Overview
ISO/IEC 18045:2022 - Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Methodology for IT security evaluation - defines the minimum actions an evaluator must perform to conduct evaluations against the ISO/IEC 15408 series (Common Criteria). It provides a structured methodology for assessing security functionality and assurance, detailing the evaluation process, required evidence, evaluator roles, and expected outputs such as evaluation verdicts and the Evaluation Technical Report (ETR).
Keywords: ISO/IEC 18045:2022, IT security evaluation, Common Criteria, evaluation methodology, ISO/IEC 15408.
Key topics and technical requirements
- Evaluation process and tasks: describes input, sub‑activities, and output tasks; role responsibilities; and the general evaluation model.
- Evaluator actions and evidence management: minimum required actions for collecting, managing and re‑using evaluation evidence in accordance with ISO/IEC 15408 criteria.
- Evaluator deliverables: guidance on preparing evaluation outputs including the ETR and other reports (e.g., write OR sub‑task, write ETR sub‑task).
- Protection Profile (PP) evaluation (Class APE): requirements for evaluating full PPs, including conformance claims, security problem definition, objectives, extended components, and security requirements.
- Protection Profile Configuration (Class ACE): evaluation of PP‑module content, consistency and configuration conformance.
- Security Target (ST) evaluation (Class ASE): criteria for assessing ST introduction, conformance claims, security problem definitions, objectives, extended components, security requirements, and TOE summary specification.
- Development class (Class ADV): sections addressing security architecture and development‑related evaluation activities.
- Evaluator verdicts and consistency checks: standardized verdicts and methods to determine conformity with ISO/IEC 15408 evidence and criteria.
Keywords: security target evaluation, protection profile, TOE, evaluation evidence, evaluator verdicts.
Practical applications and target users
- Independent evaluators and testing laboratories - to apply a standardized methodology when conducting Common Criteria evaluations.
- Certification bodies and accreditation authorities - to ensure consistent evaluation practices and to verify evaluator outputs (ETRs).
- Product vendors and developers - to understand evaluator expectations when seeking Common Criteria certification for a TOE (Target of Evaluation).
- Procurement teams and security architects - to interpret evaluation reports and select products with verified security claims.
- Government and regulated sectors - for acquiring assurance‑rated IT products in compliance with national or international certification schemes.
Keywords: cybersecurity, information security, privacy protection, assurance, Common Criteria evaluation.
Related standards
- ISO/IEC 15408 (Common Criteria) - primary set of security functional and assurance requirements that ISO/IEC 18045 operationalizes.
- ISO/IEC 18045 complements the ISO/IEC 15408 series by providing the evaluation methodology and minimum evaluator actions required for consistent, reproducible security evaluations.