Overview
ISO/IEC 18045:2026 is an international standard providing requirements and methodology for the evaluation of IT security. Developed by ISO and IEC, this standard ensures a consistent approach to assessing information security, cybersecurity, and privacy protection in IT systems. ISO/IEC 18045:2026 outlines the procedures and minimum actions required of evaluators, supporting the implementation of the Common Criteria (ISO/IEC 15408 series) in IT security evaluations. The standard is designed to improve the reliability, transparency, and trustworthiness of security evaluations for a wide range of IT products and solutions.
Key Topics
ISO/IEC 18045:2026 addresses the following essential areas:
- Evaluation Process Guidance
Provides an overview of the evaluation process, including general principles, evaluator responsibilities, and evaluation models.
- Evidence and Documentation Management
Details the handling, assessment, and management of evaluation evidence, including Protection Profiles (PP), Security Targets (ST), and development artefacts.
- Assessment of Security Criteria
Outlines the methodology to verify and validate security functionality, security problem definitions, objectives, and requirements across IT systems.
- Testing and Vulnerability Analysis
Specifies rigorous methods for conducting security testing, coverage analysis, depth assessment, and vulnerability evaluation.
- Life Cycle and Configuration Management
Covers requirements for the management of IT product life cycles, configuration management, flaw remediation, and secure development practices.
- Composition and Integration
Provides guidance on evaluating composite and integrated IT components and systems, including their dependencies and interaction.
Applications
ISO/IEC 18045:2026 is applicable for organizations, IT product developers, and evaluators seeking a formalized, internationally recognized approach to IT security certification:
- Product Certification
Used by evaluation laboratories and certification bodies as the technical basis for certifying IT products and systems in compliance with the Common Criteria.
- Procurement and Supply Chain
Enables organizations to assess the security assurance of third-party products and select suitable solutions for critical applications.
- Regulatory Compliance
Supports meeting regulatory requirements in information security, cybersecurity, and privacy by providing a recognized evaluation methodology.
- System Integrators and Developers
Assists in the design, development, and maintenance of secure IT products by highlighting evaluation-ready artifacts and processes.
- Risk Management
Enhances an organization’s risk management and due diligence activities by relying on independent security evaluations.
Related Standards
ISO/IEC 18045:2026 is closely aligned with, and often used in conjunction with, the following standards:
- ISO/IEC 15408 series (Common Criteria for IT Security Evaluation)
Defines the criteria and framework for evaluating the security properties of IT products.
- ISO/IEC 27001 (Information Security Management Systems)
Provides requirements for establishing, implementing, maintaining, and improving information security management within organizations.
- ISO/IEC 29147 (Vulnerability Disclosure)
Covers the processes for managing and disclosing IT system vulnerabilities.
- ISO/IEC 19790 (Security Requirements for Cryptographic Modules)
Specifies requirements for the design and evaluation of secure cryptographic systems.
Conclusion
By providing a structured methodology for the evaluation of IT security, ISO/IEC 18045:2026 boosts confidence in digital products and systems. Adoption of this standard facilitates consistent, transparent, and reproducible evaluation outcomes, supporting effective risk management and secure product deployment in today’s interconnected, security-focused environment. For organizations prioritizing robust cybersecurity and privacy protection, adherence to ISO/IEC 18045:2026 is an essential step in achieving trusted IT solutions.
Open preview (PDF)Information security, cybersecurity and privacy protection — Evaluation criteria for IT security — Requirements and methodology for IT security evaluation