Overview
ISO/IEC TS 23532-2:2021 is a technical specification that supplements ISO/IEC 17025:2017 for laboratories performing testing based on ISO/IEC 19790 (security requirements for cryptographic modules) and ISO/IEC 24759. It defines additional, domain‑specific competence and procedural requirements for cryptographic security testing laboratories to ensure valid, impartial and reproducible results when testing cryptographic modules and implementations under test (IUT).
Key topics and requirements
This document builds on ISO/IEC 17025 and adds crypto‑specific detail in areas including:
-
Impartiality and conflict of interest
- Policies to prevent labs from testing products for which they provided consulting, design, implementation, or hold financial/ownership interests.
- Labs may clarify standards to vendors but must avoid activities that create a conflict of interest.
-
Confidentiality and integrity
- Requirements to protect sensitive test data and vendor information throughout testing and reporting.
-
Structural and resource requirements
- Personnel competence, facility and environmental controls, equipment needs and metrological traceability pertinent to cryptographic testing.
- References to personnel competence standards (ISO/IEC 19896 series).
-
Process requirements
- Review of requests, selection/verification/validation of test methods, sampling, handling of test items (IUT), technical records, measurement uncertainty, and ensuring validity of results.
-
Reporting and records
- Specific requirements for test reports, calibration certificates, statements of conformity, and amendments.
-
Quality and management system options
- Management system requirements aligned with ISO/IEC 17025 including option A/B approaches; corrective actions, internal audits, and management review.
-
Informative annexes
- Guidance on metrological traceability, management system options and relationships between standards used in cryptographic module testing.
Applications and who uses it
ISO/IEC TS 23532-2 is intended for:
- Cryptographic security testing laboratories seeking accreditation or demonstrating competence for ISO/IEC 19790 testing.
- Accreditation bodies and assessors evaluating lab conformity to crypto testing best practices.
- Vendors and product owners preparing modules for conformance testing and wanting to understand lab expectations.
- Laboratory managers, technical leads and auditors implementing or reviewing test processes, personnel competence and impartiality safeguards.
Related standards
By integrating ISO/IEC TS 23532-2:2021 into laboratory practice, organizations can strengthen the credibility, repeatability and accreditation readiness of cryptographic module testing.