ISO/IEC 15408, commonly known as the Common Criteria (CC), is an international standard for evaluating the security of IT products and systems. It provides a framework for specifying security requirements and assurance levels.
The PDF includes strict rules about what happens after certification. If you ship a product with a new cryptographic library and do not tell the lab, your certificate is void.
Using the templates in Part 1 of the PDF, you write a . This document is the contract between you and the evaluator. It lists:
ISO/IEC 15408 remains the gold standard for verifying IT product security. While the certification process is demanding, it provides an unparalleled level of trust for governments, enterprises, and vendors alike. Whether you are downloading the ISO/IEC 15408 PDF to prepare your product for evaluation or using it to structure your organization's security procurement policies, understanding this framework is a foundational step toward superior cybersecurity hygiene.
Understanding ISO/IEC 15408: The Definitive Guide to Common Criteria PDF
Once you have the PDF open, you will encounter dense, technical language. Let us translate the most critical concepts.
Be cautious of free PDFs found online — many are outdated, incomplete, or unauthorized copies. Always refer to the official version for compliance work.
Utilizing certified products helps satisfy compliance audits for frameworks like HIPAA, PCI-DSS, and GDPR. How to Find and Access ISO/IEC 15408 PDFs
The first section introduces the Target of Evaluation (TOE). Not "the software." Not "the firewall." The TOE. A term so clinical it could describe a specimen under a microscope. This is the first deep truth of 15408: you cannot secure everything . You must draw a circle in the sand. Inside the circle is order; outside is chaos, the Operational Environment . The document implicitly admits its own failure—it only judges the artifact, never the human holding it.
Geared toward enterprise and government applications where developers use rigorous semi-formal design models to prevent high-level security breaches. EAL 6: Semiformally Verified Design and Tested
This newer part provides a framework for defining the specific evaluation methods and activities that will be used to assess the SFRs and SARs. It bridges the gap between the broad requirements of Parts 1-3 and the detailed methodology found in ISO/IEC 18045.