ISO/IEC 15408-3:2026
(Main)Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Part 3: Security assurance components
- Abstract
This document specifies the security assurance requirements of the ISO/IEC 15408 series. It includes the individual assurance components from which the evaluation assurance levels and other packages contained in ISO/IEC 15408-5 are composed, and the criteria for evaluation of Protection Profiles (PPs), PP-Configurations, PP-Modules and Security Targets (STs).
- Status
- Published
- Publication Date
- 18-May-2026
- Current Stage
- 6060 - International Standard published
- Start Date
- 19-May-2026
- Due Date
- 27-Oct-2026
- Completion Date
- 19-May-2026
Buy Documents
ISO/IEC 15408-3:2026 - Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Part 3: Security assurance components
ISO/IEC 15408-3:2026 - Sécurité de l'information, cybersécurité et protection de la vie privée — Critères d'évaluation pour la sécurité des technologies de l'information — Partie 3: Composants d'assurance de sécurité
ISO/IEC 15408-3:2026 is an International Standard published by ISO. It defines the security assurance requirements used across the ISO/IEC 15408 series, including the assurance components that make up evaluation assurance levels and other packages in ISO/IEC 15408-5. It is intended for people preparing, evaluating, or using Protection Profiles (PPs), PP-Configurations, PP-Modules and Security Targets (STs).
What does ISO/IEC 15408-3:2026 specify?
ISO/IEC 15408-3:2026 specifies the security assurance part of the ISO/IEC 15408 series. It gives the criteria used to evaluate PPs, PP-Configurations, PP-Modules and STs, and it defines the assurance components that can be combined into evaluation assurance levels and other packages.
Clause 4 shows the structure of the document. Clause 5 explains the assurance paradigm, Clause 6 explains the assurance taxonomy, and Clauses 7 to 15 give the detailed assurance classes. Annex A gives explanatory material for development-related concepts, and Annex B explains composition evaluations.
| Annex | What it covers |
|---|---|
| A | Supplementary material on security architectures, functional specification, TSF internals, subsystems/modules, and formal methods |
| B | Concepts behind composition evaluations and the ACO class, including base and dependent components and their interactions |
The main classes are:
- Clause 7 - APE, Protection Profile (PP) evaluation
- Clause 8 - ACE, Protection Profile Configuration evaluation
- Clause 9 - ASE, Security Target (ST) evaluation
- Clause 10 - ADV, Development
- Clause 11 - AGD, Guidance documents
- Clause 12 - ALC, Life cycle support
- Clause 13 - ATE, Tests
- Clause 14 - AVA, Vulnerability assessment
- Clause 15 - ACO, Composition
What are the key requirements of ISO/IEC 15408-3:2026?
ISO/IEC 15408-3:2026 is built around a simple assurance idea: security threats and policy commitments need to be stated clearly, and the proposed security controls need to be shown to be sufficient for their purpose. In practice, the standard asks for evidence that the TOE can resist vulnerabilities, that vulnerabilities are easier to find and handle, and that the evaluated security claims are internally consistent.
How does the standard frame assurance?
Clause 5 says assurance grows with greater evaluation effort, but the aim is to apply only the effort needed for the assurance required. The document describes that effort in terms of:
- Scope - how much of the IT product is included
- Depth - how far the evaluation looks into design and implementation detail
- Rigour - how structured and formal the evaluation is
This matters because a buyer or evaluator can match the assurance effort to the risk and the complexity of the product instead of treating every evaluation the same way.
Clause 6 then structures assurance into classes, families, components and elements. Each assurance element is a single requirement statement, which helps evaluators trace evidence one requirement at a time instead of trying to interpret compound text.
How are PPs, PP-Configurations and STs evaluated?
Clause 7 requires a PP to be sound and internally consistent. If the PP is built from other PPs or packages, it must also be a correct instantiation of those sources. That is the check that makes a PP usable as the basis for an ST or another PP.
Clause 8 applies the same logic to PP-Configurations and PP-Modules. A PP-Configuration must be sound and consistent, and the PP-Modules inside it must conform to their base components. In practice, this is the part that checks that a combined profile still hangs together when separate PPs or PP-Modules are assembled.
Clause 9 requires an ST to be sound and internally consistent, and, where relevant, a correct instantiation of a PP-Configuration, PPs or packages. The clause also includes TOE summary specification and consistency checks for composite product STs. That is important when a product statement draws on more than one component or package.
What do the development, test, life cycle and composition clauses require?
Clause 10 asks for evidence about the TOE's security architecture, functional specification, implementation representation, TSF internals, formal TSF model and TOE design. This is the material used to show how the security functionality is realized and how it is protected from corruption or bypass.
Clause 11 requires operational user guidance and preparative procedures. In practice, the evaluator looks for instructions that let the TOE be prepared and operated in the evaluated configuration and reduce the risk of incorrect setup or misuse.
Clause 12 covers life cycle support. It includes configuration management capabilities and scope, delivery, developer environment security, flaw remediation, development life cycle definition, TOE development artefacts, tools and techniques, and integration of composition parts. This clause matters because it shows that the evaluated TOE was controlled, reproducible and handled consistently from development through delivery.
Clause 13 covers testing. It separates coverage, depth, functional tests, independent testing and composite functional testing. The point is to confirm that the security functionality behaves as described, with evaluator testing checking enough of the developer's work to support trust.
Clause 14 covers vulnerability assessment. It includes vulnerability analysis levels from survey to advanced methodical analysis, plus composite vulnerability assessment for composed products. The evaluator looks for exploitable weaknesses in development or operation, including covert channels when the ST calls for that kind of analysis.
Clause 15 covers composition. It applies when a TOE is built from two or more previously evaluated software, firmware or hardware components. The class distinguishes base components and dependent components, then uses composition rationale, development evidence, reliance information, composed TOE testing and composition vulnerability analysis to judge whether the combined TOE remains secure.
What terms does ISO/IEC 15408-3:2026 define?
- acceptance procedure - the procedure used to accept a newly created or modified configuration item into the TOE or move it to the next life-cycle step, with the responsible roles and acceptance criteria identified.
- action - an activity carried out by an evaluator or a developer, including actions stated directly or actions implied by developer actions.
- actual test result - the observed result of a test, which may differ from the expected test result.
- configuration item - a hardware, software, or combined item managed as a single entity during TOE development, including TOE parts and related artefacts such as evaluation documents or development tools.
- configuration list - a document that lists all configuration items for a specific product version and identifies the exact version of each relevant item.
- TOE - the target of evaluation, used throughout the document as the product or system being assessed.
Who uses ISO/IEC 15408-3:2026?
ISO/IEC 15408-3:2026 is used by people who write, evaluate, or integrate security-evaluated IT products. PP authors use it to define sound and consistent Protection Profiles, and ST authors use it to build Security Targets that can support a TOE evaluation.
Evaluators use it to check conformance claims, security problem definitions, objectives, requirements, summary specifications, guidance, design evidence, tests and vulnerability analyses. Developers use it to prepare the evidence expected for functional specification, design, implementation representation, configuration management, delivery, flaw remediation and testing.
It is also relevant to product and system integrators working with composed TOEs, where one evaluated component depends on another evaluated component. That is common in software, firmware and hardware combinations where a dependent component relies on a base component for security services.
Which standards are used with ISO/IEC 15408-3:2026?
- ISO/IEC 15408-1:2026 - provides the introduction and general model for the ISO/IEC 15408 series, and Clause 7 and Clause 9 point readers to its Annexes B and D for concepts and examples.
- ISO/IEC 15408-2:2026 - provides the security functional components that accompany the assurance requirements in this part.
- ISO/IEC 15408-4 - provides the framework for specifying evaluation methods and activities.
- ISO/IEC 15408-5:2026 - provides pre-defined packages of security requirements, including the evaluation assurance levels and CAPs referred to in this part.
- ISO/IEC 18045:2026 - provides the requirements and methodology for IT security evaluation, and Annex A points to its Annex C for supplementary material on formal methods.
- ISO/IEC/IEEE 24765:2017 - provides vocabulary used alongside the terms and definitions in this document.
What does the ISO/IEC 15408-3:2026 document contain?
The document contains class decomposition diagrams, dependency tables, component objectives, component relationships, application notes and component elements. Those structures appear throughout Clauses 7 to 15 and are used to define how each assurance family is built and how its components depend on one another.
Clause 10 gives detailed treatment of security architecture, functional specification, implementation representation, TSF internals, formal TSF model and TOE design. Clause 13 sets out the testing families and their levels, while Clause 14 sets out the vulnerability-analysis families and their levels.
Annex A provides explanatory material and examples for security architecture, functional specification, TSF internals, subsystems and modules, and formal methods. Annex B explains composition evaluations, including the relationship between base and dependent components, how interfaces are interpreted, and how a composed TOE ST is evaluated.
Relations
- Effective Date
- 03-Jun-2026
- Effective Date
- 09-Feb-2026
- Effective Date
- 12-Feb-2026
- Effective Date
- 28-Oct-2023
Buy Documents
ISO/IEC 15408-3:2026 - Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Part 3: Security assurance components
ISO/IEC 15408-3:2026 - Sécurité de l'information, cybersécurité et protection de la vie privée — Critères d'évaluation pour la sécurité des technologies de l'information — Partie 3: Composants d'assurance de sécurité
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
ISO/IEC 15408-3:2026 is a standard published by the International Organization for Standardization (ISO). Its full title is "Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Part 3: Security assurance components". This standard covers: This document specifies the security assurance requirements of the ISO/IEC 15408 series. It includes the individual assurance components from which the evaluation assurance levels and other packages contained in ISO/IEC 15408-5 are composed, and the criteria for evaluation of Protection Profiles (PPs), PP-Configurations, PP-Modules and Security Targets (STs).
This document specifies the security assurance requirements of the ISO/IEC 15408 series. It includes the individual assurance components from which the evaluation assurance levels and other packages contained in ISO/IEC 15408-5 are composed, and the criteria for evaluation of Protection Profiles (PPs), PP-Configurations, PP-Modules and Security Targets (STs).
ISO/IEC 15408-3:2026 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
ISO/IEC 15408-3:2026 has the following relationships with other standards: It is inter standard links to EN ISO/IEC 15408-5:2026, EN ISO/IEC 19896-3:2025, EN ISO/IEC 15408-3:2026, ISO/IEC 15408-3:2022. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
ISO/IEC 15408-3:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
International
Standard
ISO/IEC 15408-3
Fifth edition
Information security, cybersecurity
2026-05
and privacy protection —
Evaluation criteria for IT security —
Part 3:
Security assurance components
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies
de l'information —
Partie 3: Composants d'assurance de sécurité
Reference number
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
Contents Page
Foreword .x
Introduction .xi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Overview . 5
5 Assurance paradigm . 5
5.1 General .5
5.2 CC approach .5
5.3 Assurance approach .5
5.3.1 General .5
5.3.2 Significance of vulnerabilities .5
5.3.3 Cause of vulnerabilities .6
5.3.4 CC assurance .6
5.3.5 Assurance through evaluation .6
5.4 CC evaluation assurance scale .7
6 Security assurance components . 7
6.1 General .7
6.2 Assurance class structure .7
6.2.1 General .7
6.2.2 Class name .8
6.2.3 Class introduction .8
6.2.4 Class application notes .8
6.2.5 Assurance families .8
6.3 Assurance family structure .8
6.3.1 General .8
6.3.2 Family name .8
6.3.3 Family objectives .8
6.3.4 Component levelling .9
6.3.5 Family application notes .9
6.3.6 Assurance components .9
6.4 Assurance component structure .9
6.4.1 General .9
6.4.2 Component name .9
6.4.3 Component objectives . .10
6.4.4 Component application notes .10
6.4.5 Component dependencies .10
6.4.6 Assurance elements .10
6.5 Assurance elements .11
6.6 Component taxonomy .11
7 Class APE Protection Profile (PP) evaluation .11
7.1 General .11
7.2 PP introduction (APE_INT) . 12
7.2.1 Objectives . 12
7.2.2 PP introduction (APE_INT.1) . 13
7.3 Conformance claims (APE_CCL) . 13
7.3.1 Objectives . 13
7.3.2 Conformance claims (APE_CCL.1) . 13
7.4 Security problem definition (APE_SPD) . 15
7.4.1 Objectives . 15
7.4.2 Security problem definition (APE_SPD.1) . 15
7.5 Security objectives (APE_OBJ) . 15
© ISO/IEC 2026 – All rights reserved
iii
7.5.1 Objectives . 15
7.5.2 Component levelling . 15
7.5.3 Security objectives for the operational environment (APE_OBJ.1) . 15
7.5.4 Security objectives (APE_OBJ.2) . .16
7.6 Extended components definition (APE_ECD) .17
7.6.1 Objectives .17
7.6.2 Extended components definition (APE_ECD.1) .17
7.7 Security requirements (APE_REQ) .18
7.7.1 Objectives .18
7.7.2 Component levelling .18
7.7.3 Direct rationale security requirements (APE_REQ.1) .18
7.7.4 Derived security requirements (APE_REQ.2) .19
8 Class ACE Protection Profile Configuration evaluation .20
8.1 General . 20
8.2 PP-Module introduction (ACE_INT) . 22
8.2.1 Objectives . 22
8.2.2 PP-Module introduction (ACE_INT.1) . 22
8.3 PP-Module conformance claims (ACE_CCL) . 22
8.3.1 Objectives . 22
8.3.2 PP-Module conformance claims (ACE_CCL.1) . 23
8.4 PP-Module security problem definition (ACE_SPD) .24
8.4.1 Objectives .24
8.4.2 PP-Module security problem definition (ACE_SPD.1) .24
8.5 PP-Module security objectives (ACE_OBJ) .24
8.5.1 Objectives .24
8.5.2 Component levelling .24
8.5.3 PP-Module security objectives for the operational environment (ACE_OBJ.1) .24
8.5.4 PP-Module security objectives (ACE_OBJ.2) . 25
8.6 PP-Module extended components definition (ACE_ECD). 26
8.6.1 Objectives . 26
8.6.2 PP-Module extended components definition (ACE_ECD.1) . 26
8.7 PP-Module security requirements (ACE_REQ) .27
8.7.1 Objectives .27
8.7.2 Component levelling .27
8.7.3 PP-Module direct rationale security requirements (ACE_REQ.1) .27
8.7.4 PP-Module derived security requirements (ACE_REQ.2) . 28
8.8 PP-Module consistency (ACE_MCO) . 29
8.8.1 Objectives . 29
8.8.2 PP-Module consistency (ACE_MCO.1) . 29
8.9 PP-Configuration consistency (ACE_CCO) . 30
8.9.1 Objectives . 30
8.9.2 PP-Configuration consistency (ACE_CCO.1) . 30
9 Class ASE Security Target (ST) evaluation .32
9.1 General .32
9.2 ST introduction (ASE_INT) . 34
9.2.1 Objectives . 34
9.2.2 ST introduction (ASE_INT.1) . 34
9.3 Conformance claims (ASE_CCL) . 34
9.3.1 Objectives . 34
9.3.2 Conformance claims (ASE_CCL.1) . 35
9.4 Security problem definition (ASE_SPD) . 36
9.4.1 Objectives . 36
9.4.2 Security problem definition (ASE_SPD.1) . 36
9.5 Security objectives (ASE_OBJ) . 36
9.5.1 Objectives . 36
9.5.2 Component levelling . 36
9.5.3 Security objectives for the operational environment (ASE_OBJ.1) . 36
9.5.4 Security objectives (ASE_OBJ.2) .37
© ISO/IEC 2026 – All rights reserved
iv
9.6 Extended components definition (ASE_ECD) . 38
9.6.1 Objectives . 38
9.6.2 Extended components definition (ASE_ECD.1) . 38
9.7 Security requirements (ASE_REQ). 39
9.7.1 Objectives . 39
9.7.2 Component levelling . 39
9.7.3 Direct rationale security requirements (ASE_REQ.1) . 39
9.7.4 Derived security requirements (ASE_REQ.2). 40
9.8 TOE summary specification (ASE_TSS) .41
9.8.1 Objectives .41
9.8.2 Component levelling .41
9.8.3 TOE summary specification (ASE_TSS.1) .41
9.8.4 TOE summary specification with architectural design summary (ASE_TSS.2) .42
9.9 Consistency of composite product Security Target (ASE_COMP) .42
9.9.1 Objectives .42
9.9.2 Component levelling .43
9.9.3 Application notes .43
9.9.4 Consistency of Security Target (ST) (ASE_COMP.1) . 44
10 Class ADV Development .44
10.1 General . 44
10.2 Security architecture (ADV_ARC) . 50
10.2.1 Objectives . 50
10.2.2 Component levelling . 50
10.2.3 Application notes . 50
10.2.4 Security architecture description (ADV_ARC.1) .51
10.3 Functional specification (ADV_FSP) .52
10.3.1 Objectives .52
10.3.2 Component levelling .52
10.3.3 Application notes .52
10.3.4 Basic functional specification (ADV_FSP.1) . 55
10.3.5 Security-enforcing functional specification (ADV_FSP.2) . 55
10.3.6 Functional specification with complete summary (ADV_FSP.3) . 56
10.3.7 Complete functional specification (ADV_FSP.4) .57
10.3.8 Complete semi-formal functional specification with additional error
information (ADV_FSP.5).57
10.3.9 Complete semi-formal functional specification with additional formal
specification (ADV_FSP.6). 58
10.4 Implementation representation (ADV_IMP) .59
10.4.1 Objectives .59
10.4.2 Component levelling .59
10.4.3 Application notes .59
10.4.4 Implementation representation of the TSF (ADV_IMP.1) . 60
10.4.5 Complete mapping of the implementation representation of the TSF (ADV_IMP.2) .61
10.5 TSF internals (ADV_INT) .62
10.5.1 Objectives .62
10.5.2 Component levelling .62
10.5.3 Application notes .62
10.5.4 Well-structured subset of TSF internals (ADV_INT.1) .62
10.5.5 Well-structured internals (ADV_INT.2) . 63
10.5.6 Minimally complex internals (ADV_INT.3) . 64
10.6 Formal TSF model (ADV_SPM). 65
10.6.1 Objectives . 65
10.6.2 Component levelling . 65
10.6.3 Application notes . 65
10.6.4 Formal TSF model (ADV_SPM.1) . 66
10.7 TOE design (ADV_TDS) .67
10.7.1 Objectives .67
10.7.2 Component levelling .67
© ISO/IEC 2026 – All rights reserved
v
10.7.3 Application notes .67
10.7.4 Basic design (ADV_TDS.1) . 68
10.7.5 Architectural design (ADV_TDS.2) . 69
10.7.6 Basic modular design (ADV_TDS.3) .70
10.7.7 Semi-Formal modular design (ADV_TDS.4) .71
10.7.8 Complete semi-formal modular design (ADV_TDS.5) .71
10.7.9 Complete semi-formal modular design with formal high-level design
presentation (ADV_TDS.6) . 72
10.8 Composite design compliance (ADV_COMP) . 73
10.8.1 Objectives . 73
10.8.2 Component levelling . 73
10.8.3 Application notes . 73
10.8.4 Design compliance with the base component-related user guidance, ETR for
composite evaluation and report of the base component evaluation authority
(ADV_COMP.1) .74
11 Class AGD guidance documents .75
11.1 General . 75
11.2 Operational user guidance (AGD_OPE) . 75
11.2.1 Objectives . 75
11.2.2 Component levelling .76
11.2.3 Application notes .76
11.2.4 Operational user guidance (AGD_OPE.1) .76
11.3 Preparative procedures (AGD_PRE) . 77
11.3.1 Objectives . 77
11.3.2 Component levelling . 77
11.3.3 Application notes . 77
11.3.4 Preparative procedures (AGD_PRE.1) . 78
12 Class ALC life cycle support .78
12.1 General . 78
12.2 CM capabilities (ALC_CMC) . 80
12.2.1 Objectives . 80
12.2.2 Component levelling . 81
12.2.3 Application notes . 81
12.2.4 Labelling of the TOE (ALC_CMC.1) . 81
12.2.5 Use of the CM system (ALC_CMC.2) . 82
12.2.6 Authorization controls (ALC_CMC.3) . 83
12.2.7 Production support, acceptance procedures and automation (ALC_CMC.4) . 84
12.2.8 Advanced support (ALC_CMC.5) . 85
12.3 CM scope (ALC_CMS) . 87
12.3.1 Objectives . 87
12.3.2 Component levelling . 87
12.3.3 Application notes . 87
12.3.4 TOE CM coverage (ALC_CMS.1) . 87
12.3.5 Parts of the TOE CM coverage (ALC_CMS.2) . 88
12.3.6 Implementation representation CM coverage (ALC_CMS.3) . 89
12.3.7 Problem tracking CM coverage (ALC_CMS.4) . 89
12.3.8 Development tools CM coverage (ALC_CMS.5) . 90
12.4 Delivery (ALC_DEL) .91
12.4.1 Objectives .91
12.4.2 Component levelling .91
12.4.3 Application notes .91
12.4.4 Delivery procedures (ALC_DEL.1) . 92
12.5 Developer environment security (ALC_DVS) . 92
12.5.1 Objectives . 92
12.5.2 Component levelling . 92
12.5.3 Application notes . 93
12.5.4 Identification of security controls (ALC_DVS.1) . 93
12.5.5 Sufficiency of security controls (ALC_DVS.2) . 93
© ISO/IEC 2026 – All rights reserved
vi
12.6 Flaw remediation (ALC_FLR) . 94
12.6.1 Objectives . 94
12.6.2 Component levelling . 94
12.6.3 Application notes . 94
12.6.4 Basic flaw remediation (ALC_FLR.1) . 94
12.6.5 Flaw reporting procedures (ALC_FLR.2) . 95
12.6.6 Systematic flaw remediation (ALC_FLR.3) . 96
12.7 Development life cycle definition (ALC_LCD) . 97
12.7.1 Objectives . 97
12.7.2 Component levelling . 97
12.7.3 Application notes .
...
Norme
internationale
ISO/IEC 15408-3
Cinquième édition
Sécurité de l'information,
2026-05
cybersécurité et protection de la
vie privée — Critères d'évaluation
pour la sécurité des technologies de
l'information —
Partie 3:
Composants d'assurance de sécurité
Information security, cybersecurity and privacy protection —
Evaluation criteria for IT security —
Part 3: Security assurance components
Numéro de référence
DOCUMENT PROTÉGÉ PAR COPYRIGHT
© ISO/IEC 2026
Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en œuvre, aucune partie de cette
publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique,
y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut
être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
ISO copyright office
Case postale 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Genève
Tél.: +41 22 749 01 11
E-mail: copyright@iso.org
Web: www.iso.org
Publié en Suisse
© ISO/IEC 2026 – Tous droits réservés
ii
Sommaire Page
Avant-propos .x
Introduction .xi
1 Domaine d'application . 1
2 Références normatives . 1
3 Termes et définitions . 1
4 Vue d'ensemble . 5
5 Paradigme d'assurance . 5
5.1 Généralités .5
5.2 Approche CC .5
5.3 Approche d'assurance .6
5.3.1 Généralités .6
5.3.2 Signification des vulnérabilités . .6
5.3.3 Cause des vulnérabilités .6
5.3.4 Assurance CC .7
5.3.5 Assurance par l'évaluation .7
5.4 Niveau d'assurance de l'évaluation CC .7
6 Composants d'assurance de sécurité . 8
6.1 Généralités .8
6.2 Structure de la classe d'assurance .8
6.2.1 Généralités .8
6.2.2 Nom de la classe .8
6.2.3 Introduction de la classe .8
6.2.4 Notes d'application de classe .8
6.2.5 Familles d'assurance .9
6.3 Structure de la famille d'assurance .9
6.3.1 Généralités .9
6.3.2 Nom de la famille .9
6.3.3 Objectifs de la famille .9
6.3.4 Classement des composants .9
6.3.5 Notes d'application familiale .9
6.3.6 Composants d'assurance .10
6.4 Structure du composant d'assurance .10
6.4.1 Généralités .10
6.4.2 Nom du composant .10
6.4.3 Objectifs des composants .10
6.4.4 Notes d'application des composants .10
6.4.5 Dépendances des composants .11
6.4.6 Éléments d'assurance .11
6.5 Éléments d'assurance . 12
6.6 Taxonomie des composants . 12
7 Évaluation du profil de protection de classe APE (PP) .12
7.1 Généralités . 12
7.2 Introduction du PP (APE_INT) . 13
7.2.1 Objectifs . 13
7.2.2 Introduction de PP (APE_INT.1) .14
7.3 Revendications de conformité (APE_CCL) .14
7.3.1 Objectifs .14
7.3.2 Revendications de conformité (APE_CCL.1) . .14
7.4 Définition du problème de sécurité (APE_SPD) .16
7.4.1 Objectifs .16
7.4.2 Définition du problème de sécurité (APE_SPD.1) .16
7.5 Objectifs de sécurité (APE_OBJ) .16
© ISO/IEC 2026 – Tous droits réservés
iii
7.5.1 Objectifs .16
7.5.2 Classement des composants .16
7.5.3 Objectifs de sécurité pour l'environnement opérationnel (APE_OBJ.1) .16
7.5.4 Objectifs de sécurité (APE_OBJ.2) .17
7.6 Définition des composants étendus (APE_ECD) .18
7.6.1 Objectifs .18
7.6.2 Définitions des composants étendus (APE_ECD.1) .18
7.7 Exigences de sécurité (APE_REQ) .19
7.7.1 Objectifs .19
7.7.2 Classement des composants .19
7.7.3 Exigences de sécurité avec argumentaire direct (APE_REQ.1) .19
7.7.4 Exigences de sécurité dérivées (APE_REQ.2) . 20
8 Classe ACE Évaluation de la configuration du profil de protection .21
8.1 Généralités .21
8.2 Introduction du module de PP (APE_INT) . 23
8.2.1 Objectifs . 23
8.2.2 Introduction du module de PP (ACE_INT.1) . 23
8.3 Revendications de conformité du module de PP (ACE_CCL) . 23
8.3.1 Objectifs . 23
8.3.2 Revendications de conformité de Module de PP (ACE_CCL.1) .24
8.4 Définition de problème de sécurité de Module de PP (ACE_SPD) . 25
8.4.1 Objectifs . 25
8.4.2 Définition de problème de sécurité de Module de PP (ACE_SPD.1) . 25
8.5 Objectifs de sécurité de Module de PP (ACE_OBJ) . 26
8.5.1 Objectifs . 26
8.5.2 Classement des composants . 26
8.5.3 Objectifs de sécurité de Module de PP pour l'environnement opérationnel (ACE_
OBJ.1) . 26
8.5.4 Objectifs de sécurité de Module de PP (ACE_OBJ.2) .27
8.6 Définitions des composants étendus du module de PP (ACE_ECD) .27
8.6.1 Objectifs .27
8.6.2 Définitions des composants étendus du module de PP (ACE_ECD.1) .27
8.7 Exigences en matière de sécurité d'un module de PP (ACE_REQ) . 28
8.7.1 Objectifs . 28
8.7.2 Classement des composants . 28
8.7.3 Exigences de sécurité avec argumentaire direct du module de PP (ACE_REQ.1) . 28
8.7.4 Exigences de sécurité dérivées de Module de PP (ACE_REQ.2) . 29
8.8 Cohérence du module de PP (ACE_MCO) . 30
8.8.1 Objectifs . 30
8.8.2 Cohérence de Module de PP (ACE_MCO.1) . 30
8.9 Cohérence de la configuration de PP (ACE_CCO).31
8.9.1 Objectifs .31
8.9.2 Cohérence de configuration de PP (ACE_CCO.1) .32
9 Évaluation de la cible de sécurité (ST) de classe ASE .34
9.1 Généralités . 34
9.2 Introduction de la ST (ASE_INT) . 36
9.2.1 Objectifs . 36
9.2.2 Introduction de la ST (ASE_INT.1) . 36
9.3 Revendications de conformité (ASE_CCL) . 36
9.3.1 Objectifs . 36
9.3.2 Revendications de conformité (ASE_CCL.1) .37
9.4 Définition du problème de sécurité (ASE_SPD) . 38
9.4.1 Objectifs . 38
9.4.2 Définition du problème de sécurité (ASE_SPD.1) . 38
9.5 Objectifs de sécurité (ASE_OBJ) . 39
9.5.1 Objectifs . 39
9.5.2 Classement des composants . 39
9.5.3 Objectifs de sécurité pour l'environnement opérationnel (ASE_OBJ.1). 39
© ISO/IEC 2026 – Tous droits réservés
iv
9.5.4 Objectifs de sécurité (ASE_OBJ.2) . 40
9.6 Définitions des composants étendus (ASE_ECD) . 40
9.6.1 Objectifs . 40
9.6.2 Définition étendue des composants (ASE_ECD.1) . 40
9.7 Exigences de sécurité (ASE_REQ) .41
9.7.1 Objectifs .41
9.7.2 Classement des composants .41
9.7.3 Exigences de sécurité avec argumentaire direct (ASE_REQ.1) .41
9.7.4 Exigences de sécurité dérivées (ASE_REQ.2) .42
9.8 Spécification récapitulative de la TOE (ASE_TSS) .43
9.8.1 Objectifs .43
9.8.2 Classement des composants . 44
9.8.3 Spécification de résumé de la TOE (ASE_TSS.1) . 44
9.8.4 Spécification de résumé de la TOE avec résumé de la conception architecturale
(ASE_TSS.2) . 44
9.9 Cohérence de la cible de sécurité d'un produit composite (ASE_COMP) .45
9.9.1 Objectifs .45
9.9.2 Classement des composants .45
9.9.3 Notes d'application .45
9.9.4 Cohérence de la cible de sécurité (ST) (ASE_COMP.1) . 46
10 Développement de la classe ADV . 47
10.1 Généralités .47
10.2 Architecture de sécurité (ADV_ARC) . 53
10.2.1 Objectifs . 53
10.2.2 Classement des composants . 53
10.2.3 Notes d'application . 53
10.2.4 Description de l'architecture de sécurité (ADV_ARC.1) . 54
10.3 Spécifications fonctionnelles (ADV_FSP) . 55
10.3.1 Objectifs . 55
10.3.2 Classement des composants . 55
10.3.3 Notes d'application . 55
10.3.4 Spécification fonctionnelle de base (ADV_FSP.1) . 58
10.3.5 Spécification fonctionnelle de sécurité (ADV_FSP.2) .59
10.3.6 Spécification fonctionnelle avec résumé complet (ADV_FSP.3) .59
10.3.7 Spécification fonctionnelle complète (ADV_FSP.4) . 60
10.3.8 Spécification fonctionnelle semi-formelle complète avec informations d'erreurs
supplémentaires (ADV_FSP.5) .61
10.3.9 Spécification fonctionnelle semi-formelle complète avec spécification formelle
supplémentaire (ADV_FSP.6) .62
10.4 Représentation de l'implémentation (ADV_IMP).62
10.4.1 Objectifs .62
10.4.2 Classement des composants . 63
10.4.3 Notes d'application . 63
10.4.4 Représentation de l'implémentation de la TSF (ADV_IMP.1) . 64
10.4.5 Mappage complet de la représentation d'implémentation de la TSF (ADV_IMP.2) . 64
10.5 Éléments internes de la TSF (ADV_INT) . 65
10.5.1 Objectifs . 65
10.5.2 Classement des composants . 65
10.5.3 Notes d'application . 65
10.5.4 Sous-ensemble bien structuré de la TSF interne (ADV_INT.1) . 66
10.5.5 Internes bien structurés (ADV_INT.2) .67
10.5.6 Internes de complexité minimale (ADV_INT.3) . 68
10.6 Modélisation de TSF formelle (ADV_SPM) . 68
10.6.1 Objectifs . 68
10.6.2 Classement des composants . 69
10.6.3 Notes d'application . 69
10.6.4 Modèle TSF formel (ADV_SPM.1) . 69
10.7 Conception de la TOE (ADV_TDS) .70
© ISO/IEC 2026 – Tous droits réservés
v
10.7.1 Objectifs .70
10.7.2 Classement des composants .71
10.7.3 Notes d'application .71
10.7.4 Conception de base (ADV_TDS.1) . 72
10.7.5 Conception architecturale (ADV_TDS.2) . 73
10.7.6 Conception modulaire de base (ADV_TDS.3) .74
10.7.7 Conception modulaire semi-formelle (ADV_TDS.4) . 75
10.7.8 Conception modulaire semi-formelle complète (ADV_TDS.5) . 75
10.7.9 Conception modulaire semi-formelle complète avec présentation formelle de la
conception de haut niveau (ADV_TDS.6) .76
10.8 Conformité de conception composite (ADV_COMP) . 77
10.8.1 Objectifs . 77
10.8.2 Classement des composants . 77
10.8.3 Notes d'application . 77
10.8.4 Conformité de la conception aux recommandations de l'utilisateur relatives
aux composants de base, RTE pour l'évaluation mixte et rapport de l'autorité
d'évaluation des composants de base (ADV_COMP.1) . 78
11 Classe AGD Lignes directrices.79
11.1 Généralités . 79
11.2 Guide opérationnel de l'utilisateur (AGD_OPE) . 80
11.2.1 Objectifs . 80
11.2.2 Classement des composants . 80
11.2.3 Notes d'application . 80
11.2.4 Recommandations opérationnelles de l'utilisateur (AGD_OPE.1) . 81
11.3 Guide préparatoire (AGD_PRE) . 82
11.3.1 Objectifs . 82
11.3.2 Classement des composants . 82
11.3.3 Notes d'application . 82
11.3.4 Procédures préparatoires (AGD_PRE.1) . 83
12 Support du cycle de vie de la classe ALC .83
12.1 Généralités . 83
12.2 Capacités CM (ALC_CMC) . 85
12.2.1 Objectifs . 85
12.2.2 Classement des composants . 86
12.2.3 Notes d'application . 86
12.2.4 Étiquetage de la TOE (ALC_CMC.1) . 86
12.2.5 Utilisation du système CM (ALC_CMC.2) . 87
12.2.6 Contrôles d'autorisation (ALC_CMC.3) . 88
12.2.7 Support de production, procédures d'acceptation et automatisation (ALC_CMC.4). 89
12.2.8 Support avancé (ALC_CMC.5) . 90
12.3 Périmètre de la CM (ALC_CMS) . 92
12.3.1 Objectifs . 92
12.3.2 Classement des composants . 92
12.3.3 Notes d'application . 93
12.3.4 Couverture de la CM de la TOE (ALC_CMS.1) . 93
12.3.5 Parties de la couverture de la CM de la TOE (ALC_CMS.2) . 93
12.3.6 Couverture de CM de représentation de mise en œuvre (ALC_CMS.3) . 94
12.3.7 Couverture de CM de suivi des problèmes (ALC_CMS.4) . 95
12.3.8 Outils de développement Couverture CM (ALC_CMS.5) . 96
12.4 Livraison (ALC_DEL) . 97
12.4.1 Objectifs . 97
12.4.2 Classement des composants . 97
12.4.3 Notes d'application . 97
12.4.4 Procédures de livraison (ALC_DEL.1) . 98
12.5 Sécurité de l'environnement du développeur (ALC_DVS) . 98
12.5.1 Objectifs . 98
12.5.2 Classement des composants . 98
12.5.3 Notes d'application . 98
© ISO/IEC 2026 – Tous droits réservés
vi
12.5.4 Identification des contrôles de sécurité (ALC_DVS.1) . 99
12.5.5 Caractère suffisant des mesures de sécurité (ALC_DVS.2) . 99
12.6 Correction des failles (ALC_FLR) . 100
12.6.1 Objectifs . 100
12.6.2 Classement des composants . 100
12.6.3 Notes d'application . 100
12.6.4 Correction des failles de base (ALC_FLR.1) . 100
12.6.5 Procédures de signalement des failles (ALC_FLR.2) . 101
12.6.6 Correction systématique des failles (ALC_FLR.3) . 102
12.7 Définition du cycle de vie de développement (ALC_LCD) . 103
12.7.1 Objectifs . 103
12.7.2 Classement des composants . 104
12.7.3 Notes d'application . 104
12.7.4 Processus du cycle de vie définis par le développeur (ALC_LCD.1) . 104
12.7.5 Modèle mesurable du cycle de vie (ALC_LCD.2) . 105
12.8 Artéfacts de développement de la TOE (ALC_TDA) . 105
12.8.1 Objectifs . 105
12.8.2 Classement des composants . 106
12.8.3 Notes d'application .
...