ISO/IEC 15408-2:2022

Overview

ISO/IEC 15408-2:2022 defines the required structure and content of security functional components used for IT security evaluation. Part 2 of the ISO/IEC 15408 evaluation criteria series provides a standardized catalogue of functional components that address common security functionality across a wide range of IT products. The fourth edition (2022) organizes components into classes, families and component levels to support consistent evaluation and specification of security capabilities.

Key topics and technical requirements

• Functional requirements paradigm - defines how functional components are structured, specified and combined for evaluation.
• Class, family and component structure - hierarchical organization allowing precise selection of security functional components for a product or security target.
• Component catalogue - a comprehensive list of predefined functional components (e.g., audit, communication, cryptographic support) that evaluators and vendors can reference.
• Representative classes and families (examples referenced in the document):
  • FAU (Security audit) - audit generation, storage, analysis, review and selection (FAU_GEN, FAU_STG, FAU_SAA, FAU_SAR, FAU_SEL, FAU_ARP).
  • FCO (Communication) - non-repudiation of origin and receipt (FCO_NRO, FCO_NRR).
  • FCS (Cryptographic support) - cryptographic key management and related cryptographic functions (FCS_CKM and related components).
• Management and audit expectations - component-level descriptions include management requirements and what must be auditable during evaluation.
• Leveling of components - components may be defined at multiple assurance/functional levels to match risk and product capability.

Practical applications - who uses this standard

• Security evaluators and certification bodies - to map product behaviour to standardized functional components during formal evaluation.
• Product developers and architects - to define, design and document security features that meet recognized evaluation criteria.
• Procurement and risk managers - to specify required security functionality in contracts and vendor assessments.
• Security testers and auditors - to verify that implemented features comply with the functional requirements and to plan test coverage.

Using ISO/IEC 15408-2 helps align product security claims with a recognized catalogue of functional requirements, simplifying certification, procurement and interoperability assessments.

Related standards

• Other parts of the ISO/IEC 15408 series (e.g., Part 1 - general model/introduction; Part 3 - security assurance components) and complementary IT security standards are commonly used alongside ISO/IEC 15408-2 for comprehensive security evaluation and compliance.

Keywords: ISO/IEC 15408-2:2022, security functional components, evaluation criteria for IT security, security audit, cryptographic key management, IT security evaluation.