ISO 23195:2021

Overview

ISO 23195:2021 - Security objectives of information systems of third‑party payment services - defines a common terminology, two logical structural models, and a set of security objectives for information systems used by third‑party payment service providers (TPPSPs). The standard addresses the specific risks introduced by the intermediary role of TPPSPs (TPP), emphasizing protection of payment data integrity, confidentiality and non‑repudiation in open payment ecosystems. It is based on the ISO/IEC 15408 (Common Criteria) methodology and is independent of any specific payment instrument.

Key topics and requirements

• Terminology and scope: Clear definitions for TPP, TPPSP, ASPSP (account servicing payment service provider), PSU and related business terms to ensure consistent interpretation across stakeholders.
• Logical structural models: Two TPP‑centric models that clarify how assets flow and interact in an open ecosystem and where threats arise.
• Asset identification: Categorization of protected assets including user data, business configuration data, transaction input and transmitting data, and TPPSP technical security function (TSF) data.
• Threat analysis: Threat classes tied to the intermediary nature of TPPSPs - e.g., customer impersonation, data tampering, unauthorized disclosure, repudiation risks.
• Security objectives: Objectives to prevent unauthorized disclosure/change of business and transaction data; prevent counterfeiting and repudiation of inputs and transmissions; protect authentication data supplied by ASPSPs; generate auditable security logs.
• Assumptions and boundaries: The document treats some aspects (e.g., the security of communication channels and the TPPSP credential issuance lifecycle) as assumptions or out of scope while requiring implementers to address them in the operating environment.

Applications - who should use it

• TPPSPs and fintechs designing or operating third‑party payment platforms to define security requirements.
• Security architects and developers implementing transaction flows, authentication and logging.
• Banks / ASPSPs that integrate with TPPSPs and assess intermediary risks.
• Auditors, assessors and regulators evaluating compliance and risk mitigation measures for TPP services.
• Vendors and integrators producing middleware, gateways or APIs for TPP ecosystems.

Practical uses include threat modelling, specification of security controls for integrity, confidentiality and non‑repudiation, procurement requirements, conformity assessments and building auditable transaction trails.

Related standards

• ISO/IEC 15408 (Common Criteria) - methodology basis for security objectives and evaluation.
• ISO references cited in the standard include ISO 12812‑1 and ISO/TR 21941 for related payment terminology and concepts.

Keywords: ISO 23195:2021, third‑party payment, TPP, TPPSP, ASPSP, payment security, security objectives, information systems, payment data integrity, non‑repudiation, ISO/IEC 15408.