ISO/IEC 15408-5:2022

Overview

ISO/IEC 15408-5:2022 is Part 5 of the Common Criteria family for information security, cybersecurity and privacy protection. It defines pre‑defined packages of security assurance and security functional requirements that stakeholders commonly use when specifying or evaluating IT products (Targets of Evaluation, TOEs). The standard supplies ready‑made assurance packages - including Evaluation Assurance Levels (EALs), Composed Assurance Packages (CAPs), a Composite Product (COMP) package, and assurance families for Protection Profiles (PPA) and Security Targets (STA) - to streamline, harmonize and make evaluations more predictable.

Key topics and requirements

• Evaluation Assurance Levels (EAL1–EAL7): a scale of assurance where each EAL specifies a pre‑defined set of assurance components.
  • EAL1 - Functionally tested
  • EAL2 - Structurally tested
  • EAL3 - Methodically tested and checked
  • EAL4 - Methodically designed, tested and reviewed
  • EAL5 - Semi‑formally verified design and tested
  • EAL6 - Semi‑formally verified design and tested (higher rigor)
  • EAL7 - Formally verified design and tested
• Composed Assurance Packages (CAPs): packages tailored for systems composed of multiple components or subsystems. Examples in the standard:
  • CAP A - Structurally composed
  • CAP B - Methodically composed
  • CAP C - Methodically composed, tested and reviewed
• Composite Product (COMP) package: defines assurance components for evaluating composite products made from independently evaluated parts.
• PPA & STA families: predefined assurance sets for Protection Profile and Security Target evaluations, including direct rationale and standard package variants.
• Normative links: aligns with ISO/IEC 15408‑1 (general model) and ISO/IEC 15408‑3 (assurance components).

Applications and who uses it

• Procurement officers / consumers: specify required EALs or CAPs in RFPs to ensure predictable assurance levels.
• Product developers: use packages to design evidence and processes that meet an intended assurance level, reducing development and evaluation effort.
• Evaluation labs / certifiers: apply the predefined packages to assess TOEs consistently against Common Criteria expectations.
• PP and ST authors: leverage PPA/STA packages to simplify and harmonize requirement sets for profiles and targets.

Related standards

• ISO/IEC 15408‑1:2022 - Introduction and general model (normative)
• ISO/IEC 15408‑3:2022 - Security assurance components (normative)
• Common Criteria (CC) material referenced by national certification schemes

Using ISO/IEC 15408-5:2022 helps organizations standardize assurance claims, reduce duplicated effort when creating Protection Profiles and Security Targets, and increase comparability of security evaluations across vendors and evaluators. Keywords: ISO/IEC 15408-5:2022, Common Criteria, EAL, CAP, composite product, protection profile, security target, cybersecurity, security assurance.