SIST EN ISO/IEC 15408-1:2026
(Main)Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 1: Introduction and general model (ISO/IEC 15408-1:2026)
- Abstract
This document establishes the general concepts and principles of information technology (IT) security evaluation. It specifies the general model of evaluation given in this document, which in its entirety is intended to be used as the basis for evaluation of security properties of IT products.
This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various parts of the ISO/IEC 15408 series i.e.
defines the terms and abbreviations used in all parts of the series; establishes the core concept of a Target of Evaluation (TOE);
describes the evaluation context; and
describes the audience to which the evaluation criteria is addressed.
Additionally, this document introduces the basic security concepts necessary for the evaluation of IT products.
- Status
- Published
- Public Enquiry End Date
- 10-Nov-2024
- Publication Date
- 16-Sep-2026
- Technical Committee
- ITC - Information technology
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 13-Aug-2026
- Due Date
- 18-Oct-2026
- Completion Date
- 17-Sep-2026
SIST EN ISO/IEC 15408-1:2026 is the first part of the ISO/IEC 15408 series, published by SIST as the European standard EN ISO/IEC 15408-1:2026. It sets out the general concepts, terminology and evaluation model for IT security evaluation, and it is the basis for evaluating the security properties of IT products. The document is used by people who define, evaluate, certify or procure evaluated IT products, including Protection Profiles (PPs), Security Targets (STs), PP-Modules and PP-Configurations.
What does SIST EN ISO/IEC 15408-1:2026 specify?
SIST EN ISO/IEC 15408-1:2026 specifies the general concepts and principles of information technology (IT) security evaluation. It also gives the general model used across the ISO/IEC 15408 series and explains how the parts fit together.
In practice, the document does four things that matter to readers:
- it defines the common terms and abbreviations used throughout the series
- it establishes the core concept of the Target of Evaluation (TOE)
- it describes the evaluation context and the intended audience
- it introduces the basic security concepts needed to evaluate IT products
The series focuses on security functionality and assurance for IT products, including hardware, firmware and software. It leaves out administrative security measures not directly tied to IT security functionality, the evaluation methodology itself, the legal or administrative framework for applying the criteria, accreditation procedures, and criteria for the inherent qualities of cryptographic algorithms.
The document is organized into an overview, the general model, the specification of security requirements, security components, packages, Protection Profiles, modular requirements, Security Targets, evaluation, and composition of assurance. Its annexes provide the detailed structures for packages, PPs, PP-Modules and PP-Configurations, STs, and PP/PP-Configuration conformance.
| Annex | What it covers |
|---|---|
| Annex A | Specification of packages |
| Annex B | Specification of Protection Profiles (PPs) |
| Annex C | Specification of PP-Modules and PP-Configurations |
| Annex D | Specification of Security Targets (STs) and direct rationale STs |
| Annex E | PP/PP-Configuration conformance |
What are the key requirements of SIST EN ISO/IEC 15408-1:2026?
SIST EN ISO/IEC 15408-1:2026 is the framework document that explains how to describe a security problem, turn it into security objectives and security requirements, and then evaluate a TOE against those requirements. The main practical point is that every claim in a PP, PP-Configuration or ST has to be traceable and consistent.
Security problem and security objectives
Clause 7 requires a security problem definition (SPD) that can include threats, organizational security policies (OSPs) and assumptions. It then maps that SPD to security objectives for the TOE and for the operational environment.
This matters because the evaluator has to see how the stated threats and policies are addressed. The document expects tracing between the SPD, the objectives and the later requirements, so authors have to justify why each objective exists and what it protects.
Clause 7 also distinguishes Security Functional Requirements (SFRs) from Security Assurance Requirements (SARs). SFRs say what the TOE shall do, while SARs say what evidence and confidence are needed in the evaluation. In practice, a good ST or PP needs both: function and assurance.
Security components and dependencies
Clause 8 defines the hierarchy of class, family, component and element. It also describes the allowed operations on components - iteration, assignment, selection and refinement.
That matters when a writer builds requirements from standard components in ISO/IEC 15408-2 and ISO/IEC 15408-3. If a requirement depends on another component, the dependency has to be met by an included component, a higher component, or a documented justification. This keeps packages, PPs and STs complete instead of partly specified.
Clause 8 also allows extended components. That is important when a product needs a requirement that is not covered by the standard catalogues, but the author still wants to stay within the Common Criteria structure.
Packages, PPs and conformance claims
Clause 9 defines a package as a named set of security components or security requirements intended for reuse. Packages may be functional or assurance packages, and the document allows them to carry evaluation method or activity references derived from ISO/IEC 18045.
Clause 10 explains how a PP describes a general TOE type. A PP can be used as a template for STs, as a template for other PPs, or as a base PP for a PP-Module. The conformance language is important in practice: a PP may claim ISO/IEC 15408-2 and ISO/IEC 15408-3 conformance, package conformance, and PP conformance, and it must state whether conformance is exact, strict or demonstrable.
PP-Modules, PP-Configurations and multi-assurance
Clause 11 introduces modular construction through PP-Modules and PP-Configurations. This is what lets authors describe a family of related security needs without rewriting everything from scratch.
The practical distinction is between single-assurance and multi-assurance evaluations. In a multi-assurance evaluation, one global set of SARs applies to the whole TOE, but each sub-TSF can also have its own SARs. This matters when different parts of the TOE need different assurance levels, because the structure of the PP-Configuration and the ST has to reflect that clearly.
Security Targets, evaluation and composition
Clause 12 defines the ST as the document for a specific TOE. It contains the TOE description, the conformance claims, the SPD, the security objectives, the SFRs, the SARs and the TOE summary specification.
Clause 13 then sets out the evaluation types: PP evaluation, PP-Configuration evaluation, ST evaluation and TOE evaluation. It also explains that evaluations should be performed within an evaluation scheme and that methods may come from ISO/IEC 18045 or from derived evaluation methods and activities.
Clause 14 covers composition of assurance, including layered, network or bi-directional, and embedded composition models. This matters for products built from evaluated parts, because the standard provides two reuse paths: composed evaluation and composite evaluation.
What terms does SIST EN ISO/IEC 15408-1:2026 define?
- Target of Evaluation (TOE) - the IT product, or part of a product, that is being evaluated.
- Security Target (ST) - the document that describes one specific TOE, its security problem, objectives, requirements and conformance claims.
- Protection Profile (PP) - a reusable template for a TOE type, including the security problem and the security requirements for that type.
- PP-Module - a modular building block used with a base PP to build a PP-Configuration.
- PP-Configuration - a set of PPs and PP-Modules combined into a modular security description for an ST.
- Security Functional Requirements (SFRs) - the functional security requirements that specify what the TOE shall do.
- Security Assurance Requirements (SARs) - the requirements that provide grounds for confidence that the TOE meets the SFRs.
- Evaluation Assurance Level (EAL) - a named assurance package representing a point on a predefined assurance scale.
Who uses SIST EN ISO/IEC 15408-1:2026?
SIST EN ISO/IEC 15408-1:2026 is used by several groups that work with evaluated IT products:
- Consumers or risk owners - to express security needs and judge whether an evaluated product fits those needs
- Developers - to write STs, build PPs, and prepare evidence for evaluation
- Evaluators - to assess PPs, PP-Configurations, STs and TOEs against defined criteria
- Evaluation authorities and certifying bodies - to run schemes, review evaluation results and issue judgments
- Technical working groups and user communities - to agree on a common TOE type and its security baseline
- Purchasing organizations - to define security requirements in procurement and compare products against a common reference
What changed in SIST EN ISO/IEC 15408-1:2026 from the previous edition?
SIST EN ISO/IEC 15408-1:2026 is the fifth edition and replaces ISO/IEC 15408-1:2022. The European adoption also supersedes EN ISO/IEC 15408-1:2023.
The changes stated in the document are:
- terminology has been reviewed and updated
- the package conformance claim for Security Targets, Protection Profiles and PP-Modules has been reviewed and aligned with ISO/IEC 18045
- the specification of multiple PP-Modules Bases has been improved for accuracy
- mistakes have been corrected
Which standards are used with SIST EN ISO/IEC 15408-1:2026?
| Standard | What it contributes |
|---|---|
| ISO/IEC 15408-2:2026 | The catalog of security functional components used to build SFRs |
| ISO/IEC 15408-3:2026 | The security assurance components and the evaluation criteria for PPs, STs and TOEs |
| ISO/IEC 18045 | The baseline methodology for IT security evaluation |
| ISO/IEC IEEE 24765:2017 | Vocabulary used for some shared systems and software engineering terms |
| ISO/IEC 15408-4 | The framework for deriving evaluation methods and evaluation activities from ISO/IEC 18045 |
| ISO/IEC 15408-5 | Pre-defined packages, including EALs and CAPs |
What does the SIST EN ISO/IEC 15408-1:2026 document contain?
SIST EN ISO/IEC 15408-1:2026 contains the conceptual model for IT security evaluation, including assets, threats, security controls, the TOE, and the relationship between confidence and evaluation. The figures in the document explain the security concepts, the evaluation relationships, the evaluation flow, and an example of a multi-assurance ST.
It also contains the procedural structure for building and evaluating PPs, PP-Configurations, STs and TOEs. Clause 7 covers security problem definition, objectives and requirements; Clause 8 covers security components and their operations; Clause 9 covers packages; Clauses 10 to 12 cover PPs, modular requirements, PP-Configurations and STs; Clause 13 covers evaluation and results; and Clause 14 covers assurance composition.
Annexes A to E provide the detailed content rules and conformance rules that support drafting and evaluation. In practice, these annexes are what authors and evaluators use when preparing a package, PP, PP-Module, PP-Configuration or ST for review.
Relations
- Effective Date
- 01-Oct-2026
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
SIST EN ISO/IEC 15408-1:2026 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 1: Introduction and general model (ISO/IEC 15408-1:2026)". This standard covers: This document establishes the general concepts and principles of information technology (IT) security evaluation. It specifies the general model of evaluation given in this document, which in its entirety is intended to be used as the basis for evaluation of security properties of IT products. This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various parts of the ISO/IEC 15408 series i.e. defines the terms and abbreviations used in all parts of the series; establishes the core concept of a Target of Evaluation (TOE); describes the evaluation context; and describes the audience to which the evaluation criteria is addressed. Additionally, this document introduces the basic security concepts necessary for the evaluation of IT products.
This document establishes the general concepts and principles of information technology (IT) security evaluation. It specifies the general model of evaluation given in this document, which in its entirety is intended to be used as the basis for evaluation of security properties of IT products. This document provides an overview of all parts of the ISO/IEC 15408 series. It describes the various parts of the ISO/IEC 15408 series i.e. defines the terms and abbreviations used in all parts of the series; establishes the core concept of a Target of Evaluation (TOE); describes the evaluation context; and describes the audience to which the evaluation criteria is addressed. Additionally, this document introduces the basic security concepts necessary for the evaluation of IT products.
SIST EN ISO/IEC 15408-1:2026 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
SIST EN ISO/IEC 15408-1:2026 has the following relationships with other standards: It is inter standard links to SIST EN ISO/IEC 15408-1:2024. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
SIST EN ISO/IEC 15408-1:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-oktober-2026
Nadomešča:
SIST EN ISO/IEC 15408-1:2024
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Merila za
vrednotenje varnosti IT - 1. del: Uvod in splošni model (ISO/IEC 15408-1:2026)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT
security - Part 1: Introduction and general model (ISO/IEC 15408-1:2026)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Evaluationskriterien für IT-Sicherheit - Teil 1: Einführung und allgemeines Modell
(ISO/IEC 15408-1:2026)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères
d'évaluation pour la sécurité des technologies de l'information - Partie 1: Introduction et
modèle général (ISO/IEC 15408-1:2026)
Ta slovenski standard je istoveten z: EN ISO/IEC 15408-1:2026
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN ISO/IEC 15408-1
NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2026
ICS 35.030
Supersedes EN ISO/IEC 15408-1:2023
English version
Information security, cybersecurity and privacy protection
- Evaluation criteria for IT security - Part 1: Introduction
and general model (ISO/IEC 15408-1:2026)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Critères d'évaluation pour la sécurité der Privatsphäre - Evaluationskriterien für IT-
des technologies de l'information - Partie 1: Sicherheit - Teil 1: Einführung und allgemeines Modell
Introduction et modèle général (ISO/IEC 15408- (ISO/IEC 15408-1:2026)
1:2026)
This European Standard was approved by CEN on 14 March 2026.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2026 CEN/CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 15408-1:2026 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3
European foreword
This document (EN ISO/IEC 15408-1:2026) has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology" in collaboration with Technical Committee CEN-CENELEC/ JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by November 2026, and conflicting national standards
shall be withdrawn at the latest by November 2026.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 15408-1:2023.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC
websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 15408-1:2026 has been approved by CEN-CENELEC as EN ISO/IEC 15408-1:2026
without any modification.
International
Standard
ISO/IEC 15408-1
Fifth edition
Information security, cybersecurity
2026-05
and privacy protection —
Evaluation criteria for IT security —
Part 1:
Introduction and general model
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies
de l'information —
Partie 1: Introduction et modèle général
Reference number
ISO/IEC 15408-1:2026(en) © ISO/IEC 2026
ISO/IEC 15408-1:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 15408-1:2026(en)
Contents Page
Foreword .vi
Introduction .vii
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms .13
5 Overview . 14
5.1 General .14
5.2 ISO/IEC 15408 series audience .14
5.2.1 General .14
5.2.2 Consumers (Risk owners) .14
5.2.3 Developers.14
5.2.4 Technical working groups . 15
5.2.5 Evaluators. 15
5.2.6 Others . 15
5.3 Target of evaluation (TOE) .17
5.3.1 General .17
5.3.2 TOE boundaries .18
5.3.3 Different representations of the TOE .18
5.3.4 Different configurations of the TOE .18
5.3.5 Operational environment of the TOE .19
5.4 Presentation of material in this document .19
6 General model . 19
6.1 Background .19
6.2 Assets and security controls . 20
6.3 Core constructs of the paradigm of the ISO/IEC 15408 series . 22
6.3.1 General . 22
6.3.2 Conformance types . 23
6.3.3 Communicating security requirements. 23
6.3.4 Meeting the needs of consumers (risk owners) . 26
7 Specifying security requirements .27
7.1 Security problem definition (SPD) .27
7.1.1 General .27
7.1.2 Threats .27
7.1.3 Organizational security policies (OSPs) . 28
7.1.4 Assumptions . 28
7.2 Security objectives . 29
7.2.1 General . 29
7.2.2 Security objectives for the TOE . 29
7.2.3 Security objectives for the operational environment . 29
7.2.4 Relation between security objectives and the SPD . 30
7.2.5 Tracing between security objectives and the SPD . 30
7.2.6 Providing a justification for the tracing .31
7.2.7 On countering threats.31
7.2.8 Security objectives: conclusion .31
7.3 Security requirements . .31
7.3.1 General .31
7.3.2 Security Functional Requirements (SFRs) .32
7.3.3 Security assurance requirements (SARs) . 34
7.3.4 Security requirements: conclusion . 35
8 Security components .36
8.1 Hierarchical structure of security components . 36
© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 15408-1:2026(en)
8.1.1 General . 36
8.1.2 Class . 36
8.1.3 Family . 36
8.1.4 Component . 36
8.1.5 Element . 36
8.2 Operations .37
8.2.1 General .37
8.2.2 Iteration .37
8.2.3 Assignment . 38
8.2.4 Selection . 39
8.2.5 Refinement . . 40
8.3 Dependencies between components .41
8.4 Extended components.42
8.4.1 General .42
8.4.2 Defining extended components .42
9 Packages .43
9.1 General .43
9.2 Package types . 44
9.2.1 General . 44
9.2.2 Assurance packages . 44
9.2.3 Functional packages . 44
9.3 Package dependencies .45
9.4 Evaluation method(s) and activities.45
10 Protection Profiles (PPs) .45
10.1 General .45
10.2 PP introduction . 46
10.3 Conformance claims and conformance statements. 46
10.4 Security assurance requirements (SARs) . 48
10.5 Additional requirements common to strict and demonstrable conformance . 49
10.5.1 Conformance claims and conformance statements . 49
10.5.2 Security problem definition (SPD) . 49
10.5.3 Security objectives . 49
10.6 Additional requirements specific to strict conformance . 49
10.6.1 Requirements for the security problem definition (SPD) . 49
10.6.2 Requirements for the security objectives . 50
10.6.3 Requirements for the security requirements . . 50
10.7 Additional requirements specific to demonstrable conformance . 50
10.8 Additional requirements specific to exact conformance . 50
10.8.1 General . 50
10.8.2 Conformance claims and conformance statements .51
10.9 Using PPs .51
10.10 Conformance statements and claims in the case of multiple PPs .52
10.10.1 General .52
10.10.2 Where strict or demonstrable conformance is specified .52
10.10.3 Where exact conformance is specified .52
11 Modular requirements construction .52
11.1 General .52
11.2 PP-Modules.52
11.2.1 General .52
11.2.2 PP-Module Base . 53
11.2.3 Requirements for PP-Modules . 53
11.3 PP-Configurations . . 56
11.3.1 General . 56
11.3.2 Requirements for PP-Configurations .57
11.3.3 Usage of PP-Configurations .62
12 Security Targets (STs) .65
12.1 General . 65
© ISO/IEC 2026 – All rights reserved
iv
ISO/IEC 15408-1:2026(en)
12.2 Conformance claims and conformance statements. 66
12.3 Assurance requirements . 68
12.4 Additional requirements in the exact conformance case . 69
12.4.1 Additional requirements for the conformance claim . 69
12.4.2 Additional requirements for the SPD . 69
12.4.3 Additional requirements for the security objectives. 69
12.4.4 Additional requirements for the security requirements . 69
12.5 Additional requirements in the multi-assurance case .70
13 Evaluation and evaluation results .71
13.1 General .71
13.2 Evaluation context . 73
13.3 Evaluation of PPs and PP-Configurations . 73
13.4 Evaluation of STs .74
13.5 Evaluation of TOEs .74
13.6 Evaluation methods and evaluation activities . 75
13.7 Evaluation results . 75
13.7.1 Results of a PP evaluation . 75
13.7.2 Results of a PP-Configuration evaluation . 75
13.7.3 Results of an ST/TOE evaluation. 75
13.8 Multi-assurance evaluation .76
14 Composition of assurance .77
14.1 General . 77
14.2 Composition models . 77
14.2.1 Layered composition model . 77
14.2.2 Network or bi-directional composition model . 78
14.2.3 Embedded composition model . 79
14.3 Evaluation techniques for providing assurance in composition models . 79
14.3.1 General . 79
14.3.2 ACO class for composed TOEs . 80
14.3.3 Composite evaluation for composite products . 80
14.4 Requirements for evaluations using composition techniques .91
14.4.1 Re-use of evaluation results .91
14.4.2 Composition evaluation issues . 92
14.5 Evaluation by composition and multi-assurance. 93
Annex A (normative) Specification of packages .94
Annex B (normative) Specification of Protection Profiles (PPs) .98
Annex C (normative) Specification of PP-Modules and PP-Configurations .107
Annex D (normative) Specification of Security Targets (STs) and direct rationale STs .121
Annex E (normative) PP/PP-Configuration conformance .132
Bibliography .137
© ISO/IEC 2026 – All rights reserved
v
ISO/IEC 15408-1:2026(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection, in collaboration with the
European Committee for Standardization (CEN) Technical Committee CEN/CLC/JTC 13, Cybersecurity and
data protection, in accordance with the Agreement on technical cooperation between ISO and CEN (Vienna
Agreement).
This fifth edition cancels and replaces the fourth edition (ISO/IEC 15408-1:2022), which has been technically
revised.
The main changes are as follows:
— the terminology has been reviewed and updated;
— the package conformance claim for Security Targets, Protection Profiles and PP-Modules, respectively,
has been reviewed and aligned with ISO/IEC 18045;
— the specification of multiple PP-Modules Bases has been improved for accuracy;
— corrections of mistakes.
A list of all parts in the ISO/IEC 15408 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
© ISO/IEC 2026 – All rights reserved
vi
ISO/IEC 15408-1:2026(en)
Introduction
The ISO/IEC 15408 series permits comparability between the results of independent security evaluations
by providing a common set of requirements for the security functionality of IT products and for assurance
measures applied to these IT products during a security evaluation. These IT products may be implemented
in hardware, firmware, or software.
The evaluation process establishes a level of confidence that the security functionality of these IT products
and the assurance applied to these IT products meet relevant requirements.
The evaluation results can help consumers to determine whether these IT products fulfil their security
needs.
The ISO/IEC 15408 series is useful as a guide for the development, evaluation or procurement of IT products
with security functionality.
The ISO/IEC 15408 series is intentionally flexible, enabling a range of evaluation approaches to be applied to
a range of security properties of a range of IT products. Therefore, users of this document are recommended
to ensure that this flexibility is not misused. For example, using the ISO/IEC 15408 series in conjunction
with unsuitable evaluation methods/activities, irrelevant security properties, or inappropriate IT products,
can result in meaningless evaluation results.
Consequently, the fact that an IT product has been evaluated has meaning only in the context of the security
properties that were evaluated and the evaluation methods that were used. Evaluation authorities are
advised to carefully check the products, properties, and methods to determine that an evaluation provides
meaningful results. Additionally, purchasers of evaluated products are advised to carefully consider this
context to determine whether the evaluated product is useful and applicable to their specific situation and
needs.
The ISO/IEC 15408 series addresses the protection of assets from unauthorized disclosure, modification,
or loss of use. The categories of protection relating to these three types of failure of security are commonly
called confidentiality, integrity and availability. The ISO/IEC 15408 series can also be applicable to aspects
of IT security outside of these three categories. The ISO/IEC 15408 series is applicable to risks arising from
human activities (malicious or otherwise) and to risks arising from non-human activities. The ISO/IEC 15408
series may be applied in other areas of IT but makes no claim of applicability in these areas.
The ISO/IEC 15408 series is presented as a set of distinct but related parts as identified below.
a) ISO/IEC 15408-1 is the introduction to the ISO/IEC 15408 series. It defines the general concepts and
principles of IT security evaluation and presents a general model of evaluation.
b) ISO/IEC 15408-2 establishes a set of functional components that serve as standard templates upon which
security functional requirements (SFRs) for Target of Evaluations (TOEs) are based. ISO/IEC 15408-2
catalogues the set of security functional components and organizes them into families and classes.
c) ISO/IEC 15408-3 establishes a set of assurance components that serve as standard templates upon
which security assurance requirements for TOEs are based. ISO/IEC 15408-3 catalogues the set of
security assurance components and organizes them into families and classes. ISO/IEC 15408-3 also
defines evaluation criteria for PPs, STs and TOEs.
d) ISO/IEC 15408-4 provides a standardized framework for the specification of evaluation methods and
activities that may be included in PPs, STs and any documents supporting them, to be used by evaluators
in support of evaluations using the model described in the other parts of the ISO/IEC 15408 series.
ISO/IEC 18045 is fundamental to ISO/IEC 15408-4.
e) ISO/IEC 15408-5 provides packages of security assurance and SFRs that have been identified as useful
in support of common usage by stakeholders. Examples of provided packages include the evaluation
assurance levels (EAL) and the composed assurance packages (CAPs).
NOTE 1 ISO/IEC 18045 provides the baseline methodology for IT security evaluations performed in accordance
with the ISO/IEC 15408 series.
© ISO/IEC 2026 – All rights reserved
vii
ISO/IEC 15408-1:2026(en)
Certain topics, which involve specialized techniques or are somewhat peripheral to IT security, are
considered to be outside the scope of the ISO/IEC 15408 series. The following list of topics are not covered
by the ISO/IEC 15408 series:
f) security evaluation criteria pertaining to administrative security measures not related directly to the IT
security functionality. However, it is recognized that significant security can often be achieved through
or supported by administrative measures such as organizational, personnel, physical, and procedural
controls;
g) the evaluation methodology under which the criteria should be applied;
NOTE 2 The baseline methodology is defined in ISO/IEC 18045. ISO/IEC 15408-4 can be used to further derive
evaluation activities and methods from ISO/IEC 18045.
h) administrative and legal framework under which the criteria can be applied by evaluation authorities.
However, it is expected that the ISO/IEC 15408 series is intended to be used for evaluation purposes in
the context of such a framework;
i) the procedures for use of evaluation results in accreditation. Accreditation is the administrative
process whereby authority is granted for the operation of an IT product (or collection thereof) in its
full operational environment including all of its non-IT parts. The results o
...