Overview
ISO/IEC 19896-1:2018 - part of the ISO/IEC 19896 series - provides the foundational concepts, terms and general requirements for defining competence requirements for information security testers and evaluators. It establishes a common framework and vocabulary to describe the knowledge, skills, experience, education and effectiveness needed by professionals who perform IT product security conformance testing and evaluations. The standard is intended to support consistent, repeatable assessment outcomes and mutual recognition of security assurance results across laboratories and approval authorities.
Key Topics and Requirements
- Terms and definitions: Clarifies essential vocabulary (competence, conformance-tester, evaluator, knowledge, skill, experience, effectiveness, laboratory).
- Concepts: Explains why minimum competence matters for conformity, repeatability and mutual recognition in IT security testing and evaluation.
- Elements of competence: Defines the components used to assess competence:
- Knowledge (e.g., relevant assurance standards, testing/evaluation methods, policies, IT product architecture)
- Skills (task-specific abilities)
- Experience (practical project involvement)
- Education (formal instruction)
- Effectiveness (behavioural attributes such as communication, initiative, teamwork, leadership)
- Competency levels: Describes a structured progression of competence (Level 1 Associate, Level 2 Professional, Level 3 Manager, Level 4 Principal) to align responsibilities and expected capabilities.
- Measurement and records: Guidance for assessing and recording elements of competence (knowledge, skills, experience, education, effectiveness) to support laboratory personnel management and accreditation.
- Supporting annexes: Informative frameworks and example records to help implement competence descriptions and evidence.
Applications and Users
ISO/IEC 19896-1:2018 is practical for organizations and professionals involved in IT security assurance and conformance testing:
- Information security testers and evaluators seeking a baseline for professional competence.
- Testing and evaluation laboratories (ITSEFs, CCTLs, CLEFs) developing personnel competence policies and records.
- Approval authorities and accreditation bodies that assess laboratory personnel competence and conformity.
- Vendors and technology providers preparing products for security evaluation and wanting to understand tester qualifications.
- Credentialing organizations designing recognition schemes for security-testing professionals.
Adopting this standard helps organizations align personnel qualifications with recognized competence levels, improve repeatability of test results, and strengthen trust in IT product security assurance.
Related Standards
- ISO/IEC 17025 (competence of testing laboratories) - referenced as a basis for laboratory competence requirements.
- ISO/IEC 19790 and ISO/IEC 24759 - related to conformance testing covered in subsequent parts of the 19896 series.
- ISO/IEC 15408 and ISO/IEC 18045 - evaluation standards referenced in later parts for evaluators.
Keywords: ISO/IEC 19896-1:2018, competence requirements, information security testers, information security evaluators, conformance testing, IT security techniques, competency levels, laboratory accreditation.