Overview
ISO/IEC TS 23532-1:2021 is a Technical Specification that supplements ISO/IEC 17025:2017 with competency requirements specific to laboratories performing IT security evaluations against the ISO/IEC 15408 series (Common Criteria) and ISO/IEC 18045. It is intended for evaluation laboratories (often called ITSEF, CLEF or evaluation facilities) and accreditation bodies to harmonize procedures, demonstrate laboratory competence, and improve consistency of IT security evaluation results.
Key topics and requirements
- Scope and purpose: Complements ISO/IEC 17025:2017 by adding requirements specific to information security, cybersecurity and privacy protection evaluations.
- Impartiality: Rules to avoid conflicts of interest - for example, evaluators must not both develop and evaluate the same protection profile, security target or IT product; separation between evaluation and consulting roles; separation of evaluator organization from TOE developer.
- Confidentiality: Strengthened confidentiality controls to ensure evaluation reports and sensitive test information are protected.
- Structural and resource requirements: Supplementary guidance on laboratory structure, personnel competence, facilities, environmental controls, equipment and metrological traceability tailored for IT security testing.
- Process requirements: Detailed expectations for review of requests and contracts, selection/verification/validation of methods (per ISO/IEC 18045), sampling, handling test items, technical records, measurement uncertainty considerations, result validity, and reporting (test reports, conformity statements, opinions).
- Quality control and governance: Requirements for handling complaints, nonconforming work, data and information management.
- Management system options: Two management system approaches (Options A and B) aligned with ISO/IEC 17025, with annexed guidance for implementation.
- Annexes and guidance: Informative annexes on metrological traceability, management system options and relationships to related IT security standards.
Applications and users
- Evaluation laboratories (ITSEFs / CLEFs) seeking accreditation or demonstrating competence for Common Criteria evaluations.
- Accreditation bodies assessing labs against discipline-specific competence requirements.
- National certification authorities and scheme owners defining evaluation criteria and lab expectations.
- Vendors and developers preparing products for Common Criteria evaluation to understand lab practices.
- Auditors and consultants who implement or assess laboratory quality and security testing programs.
Related standards
- ISO/IEC 17025:2017 - General requirements for testing and calibration laboratories (base standard).
- ISO/IEC 15408 series - Evaluation criteria for IT security (Common Criteria).
- ISO/IEC 18045 - Methodology for IT security evaluation.
- ISO/IEC 19896 series - Competence requirements for information security testers and evaluators.
Keywords: ISO/IEC TS 23532-1:2021, information security, cybersecurity, IT security evaluation laboratory, ISO/IEC 15408, ISO/IEC 17025, Common Criteria, lab accreditation, evaluator competence.
Open preview (PDF)Information security, cybersecurity and privacy protection — Requirements for the competence of IT security testing and evaluation laboratories — Part 1: Evaluation for ISO/IEC 15408