ISO/IEC 15408-3:2022

Overview

ISO/IEC 15408-3:2022 - part of the Common Criteria family - defines the security assurance components used to evaluate IT products and systems for information security, cybersecurity and privacy protection. This fourth edition specifies the assurance requirements from which evaluation assurance levels (EALs) and other assurance packages (referenced in ISO/IEC 15408-5) are composed. It also sets criteria for evaluating Protection Profiles (PPs), PP‑Configurations, PP‑Modules and Security Targets (STs).

Keywords: ISO/IEC 15408-3:2022, Common Criteria, security assurance components, evaluation assurance levels, Protection Profile, Security Target, IT security evaluation, cybersecurity assurance, privacy protection.

Key topics and requirements

• Assurance paradigm and approach: explains the assurance model, significance and causes of vulnerabilities, and how assurance is provided through evaluation.
• Evaluation assurance scale: establishes the framework used to map components into EALs and assurance packages.
• Assurance class structure: organizes components into classes and families with clear naming, introductions and application notes.
• Assurance family and component structure: defines family objectives, component levelling, dependencies, application guidance and component identification.
• Assurance elements: the low‑level building blocks that form components and support consistent evaluation evidence.
• Component taxonomy and levelling: provides a consistent taxonomy and levels for tailoring assurance requirements to different evaluation scopes.
• Evaluation criteria for PPs, PP‑Modules, PP‑Configurations and STs: includes classes such as APE (Protection Profile evaluation), ACE (PP‑Module/Configuration evaluation) and ASE (Security Target evaluation) with specific component objectives (e.g., introductions, conformance claims, problem definitions, objectives, requirements and consistency checks).

Applications

• Developing and writing Protection Profiles (PPs), PP‑Modules and Security Targets (STs) that meet internationally recognized assurance criteria.
• Structuring product or system evaluations for certification against Common Criteria and demonstrating appropriate assurance to customers or regulators.
• Designing security assurance packages and mapping assurance evidence to evaluation assurance levels (EALs) for procurement or compliance.
• Informing secure product development lifecycle practices where formal assurance evidence is required.

Who uses this standard

• Certification bodies and evaluation laboratories performing Common Criteria evaluations
• Product vendors and system integrators preparing PPs or STs
• Security architects, assurance engineers and QA teams producing evaluation evidence
• Procurement officers and compliance teams specifying assurance requirements
• Regulators and auditors assessing security claims

Related standards

• ISO/IEC 15408 series (Common Criteria) - Parts 1, 2 and 5 are directly related
• ISO/IEC 15408-5 (assurance packages and EAL composition) - referenced by this part

ISO/IEC 15408-3:2022 is essential for anyone involved in formal IT security evaluation, providing the detailed assurance component definitions needed to achieve repeatable, auditable cybersecurity and privacy assurance.