ISO/IEC 18045:2022

Overview

ISO/IEC 18045:2022 - Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Methodology for IT security evaluation - defines the minimum actions an evaluator must perform to conduct evaluations against the ISO/IEC 15408 series (Common Criteria). It provides a structured methodology for assessing security functionality and assurance, detailing the evaluation process, required evidence, evaluator roles, and expected outputs such as evaluation verdicts and the Evaluation Technical Report (ETR).

Keywords: ISO/IEC 18045:2022, IT security evaluation, Common Criteria, evaluation methodology, ISO/IEC 15408.

Key topics and technical requirements

• Evaluation process and tasks: describes input, sub‑activities, and output tasks; role responsibilities; and the general evaluation model.
• Evaluator actions and evidence management: minimum required actions for collecting, managing and re‑using evaluation evidence in accordance with ISO/IEC 15408 criteria.
• Evaluator deliverables: guidance on preparing evaluation outputs including the ETR and other reports (e.g., write OR sub‑task, write ETR sub‑task).
• Protection Profile (PP) evaluation (Class APE): requirements for evaluating full PPs, including conformance claims, security problem definition, objectives, extended components, and security requirements.
• Protection Profile Configuration (Class ACE): evaluation of PP‑module content, consistency and configuration conformance.
• Security Target (ST) evaluation (Class ASE): criteria for assessing ST introduction, conformance claims, security problem definitions, objectives, extended components, security requirements, and TOE summary specification.
• Development class (Class ADV): sections addressing security architecture and development‑related evaluation activities.
• Evaluator verdicts and consistency checks: standardized verdicts and methods to determine conformity with ISO/IEC 15408 evidence and criteria.

Keywords: security target evaluation, protection profile, TOE, evaluation evidence, evaluator verdicts.

Practical applications and target users

• Independent evaluators and testing laboratories - to apply a standardized methodology when conducting Common Criteria evaluations.
• Certification bodies and accreditation authorities - to ensure consistent evaluation practices and to verify evaluator outputs (ETRs).
• Product vendors and developers - to understand evaluator expectations when seeking Common Criteria certification for a TOE (Target of Evaluation).
• Procurement teams and security architects - to interpret evaluation reports and select products with verified security claims.
• Government and regulated sectors - for acquiring assurance‑rated IT products in compliance with national or international certification schemes.

Keywords: cybersecurity, information security, privacy protection, assurance, Common Criteria evaluation.

Related standards

• ISO/IEC 15408 (Common Criteria) - primary set of security functional and assurance requirements that ISO/IEC 18045 operationalizes.
• ISO/IEC 18045 complements the ISO/IEC 15408 series by providing the evaluation methodology and minimum evaluator actions required for consistent, reproducible security evaluations.