Overview
ISO/IEC TR 15443-1:2012 is the first part of the ISO/IEC Technical Report that establishes a security assurance framework for IT. It defines terms, concepts and relationships needed for a shared understanding of IT security assurance and provides foundational material for the analytical model in ISO/IEC TR 15443-2. This Technical Report is informative (a TR) and reflects state‑of‑the‑art concepts applicable to assurance of security properties in IT deliverables.
Key Topics
The standard organizes and explains core concepts and components of security assurance, including:
- Terms and definitions and a concise glossary to standardize language across stakeholders.
- Fundamental concepts such as security assurance vs. confidence, the intangible nature of assurance, and how assurance reduces security risk.
- Stakeholders: those requesting assurance, approval/assurance authorities, assessors, acquirers and end‑users.
- Structure of assurance artefacts: assurance requirements, assurance claims, assurance arguments, assurance evidence, and assurance cases (how to develop and communicate them).
- SACA (Security Assurance Conformity Assessment) techniques and methods: effectiveness/evaluation, correctness/conformance, predictive assurance; how to select and combine techniques and methods.
- SACA paradigms and schemes: examples and models of assessment approaches and bodies (including references to Common Criteria, CMVP and Payment Card Industry models as illustrative paradigms).
- Composition and scalability: layering, network and component composition, reuse and integration issues when composing assurance for complex systems.
- Organisational and lifecycle considerations, tool support, ratings and outputs from SACA methods.
Applications
ISO/IEC TR 15443-1:2012 is practical guidance for professionals who need to create, evaluate or interpret security assurance, including:
- Security assurance authorities and approval bodies deciding on acceptance of IT deliverables.
- IT security architects, developers and integrators who must build and document assurance into systems.
- Assessors and conformity assessment bodies selecting or designing SACA methods and tools.
- Procurement teams, acquirers and end users requiring evidence-based confidence in security claims.
- Use cases include developing assurance cases, selecting appropriate assessment techniques, structuring evidence and arguments for certification or acquisition, and improving cross‑organizational understanding of assurance claims.
Related Standards
- ISO/IEC TR 15443-2 (Analysis) - framework model and method assessment
- ISO/IEC 15408 (Common Criteria), ISO/IEC 19790 (cryptographic modules), ISO/IEC 27001 (information security management) - referenced assurance methods and schemes
- ISO/IEC 15026, CASCO guidance and ISO/IEC 17000 - related assurance and conformity assessment guidance
Keywords: ISO/IEC TR 15443-1:2012, security assurance framework, IT security assurance, assurance case, SACA methods, security assurance evidence, Common Criteria, CMVP.