SIST EN ISO/IEC 18045:2026
(Main)Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Requirements and methodology for IT security evaluation (ISO/IEC 18045:2026)
General Information
- Abstract
This document specifies requirements and the minimum actions performed by an evaluator in order to conduct an evaluation using the criteria and evaluation evidence defined in the ISO/IEC 15408 series evaluation.
- Status
- Published
- Public Enquiry End Date
- 14-Oct-2024
- Publication Date
- 16-Sep-2026
- Technical Committee
- ITC - Information technology
- Current Stage
- 6060 - National Implementation/Publication (Adopted Project)
- Start Date
- 13-Aug-2026
- Due Date
- 18-Oct-2026
- Completion Date
- 17-Sep-2026
Overview
SIST EN ISO/IEC 18045:2026 defines comprehensive requirements and methodologies for evaluating IT security, focusing on information security, cybersecurity, and privacy protection. This standard, developed by SIST following international ISO/IEC processes, serves as a foundational document for IT security evaluators. It works in conjunction with the ISO/IEC 15408 series, known as the "Common Criteria" for IT security evaluation, by specifying the essential activities and minimum evaluator actions necessary for consistent, reliable security assessments.
Key Topics
- Evaluation Criteria for IT Security: Outlines the framework and requirements that must be addressed during an IT security evaluation. It ensures that the evaluation aligns with clear, internationally recognized benchmarks.
- Evaluation Methodology: Details the minimum actions and steps evaluators must perform, including management of evidence, assessment of protection profiles, and analysis of security targets.
- Process and Task Structure: Describes the sequence of evaluation, including input, sub-tasks, and output documentation, ensuring a transparent and auditable process.
- Roles and Responsibilities: Clarifies the responsibilities of evaluators, developers, and sponsors within the overall security evaluation project.
- Relationship with ISO/IEC 15408: Explains how the evaluation methodology integrates with the structure and criteria provided in the ISO/IEC 15408 series for a harmonized approach.
Applications
SIST EN ISO/IEC 18045:2026 is applicable in any context where IT security evaluation is required, including:
- Certification Schemes: Forms the basis for national or multinational IT product and system certifications, ensuring adherence to best practices in cybersecurity.
- Product Development: Guides developers in preparing the necessary documentation and evidence to facilitate a successful security assessment.
- Procurement and Compliance: Assists organizations in assessing the security claims of IT products, critical for informed procurement and regulatory compliance.
- Government and Defense: Used in public sector acquisition processes where robust cybersecurity is mandatory.
- Critical Infrastructure: Supports risk management and assurance activities in sectors such as finance, health, telecommunications, and energy.
Adoption of this standard enhances the consistency, comparability, and reliability of IT security evaluations, promoting international trust in certified products.
Related Standards
For a holistic approach to IT security evaluation, consider the following related standards:
- ISO/IEC 15408 series (Common Criteria): The foundational criteria for IT security evaluation, detailing requirements for Protection Profiles and Security Targets.
- ISO/IEC 27001: Provides a management framework for information security.
- ISO/IEC 27005: Focuses on information security risk management.
- ISO/IEC 19790: Specifies security requirements for cryptographic modules.
- ISO/IEC 30111: Guidance on vulnerability handling processes.
SIST EN ISO/IEC 18045:2026 is essential for organizations seeking globally recognized, methodical approaches to IT security evaluation. Its implementation assures stakeholders of rigorous cybersecurity, privacy, and information protection standards throughout the IT product lifecycle.
Relations
- Effective Date
- 01-Oct-2026
Get Certified
Connect with accredited certification bodies for this standard
BSI Group
BSI (British Standards Institution) is the business standards company that helps organizations make excellence a habit.
Bureau Veritas
Bureau Veritas is a world leader in laboratory testing, inspection and certification services.
DNV
DNV is an independent assurance and risk management provider.
Sponsored listings
Frequently Asked Questions
SIST EN ISO/IEC 18045:2026 is a standard published by the Slovenian Institute for Standardization (SIST). Its full title is "Information security, cybersecurity and privacy protection - Evaluation criteria for IT security - Requirements and methodology for IT security evaluation (ISO/IEC 18045:2026)". This standard covers: This document specifies requirements and the minimum actions performed by an evaluator in order to conduct an evaluation using the criteria and evaluation evidence defined in the ISO/IEC 15408 series evaluation.
This document specifies requirements and the minimum actions performed by an evaluator in order to conduct an evaluation using the criteria and evaluation evidence defined in the ISO/IEC 15408 series evaluation.
SIST EN ISO/IEC 18045:2026 is classified under the following ICS (International Classification for Standards) categories: 35.030 - IT Security. The ICS classification helps identify the subject area and facilitates finding related standards.
SIST EN ISO/IEC 18045:2026 has the following relationships with other standards: It is inter standard links to SIST EN ISO/IEC 18045:2024. Understanding these relationships helps ensure you are using the most current and applicable version of the standard.
SIST EN ISO/IEC 18045:2026 is available in PDF format for immediate download after purchase. The document can be added to your cart and obtained through the secure checkout process. Digital delivery ensures instant access to the complete standard document.
Standards Content (Sample)
SLOVENSKI STANDARD
01-oktober-2026
Nadomešča:
SIST EN ISO/IEC 18045:2024
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Merila za
ocenjevanje varnosti IT - Zahteve in metodologija za ocenjevanje varnosti IT
(ISO/IEC 18045:2026)
Information security, cybersecurity and privacy protection - Evaluation criteria for IT
security - Requirements and methodology for IT security evaluation (ISO/IEC
18045:2026)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Evaluationskriterien für IT-Sicherheit - Methodik für die Bewertung der IT-Sicherheit
(ISO/IEC 18045:2026)
Sécurité de l'information, cybersécurité et protection de la vie privée - Critères
d'évaluation pour la sécurité des technologies de l'information - Exigences et
méthodologie pour l'évaluation de sécurité (ISO/IEC 18045:2026)
Ta slovenski standard je istoveten z: EN ISO/IEC 18045:2026
ICS:
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EUROPEAN STANDARD EN ISO/IEC 18045
NORME EUROPÉENNE
EUROPÄISCHE NORM
May 2026
ICS 35.030
Supersedes EN ISO/IEC 18045:2023
English version
Information security, cybersecurity and privacy protection
- Evaluation criteria for IT security - Requirements and
methodology for IT security evaluation (ISO/IEC
18045:2026)
Sécurité de l'information, cybersécurité et protection Informationssicherheit, Cybersicherheit und Schutz
de la vie privée - Critères d'évaluation pour la sécurité der Privatsphäre - Evaluationskriterien für IT-
des technologies de l'information - Exigences et Sicherheit - Methodik für die Bewertung der IT-
méthodologie pour l'évaluation de sécurité (ISO/IEC Sicherheit (ISO/IEC 18045:2026)
18045:2026)
This European Standard was approved by CEN on 3 March 2026.
CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.
CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2026 CEN/CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 18045:2026 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3
European foreword
This document (EN ISO/IEC 18045:2026) has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology" in collaboration with Technical Committee CEN-CENELEC/ JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by November 2026, and conflicting national standards
shall be withdrawn at the latest by November 2026.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 18045:2023.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC
websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 18045:2026 has been approved by CEN-CENELEC as EN ISO/IEC 18045:2026
without any modification.
International
Standard
ISO/IEC 18045
Fourth edition
Information security, cybersecurity
2026-05
and privacy protection —
Evaluation criteria for IT security —
Requirements and methodology for
IT security evaluation
Sécurité de l'information, cybersécurité et protection de la vie
privée — Critères d'évaluation pour la sécurité des technologies
de l'information — Exigences et méthodologie pour l'évaluation
de sécurité
Reference number
ISO/IEC 18045:2026(en) © ISO/IEC 2026
ISO/IEC 18045:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 18045:2026(en)
Contents Page
Foreword .viii
Introduction .ix
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Terminology . . 4
5 Verb usage . 5
6 General evaluation guidance . 5
7 Relationship between structures within the CC and the structure of this document . 5
8 Evaluation process and related tasks . 6
8.1 General .6
8.2 Evaluation process overview . .6
8.2.1 Objectives .6
8.2.2 Responsibilities of the roles .6
8.2.3 Relationship of roles .7
8.2.4 General evaluation model .7
8.2.5 Evaluator verdicts .8
8.3 Evaluation input task .9
8.3.1 Objectives .9
8.3.2 Application notes .9
8.3.3 Management of evaluation evidence task .10
8.4 Evaluation sub-activities .11
8.5 Evaluation output task .11
8.5.1 Objectives .11
8.5.2 Management of evaluation outputs .11
8.5.3 Application notes .11
8.5.4 Write OR task .11
8.5.5 Write ETR task . 12
9 Protection Profile (PP) evaluation . 19
9.1 Introduction .19
9.2 Application notes .19
9.2.1 Re-using the evaluation results of certified PPs .19
9.3 PP introduction (APE_INT) . 20
9.3.1 Evaluation of sub-activity (APE_INT.1) . 20
9.4 Conformance claims (APE_CCL) .21
9.4.1 Evaluation of sub-activity (APE_CCL.1) .21
9.5 Security problem definition (APE_SPD) .32
9.5.1 Evaluation of sub-activity (APE_SPD.1) .32
9.6 Security objectives (APE_OBJ) . 33
9.6.1 Evaluation of sub-activity (APE_OBJ.1) . 33
9.6.2 Evaluation of sub-activity (APE_OBJ.2) . 35
9.7 Extended components definition (APE_ECD) .37
9.7.1 Evaluation of sub-activity (APE_ECD.1) .37
9.8 Security requirements (APE_REQ) .41
9.8.1 Evaluation of sub-activity (APE_REQ.1) .41
9.8.2 Evaluation of sub-activity (APE_REQ.2).47
10 Protection Profile Configuration evaluation . 51
10.1 Introduction .51
10.2 PP-Module introduction (ACE_INT) .52
10.2.1 Evaluation of sub-activity (ACE_INT.1) .52
10.3 PP-Module conformance claims (ACE_CCL) . 55
© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 18045:2026(en)
10.3.1 Evaluation of sub-activity (ACE_CCL.1) . 55
10.4 PP-Module security problem definition (ACE_SPD) .61
10.4.1 Evaluation of sub-activity (ACE_SPD.1) .61
10.5 PP-Module security objectives (ACE_OBJ) .62
10.5.1 Evaluation of sub-activity (ACE_OBJ.1) .62
10.5.2 Evaluation of sub-activity (ACE_OBJ.2) . 64
10.6 PP-Module extended components definition (ACE_ECD). 66
10.6.1 Evaluation of sub-activity (ACE_ECD.1) . 66
10.7 PP-Module security requirements (ACE_REQ) .70
10.7.1 Evaluation of sub-activity (ACE_REQ.1) .70
10.7.2 Evaluation of sub-activity (ACE_REQ.2) .76
10.8 PP-Module consistency (ACE_MCO) . 81
10.8.1 Evaluation of sub-activity (ACE_MCO.1) . 81
10.9 PP-Configuration consistency (ACE_CCO) . 84
10.9.1 Evaluation of sub-activity (ACE_CCO.1) . 84
11 Security Target (ST) evaluation .93
11.1 Introduction . 93
11.2 Application notes . 93
11.2.1 Re-using the evaluation results of certified PPs . 93
11.2.2 Composition . 94
11.3 ST introduction (ASE_INT) . 94
11.3.1 Evaluation of sub-activity (ASE_INT.1) . 94
11.4 Conformance claims (ASE_CCL) . 98
11.4.1 Evaluation of sub-activity (ASE_CCL.1) . 98
11.5 Security problem definition (ASE_SPD) . 112
11.5.1 Evaluation of sub-activity (ASE_SPD.1) . 112
11.6 Security objectives (ASE_OBJ) . 113
11.6.1 Evaluation of sub-activity (ASE_OBJ.1) . 113
11.6.2 Evaluation of sub-activity (ASE_OBJ.2) . 115
11.7 Extended components definition (ASE_ECD) .117
11.7.1 Evaluation of sub-activity (ASE_ECD.1) .117
11.8 Security requirements (ASE_REQ). 121
11.8.1 Evaluation of sub-activity (ASE_REQ.1) . 121
11.8.2 Evaluation of sub-activity (ASE_REQ.2) .128
11.9 TOE summary specification (ASE_TSS) .134
11.9.1 Evaluation of sub-activity (ASE_TSS.1) .134
11.9.2 Evaluation of sub-activity (ASE_TSS.2) . 135
11.10 Consistency of composite product Security Target (ASE_COMP) . 136
11.10.1 Evaluation of sub-activity (ASE_COMP.1) . 136
12 Development .141
12.1 Introduction .141
12.2 Application notes .141
12.2.1 General .141
12.2.2 Composition .142
12.3 Security architecture (ADV_ARC) .142
12.3.1 Evaluation of sub-activity (ADV_ARC.1) .142
12.4 Functional specification (ADV_FSP) .147
12.4.1 Evaluation of sub-activity (ADV_FSP.1) .147
12.4.2 Evaluation of sub-activity (ADV_FSP.2) . 150
12.4.3 Evaluation of sub-activity (ADV_FSP.3) . 155
12.4.4 Evaluation of sub-activity (ADV_FSP.4) . 160
12.4.5 Evaluation of sub-activity (ADV_FSP.5) . 166
12.5 Implementation representation (ADV_IMP) . 172
12.5.1 Evaluation of sub-activity (ADV_IMP.1) . 172
12.5.2 Evaluation of sub-activity (ADV_IMP.2) .174
12.6 TSF internals (ADV_INT) . 177
12.6.1 Evaluation of sub-activity (ADV_INT.1) . 177
12.6.2 Evaluation of sub-activity (ADV_INT.2) . 180
© ISO/IEC 2026 – All rights reserved
iv
ISO/IEC 18045:2026(en)
12.6.3 Evaluation of sub-activity (ADV_INT.3) . 182
12.7 Formal TSF model (ADV_SPM). 185
12.7.1 Evaluation of sub-activity (ADV_SPM.1) . 185
12.8 TOE design (ADV_TDS) .191
12.8.1 Evaluation of sub-activity (ADV_TDS.1) .191
12.8.2 Evaluation of sub-activity (ADV_TDS.2) . 195
12.8.3 Evaluation of sub-activity (ADV_TDS.3) .200
12.8.4 Evaluation of sub-activity (ADV_TDS.4).209
12.8.5 Evaluation of sub-activity (ADV_TDS.5) .219
12.9 Composite design compliance (ADV_COMP) . 227
12.9.1 Evaluation of sub-activity (ADV_COMP.1) . 227
13 Guidance documents .229
13.1 Introduction . 229
13.2 Application notes . 229
13.3 Operational user guidance (AGD_OPE) . 230
13.3.1 Evaluation of sub-activity (AGD_OPE.1) . 230
13.4 Preparative procedures (AGD_PRE) . 233
13.4.1 Evaluation of sub-activity (AGD_PRE.1) . 233
14 life cycle support .235
14.1 Introduction . 235
14.2 Application notes . 235
14.2.1 Composition . 235
14.3 CM capabilities (ALC_CMC) . 236
14.3.1 Evaluation of sub-activity (ALC_CMC.1). 236
14.3.2 Evaluation of sub-activity (ALC_CMC.2) . 237
14.3.3 Evaluation of sub-activity (ALC_CMC.3) . 239
14.3.4 Evaluation of sub-activity (ALC_CMC.4) . 243
14.3.5 Evaluation of sub-activity (ALC_CMC.5) .248
14.4 CM scope (ALC_CMS) . 256
14.4.1 Evaluation of sub-activity (ALC_CMS.1) . 256
14.4.2 Evaluation of sub-activity (ALC_CMS.2) . 257
14.4.3 Evaluation of sub-activity (ALC_CMS.3) . 258
14.4.4 Evaluation of sub-activity (ALC_CMS.4) . 259
14.4.5 Evaluation of sub-activity (ALC_CMS.5) .260
14.5 Delivery (ALC_DEL) . 262
14.5.1 Evaluation of sub-activity (ALC_DEL.1) . 262
14.6 Developer environment security (ALC_DVS) . 263
14.6.1 Evaluation of sub-activity (ALC_DVS.1) .263
14.6.2 Evaluation of sub-activity (ALC_DVS.2) . 265
14.7 Flaw remediation (ALC_FLR) .268
14.7.1 Evaluation of sub-activity (ALC_FLR.1) .268
14.7.2 Evaluation of sub-activity (ALC_FLR.2) . 271
14.7.3 Evaluation of sub-activity (ALC_FLR.3) .274
14.8 Development life cycle definition (ALC_LCD) .280
14.8.1 Evaluation of sub-activity (ALC_LCD.1) .280
14.8.2 Evaluation of sub-activity (ALC_LCD.2) . 281
14.9 TOE development artefacts (ALC_TDA) .284
14.9.1 Evaluation of sub-activity (ALC_TDA.1) .284
14.9.2 Evaluation of sub-activity (ALC_TDA.2) .287
14.9.3 Evaluation of sub-activity (ALC_TDA.3) . 291
14.10 Tools and techniques (ALC_TAT) . 296
14.10.1 Evaluation of sub-activity (ALC_TAT.1).296
14.10.2 Evaluation of sub-activity (ALC_TAT.2) .298
14.10.3 Evaluation of sub-activity (ALC_TAT.3) . 301
14.11 Integration of composition parts and consistency check of delivery procedures (ALC_
COMP) .304
14.11.1 Evaluation of sub-activity (ALC_COMP.1) .304
© ISO/IEC 2026 – All rights reserved
v
ISO/IEC 18045:2026(en)
15 Tests . 306
15.1 Introduction . 306
15.2 Application notes . 307
15.2.1 General . 307
15.2.2 Understanding the expected behaviour of the TOE . 307
15.2.3 Testing vs. alternate approaches to verify the expected behaviour of
functionality . 307
15.2.4 Verifying the adequacy of tests .308
15.2.5 Composition .308
15.3 Coverage (ATE_COV) .309
15.3.1 Evaluation of sub-activity (ATE_COV.1) .309
15.3.2 Evaluation of sub-activity (ATE_COV.2) .309
15.3.3 Evaluation of sub-activity (ATE_COV.3) . 311
15.4 Depth (ATE_DPT) . 313
15.4.1 Evaluation of sub-activity (ATE_DPT.1) . . 313
15.4.2 Evaluation of sub-activity (ATE_DPT.2) . 315
15.4.3 Evaluation of sub-activity (ATE_DPT.3) . 318
15.5 Functional tests (ATE_FUN) . 321
15.5.1 Evaluation of sub-activity (ATE_FUN.1) . 321
15.5.2 Evaluation of sub-activity (ATE_FUN.2) . 324
15.6 Independent testing (ATE_IND) . 328
15.6.1 Evaluation of sub-activity (ATE_IND.1) . 328
15.6.2 Evaluation of sub-activity (ATE_IND.2) . 331
15.7 Composite functional testing (ATE_COMP) . 336
15.7.1 Evaluation of sub-activity (ATE_COMP.1) . 336
16 Vulnerability assessment .338
16.1 Introduction . 338
16.2 Application notes . 338
16.2.1 Composition . 338
16.3 Vulnerability analysis (AVA_VAN) .338
16.3.1 Evaluation of sub-activity (AVA_VAN.1). 338
16.3.2 Evaluation of sub-activity (AVA_VAN.2) .344
16.3.3 Evaluation of sub-activity (AVA_VAN.3) . 351
16.3.4 Evaluation of sub-activity (AVA_VAN.4) . 359
16.3.5 Evaluation of sub-activity (AVA_VAN.5) . 367
16.4 Composite vulnerability assessment (AVA_COMP) . 375
16.4.1 Evaluation of sub-activity (AVA_COMP.1). 375
17 Composition .378
17.1 Introduction . 378
17.2 Application notes . 378
17.3 Composition rationale (ACO_COR) . 379
17.3.1 Evaluation of sub-activity (ACO_COR.1) .
...