SIST EN ISO/IEC 15408-4:2024 PDF

Overview

EN ISO/IEC 15408-4:2023 - part of the Common Criteria family - defines a standardized framework for specifying Evaluation Methods (EMs) and Evaluation Activities (EAs) used in IT security, cybersecurity and privacy protection assessments. Aligned with ISO/IEC 15408-1 and ISO/IEC 18045, this part focuses on making evaluation methods objective, repeatable and reproducible so independent security evaluations are comparable across labs and certification schemes.

Key topics and requirements

• Framework scope: Provides a model to derive EMs and EAs from generic work units and group them for specific technologies, protection profiles (PPs), packages or Security Targets (STs).
• Structure of an Evaluation Method: Guidance on identification, ownership, scope, dependencies, required developer input, required tool types, evaluator competences, reporting requirements and rationale.
• Structure of an Evaluation Activity: Defines unique identification, objective, links to Security Functional Requirements (SFRs) and Security Assurance Requirements (SARs), required inputs, tool types, evaluator competences, assessment strategy, pass/fail criteria, reporting and rationale.
• Conventions and verb usage: Prescribes consistent language and conventions to ensure EMs/EAs are unambiguous and actionable.
• Goal: Ensure EMs/EAs are objective, repeatable, reproducible, and traceable to SFRs/SARs.

Keywords: EN ISO/IEC 15408-4:2023, Evaluation Methods, Evaluation Activities, Common Criteria, security evaluation, protection profiles, SFRs, SARs, ISO/IEC 18045.

Practical applications

• Creating or refining Protection Profiles (PPs) and Security Targets (STs) that reference specific evaluation methods and activities.
• Enabling certification bodies and independent laboratories to follow well-defined EMs/EAs for consistent security assessments.
• Defining technology-specific assessment activities (e.g., for cloud services, IoT devices or cryptographic modules) derived from generic CC guidance.
• Improving procurement and compliance by specifying measurable pass/fail criteria and reporting requirements in contract and certification documentation.
• Supporting reproducible testing and facilitating cross-lab comparability for conformity assessment and accreditation.

Who uses this standard

• Certification bodies and evaluators - to implement and report standardized evaluation activities.
• Protection profile authors and security architects - to specify concrete methods within PPs and STs.
• Developers and vendors - to understand required evidence, tool support and developer inputs for evaluation.
• Procurement officers and integrators - to reference objective evaluation methods in contracts and compliance checks.

Related standards

• EN ISO/IEC 15408-1 (Common Criteria: general model)
• ISO/IEC 18045 (companion methodology for assurance requirements)
• Other parts of the ISO/IEC 15408 series

Adopted by CEN as EN ISO/IEC 15408-4:2023 (SIST EN ISO/IEC 15408-4:2024 in Slovenia), this document helps harmonize evaluation practice and strengthens the reliability of IT security certification.