prEN ISO 17574

SLOVENSKI STANDARD
01-september-2025
Elektronsko pobiranje pristojbin - Smernice za zaščito varnostnih profilov EFC
(ISO/DIS 17574:2025)
Electronic fee collection - Guidelines for security protection profiles (ISO/DIS
17574:2025)
Elektronische Gebührenerhebung - Leitfaden für Sicherheitsprofile (ISO/DIS
17574:2025)
Perception de télépéage - Lignes directrices concernant les profils de protection de la
sécurité (ISO/DIS 17574:2025)
Ta slovenski standard je istoveten z: prEN ISO 17574
ICS:
03.220.20 Cestni transport Road transport
35.240.60 Uporabniške rešitve IT v IT applications in transport
prometu
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

DRAFT
International
Standard
ISO/DIS 17574
ISO/TC 204
Electronic fee collection —
Secretariat: ANSI
Guidelines for security protection
Voting begins on:
profiles
2025-07-18
Perception de télépéage — Lignes directrices concernant les
Voting terminates on:
profils de protection de la sécurité
2025-10-10
ICS: 35.240.60; 03.220.20
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
NATIONAL REGULATIONS.
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Reference number
ISO/DIS 17574:2025(en)
DRAFT
ISO/DIS 17574:2025(en)
International
Standard
ISO/DIS 17574
ISO/TC 204
Electronic fee collection —
Secretariat: ANSI
Guidelines for security protection
Voting begins on:
profiles
Perception de télépéage — Lignes directrices concernant les
Voting terminates on:
profils de protection de la sécurité
ICS: 35.240.60; 03.220.20
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
© ISO 2025
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
BE CONSIDERED IN THE LIGHT OF THEIR
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
or ISO’s member body in the country of the requester.
NATIONAL REGULATIONS.
ISO copyright office
RECIPIENTS OF THIS DRAFT ARE INVITED
CP 401 • Ch. de Blandonnet 8
TO SUBMIT, WITH THEIR COMMENTS,
CH-1214 Vernier, Geneva
NOTIFICATION OF ANY RELEVANT PATENT
Phone: +41 22 749 01 11
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland Reference number
ISO/DIS 17574:2025(en)
ii
ISO/DIS 17574:2025(en)
Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Abbreviated terms . 2
5 EFC security architecture and protection profile processes . 3
5.1 General .3
5.2 EFC security architecture . .3
5.3 Protection profile preparatory steps .4
5.4 Relationship between actors .5
6 Outlines of Protection Profile . 7
6.1 Structure .7
6.2 Context .8
Annex A (informative) Procedures for preparing documents . 9
Annex B (informative) Example of threat analysis evaluation method .42
Annex C (informative) Relevant security standards in the context of the EFC . 47
Annex D (informative) Common Criteria Recognition Arrangement (CCRA) .48
Bibliography .49

iii
ISO/DIS 17574:2025(en)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out through
ISO technical committees. Each member body interested in a subject for which a technical committee
has been established has the right to be represented on that committee. International organizations,
governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely
with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types
of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the
ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent
rights identified during the development of the document will be in the Introduction and/or on the ISO list of
patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment,
as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the
Technical Barriers to Trade (TBT) see the following URL: www.iso.org/iso/foreword.html.
The committee responsible for this document is ISO/TC 204, Intelligent transport systems.
This first edition cancels and replaces the third edition of ISO/TS 17574, which has been technically revised.
The main changes are as follows:
— Clause 3 has been updated and ISO 17573-2 has been made the primary source for terms and definitions,
— requirements updated as to reflect the latest version of the ISO/IEC 15408 series.

iv
ISO/DIS 17574:2025(en)
Introduction
Electronic fee collection (EFC) systems are subject to several ways of fraud both by users and operators but
also from people outside the system. These security threats have to be met by different types of security
measures including specified security requirements.
It is recommended that EFC operators use the guidelines provided by this document to prepare their own
EFC protection profile (PP), as security requirements should be described from the operator's point of view.
It should be noted that the guidelines provided in this document are intended to be read in conjunction with
the underlying international standards ISO/IEC 15408 (all parts). Most of the content of this document is an
example shown in Annex A on how to prepare the security requirements for EFC equipment, in this case, a
DSRC-based OBE with an integrated circuit(s) card (ICC) loaded with crucial data needed for the EFC. The
example refers to a Japanese national EFC system and should only be regarded as an example.
After an EFC/PP is prepared, it can be internationally registered by the organization that prepared the EFC/
PP so that other operators or countries that want to develop their EFC system security services can refer to
an already registered EFC/PP.
This EFC-related document on security service framework and EFC/PP is based on ISO/IEC 15408 (all parts).
ISO/IEC 15408 (all parts) includes a set of requirements for the security functions and assurance of IT-
relevant products and systems. Operators, organizations or authorities defining their own EFC/PP can use
these requirements. This will be similar to the different PPs registered by several financial institutions, e.g.
for payment instruments like IC cards (ICCs).
The products and systems that were developed in accordance with ISO/IEC 15408 (all parts) can be publicly
assured by the authentication of the government or designated private evaluation agencies.

v
DRAFT International Standard ISO/DIS 17574:2025(en)
Electronic fee collection — Guidelines for security protection
profiles
1 Scope
This document provides guidelines for preparation and evaluation of security requirements specifications,
referred to as Protection Profiles (PP) in ISO/IEC 15408 (all parts) and in ISO/IEC TR 15446.
By Protection Profile (PP), it means a set of security requirements for a category of products or systems that
meet specific needs. A typical example would be a PP for on-board equipment (OBE) to be used in an EFC
system. However, the guidelines in this document are superseded if a Protection Profile already exists for
the subsystem in consideration.
The target of evaluation (TOE) for EFC is limited to EFC specific roles and interfaces as shown in Figure 1.
Since the existing financial security standards and criteria are applicable to other external roles and
interfaces, they are assumed to be outside the scope of TOE for EFC.
Figure 1 — Scope of TOE for EFC
The security evaluation is performed by assessing the security-related properties of roles, entities and
interfaces defined in security targets (STs), as opposed to assessing complete processes which often are
distributed over more entities and interfaces than those covered by the TOE of this document.
NOTE Assessing security issues for complete processes is a complimentary approach, which may well be
beneficial to apply when evaluating the security of a system.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes
requirements of this document. For dated references, only the edition cited applies. For undated references,
the latest edition of the referenced document (including any amendments) applies.

ISO/DIS 17574:2025(en)
ISO/IEC 15408-1, Information security — cybersecurity and privacy protection — Evaluation criteria for IT
security — Part 1: Introduction and general model
ISO/IEC 15408-2, Information security — cybersecurity and privacy protection — Evaluation criteria for IT
security — Part 2: Sec
...