Overview
ISO 22388:2023 - "Security and resilience - Authenticity, integrity and trust for products and documents - Guidelines for securing physical documents" provides practical guidance for designing and managing the security of physical documents. It establishes a structured procedure for document security design covering risk assessment, document classification, selection of security features, security evaluation, and document risk mitigation. The standard applies to secure physical documents used to validate transactions, provide access, demonstrate compliance or secure products, but explicitly excludes banknotes, machine‑readable travel documents, driving licences, postage/tax stamps, health cards and national identity cards covered by other regulations.
Key topics
- Risk assessment for document security: methods to estimate risk, identify threats and document‑specific risk factors.
- Document classes and lifecycle: defining document categories and life stages - security design, blank document production, personalization, issuance, service lifetime and revocation.
- Security features: guidance on selecting and designing physical and digital security features tied to verifiable authentication methods.
- Security evaluation & risk rating: establishing evaluation processes and developing relative risk ratings to determine appropriate countermeasures.
- Document risk mitigation: practical steps to reduce fraud potential across production, distribution and usage.
- User categories and inspection capabilities: tailoring security to users’ resources - general users, specific operators (e.g., counter staff), and authorities/experts.
- Informative annexes: includes annexes for risk assessment, rating systems, feature criteria, categorization by authentication level and a glossary of document security technologies.
Applications
ISO 22388 is designed for organizations that issue, manufacture or verify physical documents where authenticity and integrity matter. Typical practical uses:
- Designing secure certificates, permits, licenses, vouchers and product authentication labels.
- Specifying security feature sets (overt, covert, forensic) appropriate to the document’s risk class.
- Establishing procurement requirements for blank document production and personalization workflows.
- Creating inspection and training requirements for frontline staff and forensic examiners.
This standard helps reduce counterfeiting, tampering and impersonation risks while improving transaction integrity.
Who should use it
- Specifying entities and issuers defining document authentication requirements.
- Document producers and personalization vendors implementing secure manufacturing processes.
- Security architects, risk managers and procurement teams responsible for document lifecycle security.
- Authorities, forensic labs and auditors establishing evaluation and verification procedures.
Related standards
- ISO 22300 (Vocabulary) - referenced terminology.
- ISO/IEC and other document/ID standards where applicable (the standard excludes documents covered by existing regulations).
Use ISO 22388:2023 as a practical framework to align document design, security features and operational controls with assessed fraud risks and verification capabilities.