EN ISO/IEC 15408-2:2026
(Main)Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components (ISO/IEC 15408-2:2026)
- Abstract
This document specifies requirements for the required structure and content of security functional components for use during a security evaluation. It includes a catalogue of functional components that meet the common security functionality requirements of many IT products.
- Status
- Published
- Publication Date
- 26-May-2026
- Technical Committee
- CEN/CLC/TC 13 - Cybersecurity and Data Protection
- Current Stage
- 6060 - Definitive text made available (DAV) - Publishing
- Start Date
- 27-May-2026
- Completion Date
- 27-May-2026
EN ISO/IEC 15408-2:2026 is a CEN European Standard for information security, cybersecurity and privacy protection. It specifies the structure and content of security functional components used to define security functional requirements (SFRs) during an IT security evaluation, and it is written for authors of Protection Profiles (PPs), PP-Modules, functional packages and Security Targets (STs), as well as evaluators.
It is the European adoption of ISO/IEC 15408-2:2026 and provides a catalogue of functional components that cover common security functionality needed by many IT products.
What does EN ISO/IEC 15408-2:2026 specify?
EN ISO/IEC 15408-2:2026 specifies the required structure and content of security functional components for use in security evaluation. Its role is to give a common catalogue of security functions that can be selected and combined when describing the security behaviour of a target of evaluation (TOE).
The document is organized as a short front matter, then clauses on scope, normative references, terms and definitions, the functional-requirements paradigm, the component structure, and a long catalogue of classes and families. The catalogue runs from class FAU (Security audit) through class FTP (Trusted path/channels).
The main classes covered are:
- FAU - Security audit
- FCO - Communication
- FCS - Cryptographic support
- FDP - User data protection
- FIA - Identification and authentication
- FMT - Security management
- FPR - Privacy
- FPT - Protection of the TSF
- FRU - Resource utilization
- FTA - TOE access
- FTP - Trusted path/channels
This organization matters in practice because PP, PP-Module and ST authors use it to choose the right functional components instead of inventing their own wording from scratch.
What are the key requirements of EN ISO/IEC 15408-2:2026?
EN ISO/IEC 15408-2:2026 is a catalogue standard, so its key requirement is not a product test method but a controlled way to express security functional requirements. Clause 6 explains the model: SFRs govern how the TOE controls access to and use of its resources, and the TSF is the part of the TOE relied on to enforce them.
Clause 6 also distinguishes the main data and communication paths that matter for security design. It separates user data from TSF data, and it distinguishes internal TOE transfer, inter-TSF transfer, transfer outside of the TOE, trusted channel, and trusted path. In practice, this tells the reader what is being protected, who communicates with whom, and whether the other side is trusted.
Clause 7 sets the structure used throughout the document. A class contains families, a family contains components, and a component contains elements. For package or ST building, the document says the full set of elements of a component is selected as a whole, which matters because users cannot pick only one element from a component and still claim that component.
Several classes carry the most common security requirements used in IT evaluations:
- FAU (Security audit) covers audit data generation, review, selection, storage, and responses to potential violations. This helps define what must be logged, who can review logs, and how audit data is protected.
- FCS (Cryptographic support) covers cryptographic key management, cryptographic operation, random bit generation, and random number generation. This is the class to use when the TOE implements cryptographic functions in hardware, firmware or software.
- FDP (User data protection) covers access control, information flow control, import/export, internal transfer, residual information protection, rollback, stored data confidentiality, stored data integrity, and inter-TSF user data transfer protection. In practice, this is where authors define how user data is allowed to move, be stored, and be protected.
- FIA (Identification and authentication) covers user identification, user authentication, authentication failure handling, proof of identity, user attributes, and user-subject binding. This is the class for login, identity proofing, and binding rights or roles to users.
- FMT (Security management) covers management of security attributes, TSF data, functions, roles, revocation, and time-limited authorization. This matters when the TOE lets administrators or users change security-relevant settings.
- FPR (Privacy) covers anonymity, pseudonymity, unlinkability and unobservability. This is the class used when the TOE must protect users from identity discovery or misuse.
- FPT (Protection of the TSF) covers protection of TSF data, self-tests, failure handling, trusted acknowledgement, and trusted transfer consistency. This is the main class for keeping the security functions themselves dependable.
- FRU (Resource utilization), FTA (TOE access) and FTP (Trusted path/channels) cover resource quotas, session limits, banners, locking, trusted channels and trusted paths. These are the practical controls that shape availability and secure administration.
Clause 5 explains an important evaluation point: the listed components are not a complete answer to every IT security problem. They are a maintained catalogue of commonly used requirements, and authors can extend beyond it when needed.
What terms does EN ISO/IEC 15408-2:2026 define?
TOE (target of evaluation) - The TOE is the IT product or system being evaluated for security.
TSF (TOE security functionality) - The TSF is the part of the TOE relied on to enforce the security functional requirements.
SFR (security functional requirement) - An SFR is a security rule or behaviour stated for the TOE and enforced by the TSF.
SFP (security function policy) - An SFP is the set of rules describing a specific security behaviour enforced by the TSF.
TSFI (TSF interface) - The TSFI is the set of interfaces, human or programmatic, through which users or other entities interact with TSF-controlled functions.
TSF data - TSF data is information the TSF depends on for enforcing the SFRs, such as security attributes or authentication data.
user data - User data is data meaningful to external entities but not used by the TSF as security-enforcement data.
trusted channel - A trusted channel is a communication means between the TOE and another trusted IT product with necessary confidence.
Who uses EN ISO/IEC 15408-2:2026?
EN ISO/IEC 15408-2:2026 is used by authors of PPs, PP-Modules, functional packages and STs who need a standardized way to state security functions for an IT product. It is also used by security evaluators, because the whole document is built around security evaluation criteria and gives the structure for checking whether the claimed functions are specified properly.
In practice, the standard is relevant for security architects, product security engineers, certification teams, quality managers, and buyers who need to compare security claims in a structured way. It is especially useful for IT products that implement audit, authentication, access control, cryptography, privacy, trusted communication, or management of security attributes.
What changed in EN ISO/IEC 15408-2:2026 from the previous edition?
EN ISO/IEC 15408-2:2026 supersedes EN ISO/IEC 15408-2:2023. The European endorsement notice states that the text of ISO/IEC 15408-2:2026 was approved by CEN-CENELEC without modification.
The Slovenian adoption notice also identifies SIST EN ISO/IEC 15408-2:2024 as the replaced national standard.
Which standards are used with EN ISO/IEC 15408-2:2026?
EN ISO/IEC 15408-2:2026 cites three normative references that provide the surrounding framework:
- ISO/IEC 15408-1:2026 - gives the introduction and general model, including how SFRs are specified, how components are organized, and the structure of PPs, PP-Modules, PP-Configurations and STs.
- ISO/IEC 15408-3:2026 - provides the security assurance components used alongside the functional components.
- ISO/IEC 18045:2026 - gives the requirements and methodology for IT security evaluation.
These references are what make Part 2 usable in an evaluation context rather than as a standalone catalogue.
What does the EN ISO/IEC 15408-2:2026 document contain?
EN ISO/IEC 15408-2:2026 contains the general model for functional requirements, then a clause-by-clause catalogue of functional classes, families and components. The classes include audit, communication, cryptographic support, user data protection, identification and authentication, security management, privacy, protection of the TSF, resource utilization, TOE access, and trusted path/channels.
The body of the document includes family behaviour, component levelling and description, component management, component audit, application notes, evaluator notes where relevant, and component relationships and rationale. It also includes dependency tables and class decomposition figures that help authors see how the pieces fit together.
For many components, the document gives short component titles such as “Audit data generation”, “Security attribute-based access control”, “Cryptographic operation”, “User authentication before any action”, or “Trusted channel establishment”. In practice, these component descriptions are what PP and ST authors select and tailor when writing evaluation claims.
The document also explains how to use operations such as assignment, iteration, refinement and selection within components. That detail matters because it is what turns the catalogue into a precise specification method for security evaluations.
Relations
- Effective Date
- 22-May-2024
- Effective Date
- 12-Feb-2026
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
EN ISO/IEC 15408-2:2026 is a standard published by the European Committee for Standardization (CEN). Its full title is "Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components (ISO/IEC 15408-2:2026)". This standard covers: This document specifies requirements for the required structure and content of security functional components for use during a security evaluation. It includes a catalogue of functional components that meet the common security functionality requirements of many IT products.
This document specifies requirements for the required structure and content of security functional components for use during a security evaluation. It includes a catalogue of functional components that meet the common security functionality requirements of many IT products.
EN ISO/IEC 15408-2:2026 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
EN ISO/IEC 15408-2:2026 has the following relationships with other standards: It is inter standard links to EN ISO/IEC 15408-2:2023, ISO/IEC 15408-2:2026. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
EN ISO/IEC 15408-2:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-oktober-2026
Nadomešča:
SIST EN ISO/IEC 15408-2:2024
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Merila za
vrednotenje varnosti IT - 2. del: Funkcionalne varnostne komponente (ISO/IEC
15408-2:2026)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT
security - Part 2: Security functional components (ISO/IEC 15408-2:2026)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Evaluationskriterien für IT-Sicherheit - Teil 2: Sicherheitsfunktionskomponenten (ISO/IEC
15408-2:2026)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères
d'évaluation pour la sécurité des technologies de l'information - Partie 2: Composants
fonctionnels de sécurité (ISO/IEC 15408-2:2026)
Ta slovenski standard je istoveten z: EN ISO/IEC 15408-2:2026
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN ISO/IEC 15408-2
NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2026
ICS 35.030
Supersedes EN ISO/IEC 15408-2:2023
English version
Information security, cybersecurity and privacy protection
- Evaluation criteria for IT security - Part 2: Security
functional components (ISO/IEC 15408-2:2026)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Critères d'évaluation pour la sécurité der Privatsphäre - Evaluationskriterien für IT-
des technologies de l'information - Partie 2: Sicherheit - Teil 2: Sicherheitsfunktionskomponenten
Composants fonctionnels de sécurité (ISO/IEC 15408- (ISO/IEC 15408-2:2026)
2:2026)
This European Standard was approved by CEN on 1 May 2026.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2026 CEN/CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 15408-2:2026 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3
European foreword
This document (EN ISO/IEC 15408-2:2026) has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology" in collaboration with Technical Committee CEN-CENELEC/ JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by November 2026, and conflicting national standards
shall be withdrawn at the latest by November 2026.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 15408-2:2023.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC
websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 15408-2:2026 has been approved by CEN-CENELEC as EN ISO/IEC 15408-2:2026
without any modification.
International
Standard
ISO/IEC 15408-2
Fifth edition
Information security, cybersecurity
2026-05
and privacy protection —
Evaluation criteria for IT security —
Part 2:
Security functional components
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies
de l'information —
Partie 2: Composants fonctionnels de sécurité
Reference number
ISO/IEC 15408-2:2026(en) © ISO/IEC 2026
ISO/IEC 15408-2:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 15408-2:2026(en)
Contents Page
Foreword . xv
Introduction . xvi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 3
5 Overview . 4
5.1 General .4
5.2 Organization of this document . .4
6 Functional requirements paradigm . . 5
7 Security functional components . 8
7.1 Overview .8
7.2 Functional class structure .8
7.2.1 General .8
7.2.2 Class name .9
7.2.3 Class introduction .9
7.2.4 Class informative notes .9
7.2.5 Functional families .9
7.3 Functional family structure .9
7.3.1 General .9
7.3.2 Family name .10
7.3.3 Family Behaviour .10
7.3.4 Component levelling and description .10
7.3.5 Component management .10
7.3.6 Component audit .11
7.3.7 Family application notes .11
7.3.8 Family evaluator notes.11
7.3.9 Functional components .11
7.4 Functional component structure . 12
7.4.1 General . 12
7.4.2 Component name . 12
7.4.3 Component relationships . 12
7.4.4 Component rationale . 13
7.4.5 Component notes . . 13
7.4.6 Functional elements . 13
7.5 Functional elements. 13
7.6 Component catalogue .14
7.6.1 General .14
7.6.2 Highlighting of component changes . 15
8 Class FAU Security audit .15
8.1 Introduction . 15
8.2 Notes on class FAU .17
8.2.1 General information about audit requirements .17
8.2.2 Audit requirements in a distributed environment .17
8.3 Security audit automatic response (FAU_ARP) .18
8.3.1 Family Behaviour .18
8.3.2 Component levelling and description .18
8.3.3 Component management .18
8.3.4 Component audit .18
8.3.5 Application notes .18
8.3.6 FAU_ARP.1 Security alarms .19
8.4 Security audit data generation (FAU_GEN) .19
© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 15408-2:2026(en)
8.4.1 Family Behaviour .19
8.4.2 Component levelling and description .19
8.4.3 Component management .19
8.4.4 Component audit . 20
8.4.5 Application notes . 20
8.4.6 Evaluator notes .21
8.4.7 FAU_GEN.1 Audit data generation .21
8.4.8 FAU_GEN.2 User identity association . 22
8.5 Security audit analysis (FAU_SAA) . 23
8.5.1 Family Behaviour . 23
8.5.2 Component levelling and description . 23
8.5.3 Component management . 23
8.5.4 Component audit .24
8.5.5 Application notes .24
8.5.6 FAU_SAA.1 Potential violation analysis .24
8.5.7 FAU_SAA.2 Profile based anomaly detection . 25
8.5.8 FAU_SAA.3 Simple attack heuristics . 26
8.5.9 FAU_SAA.4 Complex attack heuristics .27
8.6 Security audit review (FAU_SAR) . 29
8.6.1 Family Behaviour . 29
8.6.2 Component levelling and description . 29
8.6.3 Component management . 29
8.6.4 Component audit . 30
8.6.5 Application notes . 30
8.6.6 FAU_SAR.1 Audit review . 30
8.6.7 FAU_SAR.2 Restricted audit review .31
8.6.8 FAU_SAR.3 Selectable audit review .31
8.7 Security audit event selection (FAU_SEL) .32
8.7.1 Family Behaviour .32
8.7.2 Component levelling and description .32
8.7.3 Component management .32
8.7.4 Component audit .32
8.7.5 Application notes .32
8.7.6 FAU_SEL.1 Selective audit . 33
8.8 Security audit data storage (FAU_STG) . 33
8.8.1 Family Behaviour . 33
8.8.2 Component levelling and description . 33
8.8.3 Component management . 34
8.8.4 Component audit . 35
8.8.5 Application notes . 35
8.8.6 FAU_STG.1 Audit data storage location . 35
8.8.7 FAU_STG.2 Protected audit data storage . 36
8.8.8 FAU_STG.3 Guarantees of audit data availability . 36
8.8.9 FAU_STG.4 Action in case of possible audit data loss .37
8.8.10 FAU_STG.5 Prevention of audit data loss . 38
9 Class FCO Communication .38
9.1 Introduction . 38
9.2 Notes on class FCO . . 39
9.3 Non-repudiation of origin (FCO_NRO) . 39
9.3.1 Family Behaviour . 39
9.3.2 Component levelling and description . 39
9.3.3 Component management . 40
9.3.4 Component audit . 40
9.3.5 Application notes . 40
9.3.6 FCO_NRO.1 Selective proof of origin .41
9.3.7 FCO_NRO.2 Enforced proof of origin .42
9.4 Non-repudiation of receipt (FCO_NRR) .42
9.4.1 Family Behaviour .42
© ISO/IEC 2026 – All rights reserved
iv
ISO/IEC 15408-2:2026(en)
9.4.2 Component levelling and description .43
9.4.3 Component management .43
9.4.4 Component audit .43
9.4.5 Application notes .43
9.4.6 FCO_NRR.1 Selective proof of receipt . 44
9.4.7 FCO_NRR.2 Enforced proof of receipt .45
10 Class FCS Cryptographic support .46
10.1 Introduction . 46
10.2 Notes on class FCS . 48
10.3 Cryptographic key management (FCS_CKM) . 50
10.3.1 Family Behaviour . 50
10.3.2 Component levelling and description . 50
10.3.3 Component management .51
10.3.4 Component audit .51
10.3.5 Application notes .51
10.3.6 Evaluator notes .52
10.3.7 FCS_CKM.1 Cryptographic key generation .52
10.3.8 FCS_CKM.2 Cryptographic key distribution . 53
10.3.9 FCS_CKM.3 Cryptographic key access . 53
10.3.10 FCS_CKM.5 Cryptographic key derivation . 54
10.3.11 FCS_CKM.6 Timing and event of cryptographic key destruction . 55
10.4 Cryptographic operation (FCS_COP) . 56
10.4.1 Family Behaviour . 56
10.4.2 Component levelling and description . 56
10.4.3 Component management . 56
10.4.4 Component audit . 56
10.4.5 Application notes . 56
10.4.6 FCS_COP.1 Cryptographic operation .57
10.5 Random bit generation (FCS_RBG) . 58
10.5.1 Family Behaviour . 58
10.5.2 Component levelling and description . 58
10.5.3 Component management .59
10.5.4 Component audit .59
10.5.5 Application notes .59
10.5.6 FCS_RBG.1 Random bit generation (RBG) .59
10.5.7 FCS_RBG.2 Random bit generation (external seeding) .61
10.5.8 FCS_RBG.3 Random bit generation (internal seeding - single source) .61
10.5.9 FCS_RBG.4 Random bit generation (internal seeding - multiple sources) .62
10.5.10 FCS_RBG.5 Random bit generation (combining entropy sources) .62
10.5.11 FCS_RBG.6 Random bit generation service . 63
10.6 Generation of random numbers (FCS_RNG) . 63
10.6.1 Family Behaviour . 63
10.6.2 Component levelling and description . 64
10.6.3 Component management . 64
10.6.4 Component audit . 64
10.6.5 Application notes . 64
10.6.6 FCS_RNG.1 Random number generation . 64
11 Class FDP User data protection .66
11.1 Introduction . 66
11.2 Notes on class FDP . 69
11.3 Access control policy (FDP_ACC) .71
11.3.1 Family Behaviour .71
11.3.2 Component levelling and description . 72
11.3.3 Component management . 72
11.3.4 Component audit . 72
11.3.5 Application notes . 72
11.3.6 FDP_ACC.1 Subset access control . 73
11.3.7 FDP_ACC.2 Complete access control . 73
© ISO/IEC 2026 – All rights reserved
v
ISO/IEC 15408-2:2026(en)
11.4 Access control functions (FDP_ACF) .74
11.4.1 Family Behaviour .74
11.4.2 Component levelling and description .74
11.4.3 Component management .74
11.4.4 Component audit . 75
11.4.5 Application notes . 75
11.4.6 FDP_ACF.1 Security attribute-based access control . 75
11.5 Data authentication (FDP_DAU) . 77
11.5.1 Family Behaviour . 77
11.5.2 Component levelling and description . 77
11.5.3 Component management . 77
11.5.4 Component audit . 77
11.5.5 Application notes . 78
11.5.6 FDP_DAU.1 Basic Data Authentication . 78
11.5.7 FDP_DAU.2 Data Authentication with Identity of Guarantor . 78
11.6 Export from the TOE (FDP_ETC) . 79
11.6.1 Family Behaviour . 79
11.6.2 Component levelling and description . 79
11.6.3 Component management . 80
11.6.4 Component audit . 80
11.6.5 Application notes . 80
11.6.6 FDP_ETC.1 Export of user data without security attributes . 80
11.6.7 FDP_ETC.2 Export of user data with security attributes . 81
11.7 Information flow control policy (FDP_IFC) . 82
11.7.1 Family Behaviour . 82
11.7.2 Component levelling and description . 82
11.7.3 Component management . 82
11.7.4 Component audit . 82
11.7.5 Application notes . 82
11.7.6 FDP_IFC.1 Subset information flow control. 83
11.7.7 FDP_IFC.2 Complete information flow control . 84
11.8 Information flow control functions (FDP_IFF) . 85
11.8.1 Family Behaviour . 85
11.8.2 Component levelling and description . 85
11.8.3 Component management .
...