ISO/IEC TS 9569:2023

Overview

ISO/IEC TS 9569:2023 - "Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Patch Management Extension for the ISO/IEC 15408 series and ISO/IEC 18045" - is a technical specification that extends Common Criteria evaluation practices to cover patch management (PAM). It provides security assurance requirements focused on the initial target of evaluation (TOE) and the product life‑cycle processes used by manufacturers, and gives evaluators guidance to assess patch and development processes that support ongoing patching. The document does not prescribe test activities on the final, patched TOE; instead it enables assurance through lifecycle evidence and process evaluation.

Key topics and requirements

• Definition of a new patch management assurance family (ALC_PAM) aligned with the ISO/IEC 15408 structure, including objectives, component levelling and application notes.
• Evaluation work units for patch management (e.g., ALC_PAM.1 and associated actions) to guide how evidence and assurance are collected during initial evaluation.
• Guidance for evaluators across assurance classes (ASE, ADV, AGD, ALC, ATE, AVA) to incorporate patch‑related evidence into existing Common Criteria assessments.
• Practical artifacts and aids contained in annexes:
  • Annex A: options for evaluation authorities and scheme implementation approaches.
  • Annex B: template for a security relevance report.
  • Annex C / D: examples of patch management documentation and a functional package.
• Terminology and lifecycle concepts such as activation, final TOE, end‑of‑support, and how assurance continuity can be maintained when patches are issued.

Applications and who should use it

ISO/IEC TS 9569:2023 is intended for:

• Evaluation authorities and certification bodies looking to adopt standardized methods for assessing vendor patch processes and enabling more efficient re‑certification of patched products.
• Product developers and manufacturers who need to demonstrate robust patch management processes (design, distribution, activation, and lifecycle support) to support assurance continuity.
• Security architects, vulnerability management teams and procurement officers who require standardized assurance evidence when acquiring or operating IT products.
• Mutual recognition arrangements (e.g., Common Criteria Recognition) seeking options to harmonize how patched TOEs are handled across schemes.

Practical benefits include reducing re‑certification effort for patched products, improving transparency of vendor processes, and strengthening assurance that lifecycle patching preserves security properties.

Related standards

• ISO/IEC 15408 (Common Criteria for IT security evaluation) - baseline evaluation framework extended by this TS.
• ISO/IEC 18045 - evaluation methodology referenced and complemented by this technical specification.

Keywords: ISO/IEC TS 9569:2023, patch management, ALC_PAM, Common Criteria, ISO/IEC 15408, ISO/IEC 18045, TOE evaluation, security assurance, patch lifecycle.