA). Cela renforce la pertinence de le standard dans le cadre de l'évaluation systématique et fiable des produits informatiques. La clarté des informations sur les niveaux d'assurance d'évaluation pré-définis (EALs) et la portée des schémas d'évaluation ajoute à la valeur du document en permettant aux professionnels de mieux comprendre les exigences nécessaires pour atteindre des niveaux de sécurité appropriés. En somme, le SIST EN ISO/IEC 15408-1:2024 est un standard fondamental pour toute organisation impliquée dans l’évaluation de la sécurité des technologies de l'information. Sa structure détaillée et ses explications claires en font un outil incontournable pour les professionnels du secteur.
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.
Loading comments...