Overview
ISO/IEC 15408-4:2026 is an international standard, developed by ISO and IEC, that establishes a framework for the specification of evaluation methods and activities in IT security assessment. It forms part of the widely recognized ISO/IEC 15408 series, also known as the Common Criteria, focusing on information security, cybersecurity, and privacy protection. This document outlines the requirements for crafting objective, repeatable, and reproducible evaluation methods, ensuring consistency and comparability in IT product and system security evaluations across different contexts.
Critically, ISO/IEC 15408-4:2026 sets standards for describing evaluation methods but deliberately does not prescribe how such methods should be evaluated, adopted, or maintained. These responsibilities remain with organizations or communities designing the specific methods and activities appropriate to their domain or technology.
Key Topics
-
Standardized Framework: The standard provides a unified structure for specifying evaluation methods and activities, supporting clarity, traceability, and a harmonized approach across the IT security community.
-
Requirements for Specification: It defines mandatory elements such as unique identifiers, responsible entities, intended scope, dependencies, required inputs, tools, evaluator competences, reporting requirements, rationale, and the set of evaluation activities.
-
Objective, Repeatable, Reproducible Methods: By insisting on these qualities, the standard facilitates consistent and reliable IT security assessments, essential for regulatory compliance, certification, and international trust.
-
Modularity: The framework allows evaluation methods and activities to be derived for specific product types, technologies, or security functions-enabling detailed tailoring to contexts such as network devices, cryptographic modules, or updated firmware mechanisms.
-
Clear Terminology and Usage: Adherence to defined terminology, including strict verb usage and conventions, promotes transparency and alignment with broader standards like ISO/IEC 15408-1, 15408-2, 15408-3, and 18045.
Applications
-
Development of Protection Profiles (PPs): Organizations can define and reference evaluation methods and activities within protection profiles, ensuring that security functionality and assurance requirements are assessed consistently.
-
Certification Schemes: Certification bodies use this standard as a basis for developing evaluation methodologies, supporting the mutual recognition of certifications internationally.
-
Methodology Creation for Diverse Technologies: Enables security communities and standardization bodies to specify tailored evaluation schemes for emerging technologies and new application domains, such as IoT devices, biometric systems, or secure communications protocols.
-
Enhanced Security Assurance Activities: Facilitates the structured derivation and grouping of evaluation activities for security functional requirements (SFRs) and security assurance requirements (SARs), supporting comprehensive and rigorous IT security evaluations.
Related Standards
To ensure full understanding and effective implementation, ISO/IEC 15408-4:2026 should be used in conjunction with related standards:
- ISO/IEC 15408-1: Introduction and general model for information security and IT security evaluations.
- ISO/IEC 15408-2: Security functional components and requirements.
- ISO/IEC 15408-3: Security assurance components, detailing assurance classes, families, and evaluation criteria.
- ISO/IEC 18045: Methodology for IT security evaluation, providing generic work units and evaluation processes.
Practical Value
Applying ISO/IEC 15408-4:2026 helps organizations:
- Achieve consistency in the specification and application of IT security evaluation methods.
- Meet industry and regulatory expectations for transparent, auditable security evaluation processes.
- Support international recognition and comparability of IT security evaluations, facilitating global market access for certified products and solutions.
- Tailor evaluation approaches to specific technologies, product types, and evolving security threats, all within a rigorous, standards-based framework.
By following the frameworks and requirements outlined in ISO/IEC 15408-4:2026, stakeholders reinforce the integrity and credibility of IT security evaluations-strengthening trust in products, services, and infrastructures worldwide.
Open preview (PDF)Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Part 4: Framework for the specification of evaluation methods and activities