Overview
ISO/IEC 19896-2:2018 specifies competence requirements for individuals who test and evaluate cryptographic modules under conformance schemes based on ISO/IEC 19790 and ISO/IEC 24759. It defines minimum knowledge, skills, experience, education and effectiveness criteria to ensure consistent, comparable results across validation and certification projects involving cryptographic module security.
Key Topics
- Scope and structure: Organized around Knowledge, Skills, Experience, Education and Effectiveness to align personnel competence with conformance testing needs.
- Tertiary education / equivalent experience: Testers should have an associate, bachelor or higher degree in IT-related disciplines or demonstrate equivalent practical experience (minimum equivalent of 3 years study or experience).
- Technical specialities: Testers must have qualifications in at least one speciality; testing laboratories should cover all specialties across staff. Examples include:
- Cryptographic concepts and algorithms
- Software/firmware development (programming, compilers, debugging, unit/integration/regression testing)
- Operating systems (installation, configuration, hardening, virtual machines)
- Hardware development and manufacturing (single/multi-chip designs, packaging, manufacturing integrity)
- Physical security testing, side-channel analysis, algorithm testing
- Standards knowledge: Explicit requirement to know ISO/IEC 19790 (security requirements for cryptographic modules), ISO/IEC 24759 (test requirements), and related standards such as ISO/IEC 17025, ISO/IEC 17825, ISO/IEC 18367, and test tool standards (ISO/IEC 20085 series).
- Supporting materials: Annexes include an example testers’ log, ontology of technology types, specific cryptographic module knowledge, and validator competence guidance.
Applications
- Validation and certification programs: Use the standard to define minimum tester qualifications for cryptographic module conformance testing.
- Accreditation and laboratory management: Establish personnel criteria to comply with ISO/IEC 17025 and to demonstrate technical competence during audits.
- Hiring and training: HR and training teams can map job descriptions, professional development, and credential requirements to the standard’s knowledge and skills areas.
- Test project staffing: Ensure appropriate mix of specialists (software, hardware, cryptography, physical security) to meet ISO/IEC 24759 test requirements and ISO/IEC 19790 objectives.
- Credentialing bodies: Design certification schemes and recognition programs for information security testers and evaluators.
Related Standards
- ISO/IEC 19790 - Security requirements for cryptographic modules (primary subject)
- ISO/IEC 24759 - Test requirements for cryptographic modules
- ISO/IEC 17025 - Competence of testing and calibration laboratories
- ISO/IEC 17825, 18367, 20085, 20543 - Complementary test and analysis methods
ISO/IEC 19896-2 is essential for organizations involved in cryptographic module testing, accreditation bodies, validators, certification authorities and security testing professionals seeking standardized, auditable competence criteria. Keywords: ISO/IEC 19896-2, cryptographic module testing, competence requirements, ISO/IEC 19790, ISO/IEC 24759, information security testers.