ISO/IEC TR 22216:2022

Overview

ISO/IEC TR 22216:2022 is a technical report from ISO/IEC JTC 1/SC 27 that explains the new concepts and changes introduced in the revised evaluation standards ISO/IEC 15408:2022 and ISO/IEC 18045:2022. The report summarizes how the earlier Common Criteria (CC 3.1) and Common Evaluation Methodology (CEM 3.1) maps to the new document structure, presents the rationale for newly introduced concepts, and proposes an evolution path for organizations and evaluators migrating from CC 3.1/CEM 3.1 to the 2022 series.

Key Topics

• Structure and mapping: Clarifies the break-down of the former ISO/IEC 15408 series and ISO/IEC 18045:2008 into the new parts of ISO/IEC 15408:2022 and ISO/IEC 18045:2022, and provides transition guidance.
• New evaluation approaches: Describes the two primary approaches - attack-based and specification-based evaluation - and their application to security and privacy assessments.
• Modularity and composition: Introduces modular concepts such as composition mechanisms, packages, PP‑Modules (modular Protection Profiles) and PP‑Configurations, enabling reuse and scalable assurance for complex products and systems.
• Multi‑assurance evaluations: Covers evaluation by composition, multi-assurance TOEs, and methods to support multiple assurance needs across components.
• Refinement and derivation: Guidance on refining and deriving security requirements and evaluation methods (refinements, application notes, extended requirements).
• Transitional mapping: Detailed tables and figures mapping CC 3.1/CEM 3.1 constructs (PP, ST, TOE) to the ISO/IEC 15408:2022 series equivalents to support a smooth migration.

Applications

ISO/IEC TR 22216:2022 is practical for:

• Evaluators and certification labs preparing to assess products under the ISO/IEC 15408:2022 and ISO/IEC 18045:2022 frameworks.
• Security vendors and product developers designing TOEs, Protection Profiles, or modular components intended for evaluation and mutual recognition.
• Procurement and risk owners who need to specify assurance requirements and understand evaluation scope for complex systems (IoT gateways, mobile devices, composite TOEs).
• Standards bodies and accreditation organizations coordinating transition from CC 3.1/CEM 3.1 to the updated series.

Who should use it

• Security architects, evaluation authorities, conformity assessment bodies, product developers, and procurement specialists involved in information security, cybersecurity, and privacy protection assurance and certification.

Related standards

• ISO/IEC 15408:2022 (new Common Criteria series)
• ISO/IEC 18045:2022 (evaluation methodology)
• CC 3.1 and CEM 3.1 (previous Common Criteria and CEM editions)
• Common Criteria Recognition Arrangement (CCRA) and SOG‑IS MRA (context for mutual recognition)

Keywords: ISO/IEC TR 22216:2022, ISO/IEC 15408:2022, ISO/IEC 18045:2022, Common Criteria, cybersecurity, information security, protection profiles, attack-based evaluation, specification-based evaluation, modularity, multi-assurance.