Overview
EN ISO/IEC 15408-2:2026 is an essential international standard developed by CEN, specifically addressing information security, cybersecurity, and privacy protection in IT systems. This standard-titled Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Part 2: Security functional components-defines the necessary structure and content of security functional components used in IT product security evaluations. Central to the widely adopted Common Criteria framework, EN ISO/IEC 15408-2:2026 provides a comprehensive catalogue of security functionalities applicable to various IT environments.
The document ensures that consistent, repeatable, and well-documented criteria are available for assessing the security features of IT products and systems, supporting vendors, evaluators, and users in achieving and maintaining high standards of cybersecurity.
Key Topics
EN ISO/IEC 15408-2:2026 covers a broad spectrum of topics crucial to the evaluation of IT security, including:
- Security Functional Components: Structured sets of requirements that define specific security functionalities an IT product should deliver.
- Functional Class and Family Structures: Organization of security components into classes and families for clarity and systematic evaluation.
- Security Audit: Guidelines for recording, analyzing, and reviewing security-relevant events to support accountability and incident response.
- Cryptographic Support: Criteria for secure cryptographic key management, cryptographic operations, and random number generation.
- User Data Protection: Comprehensive requirements for access control, data authentication, information flow control, and information retention.
- Communication Security: Functional requirements for ensuring non-repudiation and secure data exchange.
- Component Catalogue: A detailed listing enabling developers and evaluators to select appropriate functional components based on system needs.
Applications
EN ISO/IEC 15408-2:2026 brings practical value to a range of stakeholders in the IT security sector:
- Security Evaluations: Used as a reference for third-party evaluation of IT products to ensure compliance with common security criteria.
- Product Development: Assists developers in designing and implementing security features in hardware, software, and integrated IT systems.
- Procurement: Enables organizations to specify security requirements for IT solutions during procurement, promoting robust cybersecurity across supply chains.
- Certification: Forms the functional basis for IT security certification schemes, giving assurance to customers and regulators.
- Regulatory Compliance: Supports alignment with regional and international regulations on data protection and cybersecurity by providing recognized evaluation metrics.
By adopting this standard, organizations enhance their ability to manage information risks, protect sensitive data, and ensure business continuity in the face of escalating cyber threats.
Related Standards
To provide a holistic approach to IT security evaluation and management, the following standards are closely related to EN ISO/IEC 15408-2:2026:
- EN ISO/IEC 15408-1:2026: Introduction and general model for IT security evaluation criteria.
- EN ISO/IEC 15408-3:2026: Security assurance components, complementing the functional catalogue with criteria for assessing the confidence in security functionality.
- ISO/IEC 27001 Series: Standards for information security management systems (ISMS).
- ISO/IEC 18045: Guidelines for the evaluation of IT security using ISO/IEC 15408.
- National and Regional Profiles: Localized profiles and protection profiles developed using the Common Criteria framework.
IT professionals, product developers, and organizations seeking to strengthen their cybersecurity posture are encouraged to integrate EN ISO/IEC 15408-2:2026 and its related standards into their security processes. This integration ensures recognized, effective, and demonstrable controls are in place, aligned with global best practices.