Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (published by ISO and IEC)
- Latest version
- ISO/IEC 15408-1:2026 (Edition 5), Part 1: Introduction and general model. It replaces ISO/IEC 15408-1:2022 (Edition 4), which is now withdrawn.
- Effective
- 19 May 2026
- Official text
- www.iso.org ↗
What is ISO/IEC 15408?
ISO 15408, formally ISO/IEC 15408 and widely known as the Common Criteria, is the international standard for evaluating the security properties of IT products. ISO and IEC publish it through committee JTC 1/SC 27. It applies to developers and vendors who want independent evaluation of a product, and to buyers who rely on the results.
The current version of Part 1 is ISO/IEC 15408-1:2026 (Edition 5), Introduction and general model, published on 19 May 2026 by ISO and IEC. It replaces ISO/IEC 15408-1:2022 (Edition 4), which is now withdrawn.
ISO/IEC 15408 is a multi-part series. Part 1 gives an overview of every part, defines the common terms and sets out the general concepts and principles of IT security evaluation. Its core concept is the Target of Evaluation (TOE), the product under evaluation. Part 1 also describes the evaluation context and its intended audience.
Parts 2 to 5 were also republished in 2026.
Why it matters
When a buyer asks for a Common Criteria certificate, the question is about your product, not your company.
The NCSC describes Common Criteria as a widely recognised international scheme in which independent testing validates a developer's claims about a product's security features. That is the value of it: a buyer who cannot test your product themselves can rely on someone who did.
A claim never made is a claim never tested.
Certificates also travel. Under the Common Criteria Recognition Arrangement (CCRA), member countries recognise each other's certificates, so a product evaluated in one can be accepted by buyers in another.
Who it applies to
ISO/IEC 15408 applies to developers and vendors of IT products who choose to put a product through independent evaluation, and to the buyers who rely on the result. The series is not tied to one sector. A firm that only buys and runs products evaluates nothing itself.
Obligation: voluntary for suppliers. No UK statute mandates ISO/IEC 15408. A buyer's procurement terms or contract may ask for a certified product, and where they do, the obligation becomes contractual.
ISO/IEC 15408 evaluates a product. ISO 27001 certifies an organisation's information security management system. One does not stand in for the other, so confirm with the buyer which of them they are asking for.
The UK position
A UK firm rarely meets ISO/IEC 15408 unless a buyer asks for it. The NCSC stopped producing Common Criteria certificates on 1 October 2019, when it ceased to be a certificate producer under the CCRA. The UK is now a Certificate Consuming Participant. It recognises CCRA-compliant certificates, and it continues to contribute to Collaborative Protection Profiles and to ISO standards development.
The UK recognises the certificates. It no longer issues them.
The NCSC says the relevance of individual product evaluation to the UK is diminishing, and that UK market demand for certification is limited. The UK has no national certification scheme and no statute that names the standard. A UK vendor meets it when a buyer writes it into a requirement.
Key requirements
ISO/IEC 15408 sets out a structure for evaluation rather than a list of controls to operate. Its key concepts are:
- the Target of Evaluation (TOE), the product under evaluation;
- Protection Profiles (PP), PP-Modules, PP-Configurations and packages;
- Security Targets (ST);
- conformance types.
The rest of the series, as the 2026 editions describe it:
- Part 2 sets out how functional components are built, with a catalogue of them.
- Part 3 sets out the assurance components, and the criteria for checking Protection Profiles, PP-Configurations, PP-Modules and Security Targets.
- Part 4 sets rules for writing evaluation methods that any evaluator can repeat and get the same result.
- Part 5 provides ready-made packages of assurance and functional requirements, including the Evaluation Assurance Levels (EALs).
ISO/IEC 18045 gives the evaluation methods that go with the series.
ISO/IEC 15408-2 and 15408-3
ISO/IEC 15408-2 and ISO/IEC 15408-3 are the two catalogues the rest of the series draws on. Part 2 describes what a product's security functions do. Part 3 describes how thoroughly the evaluation checks them, and the EALs in Part 5 are built from its components.
Because every Protection Profile and Security Target is written in components from these catalogues, a buyer can compare one evaluated product with another.
Frequently asked questions
The purpose of ISO/IEC 15408 is to give a common basis for evaluating the security of IT products. Part 1 sets out the general concepts, principles and model, built around the Target of Evaluation. A developer states security claims, and independent testing then validates them, so buyers can rely on a certificate.
ISO/IEC 15408 evaluates an IT product against its Security Target. ISO/IEC 27001 certifies an organisation's information security management system. A tender can ask for both: a Common Criteria certificate for the product being bought, and ISO 27001 for the supplier that runs it. Holding one does not answer a request for the other.
ISO/IEC 15408-1:2026 (Edition 5), Introduction and general model, is the current Part 1. ISO and IEC published it on 19 May 2026, and it replaces ISO/IEC 15408-1:2022, now withdrawn. Parts 2 to 5 of the ISO/IEC 15408 series also have 2026 editions, so check which edition a buyer's requirement or a certificate refers to.
No. ISO/IEC 15408 is voluntary for suppliers, and no UK statute mandates it. It becomes a requirement only when a buyer's procurement terms or contract name it. Where one does, ask which Protection Profile or assurance level the buyer expects, because a certificate covers the exact version and settings that were tested, not every later release.
ISO/IEC 15408-2 is the catalogue of security functional components, the shared building blocks for stating what a product's security functions must do. The 2026 edition, which replaces the 2022 edition, sets out how each component is built. Assurance components sit separately in ISO/IEC 15408-3, so the same function can be evaluated at different assurance levels.