Overview
ISO/IEC 19790:2025 - Information security, cybersecurity and privacy protection - Security requirements for cryptographic modules - defines a comprehensive set of security requirements for cryptographic modules used to protect sensitive information in ICT systems. The third edition establishes a layered approach with four security levels across 11 requirement areas, enabling vendors, integrators and evaluators to match cryptographic-module assurance to data sensitivity and deployment environments.
Key topics and technical requirements
ISO/IEC 19790:2025 covers functional and assurance requirements that address the full lifecycle of a cryptographic module. Major topics include:
- Cryptographic module security levels: Four increasing levels of protection to support a wide spectrum of use cases and threat models.
- Cryptographic boundary and specification: Definition of module scope, supported cryptographic functions and operational behavior.
- Interfaces and protected paths: Rules for module interfaces, categories of interfaces, and requirements for plaintext trusted paths and protected internal paths.
- Roles, services and authentication: Role-based access, services exposed by the module, and authentication mechanisms for operators and administrators.
- Software/firmware security: Requirements for secure software/firmware design, update controls and protections that scale with security level.
- Operational environment: Requirements for modifiable and fixed environments, including OS constraints for higher assurance.
- Physical security and environmental failure protection: Embodiments and tests for physical tamper resistance and environmental failure handling.
- Non-invasive attack mitigation: Protections and test metrics against side-channel and other non-invasive attacks.
- Sensitive Security Parameter (SSP) management: Generation, entry, storage, zeroization and RNG requirements for keys and other SSPs.
- Self-tests and life‑cycle assurance: Pre-operational and conditional self-tests, configuration management, secure development and vendor testing.
- Mitigation of other attacks: Measures for residual risks and high-level attack vectors at advanced security levels.
- Normative annexes: Documentation requirements, approved functions, SSP generation methods, authentication mechanisms, test metrics and development/manufacturing guidance (Annexes A–G).
Applications and who uses this standard
ISO/IEC 19790:2025 is used by:
- Cryptographic module designers and manufacturers to design hardware and software modules to meet defined security levels.
- Security architects and system integrators selecting modules for systems that protect classified, regulated or sensitive data.
- Certification labs and evaluators performing assurance assessments against the standard.
- Procurement and compliance teams specifying module security requirements in contracts and regulatory submissions.
Typical applications include HSMs, secure elements, TPMs, smart cards, VPN concentrators, cloud KMS components and embedded IoT security modules.
Related standards
ISO/IEC 19790:2025 is part of the ISO/IEC JTC 1/SC 27 family addressing cryptographic techniques and information security. It is commonly implemented alongside complementary standards for information security management and cryptographic algorithms to produce an end-to-end security solution.
Keywords: ISO/IEC 19790:2025, cryptographic modules, security requirements, cryptographic boundary, sensitive security parameter, physical security, non-invasive attacks, self-tests, life-cycle assurance.