ISO/IEC 19896-2:2018

Overview

ISO/IEC 19896-2:2018 specifies competence requirements for individuals who test and evaluate cryptographic modules under conformance schemes based on ISO/IEC 19790 and ISO/IEC 24759. It defines minimum knowledge, skills, experience, education and effectiveness criteria to ensure consistent, comparable results across validation and certification projects involving cryptographic module security.

Key Topics

• Scope and structure: Organized around Knowledge, Skills, Experience, Education and Effectiveness to align personnel competence with conformance testing needs.
• Tertiary education / equivalent experience: Testers should have an associate, bachelor or higher degree in IT-related disciplines or demonstrate equivalent practical experience (minimum equivalent of 3 years study or experience).
• Technical specialities: Testers must have qualifications in at least one speciality; testing laboratories should cover all specialties across staff. Examples include:
  • Cryptographic concepts and algorithms
  • Software/firmware development (programming, compilers, debugging, unit/integration/regression testing)
  • Operating systems (installation, configuration, hardening, virtual machines)
  • Hardware development and manufacturing (single/multi-chip designs, packaging, manufacturing integrity)
  • Physical security testing, side-channel analysis, algorithm testing
• Standards knowledge: Explicit requirement to know ISO/IEC 19790 (security requirements for cryptographic modules), ISO/IEC 24759 (test requirements), and related standards such as ISO/IEC 17025, ISO/IEC 17825, ISO/IEC 18367, and test tool standards (ISO/IEC 20085 series).
• Supporting materials: Annexes include an example testers’ log, ontology of technology types, specific cryptographic module knowledge, and validator competence guidance.

Applications

• Validation and certification programs: Use the standard to define minimum tester qualifications for cryptographic module conformance testing.
• Accreditation and laboratory management: Establish personnel criteria to comply with ISO/IEC 17025 and to demonstrate technical competence during audits.
• Hiring and training: HR and training teams can map job descriptions, professional development, and credential requirements to the standard’s knowledge and skills areas.
• Test project staffing: Ensure appropriate mix of specialists (software, hardware, cryptography, physical security) to meet ISO/IEC 24759 test requirements and ISO/IEC 19790 objectives.
• Credentialing bodies: Design certification schemes and recognition programs for information security testers and evaluators.

Related Standards

• ISO/IEC 19790 - Security requirements for cryptographic modules (primary subject)
• ISO/IEC 24759 - Test requirements for cryptographic modules
• ISO/IEC 17025 - Competence of testing and calibration laboratories
• ISO/IEC 17825, 18367, 20085, 20543 - Complementary test and analysis methods

ISO/IEC 19896-2 is essential for organizations involved in cryptographic module testing, accreditation bodies, validators, certification authorities and security testing professionals seeking standardized, auditable competence criteria. Keywords: ISO/IEC 19896-2, cryptographic module testing, competence requirements, ISO/IEC 19790, ISO/IEC 24759, information security testers.