Overview
CEN ISO/TS 17574:2017 - Electronic fee collection (EFC) - Guidelines for security protection profiles provides practical guidance for preparing and evaluating security requirements specifications (Protection Profiles, PPs) for Electronic Fee Collection systems. Adopted by CEN from ISO/TS 17574:2017 (third edition), this technical specification updates the 2009 edition and is intended to be read alongside ISO/IEC 15408 (all parts). It focuses on EFC-specific roles, interfaces and the Target of Evaluation (TOE) boundaries relevant to tolling and related road transport systems.
Key topics and technical requirements
- Protection Profile (PP) preparation and evaluation: Guidance on how to define security requirements for a category of products or systems (for example, On-Board Equipment - OBE).
- EFC security architecture: High-level structure describing roles, entities and interfaces (OBE, Road Side Equipment - RSE, SAM, personalization cards).
- TOE scoping and security targets (STs): Limitation of TOE to EFC-specific roles/interfaces and how to develop STs for evaluation.
- Assurance and functional requirements: Use of assurance requirements (including Evaluation Assurance Levels) and functional security requirements defined in ISO/IEC 15408.
- Threat analysis and risk rationale: Procedures and example methods (Annex B) for threat analysis and rationale verification.
- Key management and cryptographic modules: Considerations for key generation, storage, usage and secure modules (SAM) as part of EFC security.
- Document preparation procedures: Practical steps and templates in Annex A to prepare PPs and evaluation artefacts.
- Registration and certification: The specification explains the role of international registrars and referencing registered EFC/PPs for reuse.
Applications and users
This specification is intended for:
- EFC operators and highway authorities - to develop operator-centric PPs and security targets.
- Transport ministries and national organizations - for national EFC policies and procurement requirements.
- System integrators and vendors - to align product design (OBE, RSE, IC card solutions) with recognized PPs.
- Security evaluators, laboratories and certifying bodies - to perform evaluations against EFC-specific STs and PPs.
- Standardization and conformity assessment professionals - when harmonizing EFC requirements with international assurance practices.
Practical uses include drafting security requirements for tolling equipment, scoping evaluation targets for certification, and reusing registered PPs to accelerate secure EFC deployments.
Related standards
- ISO/IEC 15408 (all parts) - Common Criteria for IT security evaluation (primary normative reference).
- ISO/IEC TR 15446 - Guidance on Protection Profiles and security targets.
- ISO/TS 19299, ISO/TS 14907-1 - Terminology and related transport/IT security references.
- CCRA (Common Criteria Recognition Arrangement) - international recognition framework (discussed in Annex D).
Keywords: Electronic fee collection, EFC security, Protection Profile, ISO/TS 17574:2017, ISO/IEC 15408, On-Board Equipment (OBE), Road Side Equipment (RSE), security evaluation, TOE, security target.