ISO 15408

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-12-31 in 417 days Last day EUCC certificates may be issued under CC 3.1 R5 or ISO/IEC 15408-1:2009, -2:2008 and -3:2008; CCRA accepts CC:2022 security targets based on CC 3.1 protection profiles until this date
2. 2026-05-19 ISO/IEC 15408-1 to -4:2026 and ISO/IEC 18045:2026 are published; the 2022 editions are withdrawn
3. 2025-02-27 The EU cybersecurity certification scheme EUCC, built on the Common Criteria, applies
4. 2024-06-30 Last start date for evaluations that optionally use Common Criteria v3.1 Release 5 under the CCRA transition policy

1. 2026-05-19
   ISO/IEC 15408:2026 Major versionCurrent

   Fifth edition of Parts 1 to 3 and second edition of Parts 4 and 5, replacing the 2022 editions. source

   More

   • Parts 1 to 4 were published on 19 May 2026 and Part 5 on 28 April 2026.
   • The companion evaluation methodology, ISO/IEC 18045:2026, was published on 19 May 2026.
2. 2022-08-09
   ISO/IEC 15408:2022 Major version

   Fourth edition of Parts 1 to 3; Parts 4 and 5 were published for the first time. source

   More

   • Part 4 is a framework for specifying evaluation methods and activities; Part 5 holds pre-defined packages of security requirements.
   • ISO/IEC TR 22216:2022 describes the new concepts and changes in ISO/IEC 15408:2022 and ISO/IEC 18045:2022.
3. 2009-12-03
   ISO/IEC 15408-1:2009 Major version

   Third edition of Part 1 (Introduction and general model). source

4. 2008-08-19
   ISO/IEC 15408-2:2008 and 15408-3:2008 Major version

   Third editions of Part 2 and Part 3. source

5. 2005-10-07
   ISO/IEC 15408-2:2005 and 15408-3:2005 Major version

   Second editions of Part 2 and Part 3. source

Vendors who want an IT product or protection profile evaluated and certified. Using it is voluntary unless a scheme, buyer or law requires a certificate.

Purpose

Establishes the general concepts and model of IT security evaluation, intended as the basis for evaluating the security properties of IT products. source

Five parts

Part 1 gives an overview of all parts of the series, defines the terms and establishes the Target of Evaluation (TOE); Parts 2 to 5 follow. source source

Mutual recognition

Under the CCRA, IT products and protection profiles that earn a Common Criteria certificate can be procured or used without further evaluation. source

EU (EUCC)

Evaluations under the EU EUCC scheme apply the Common Criteria (ISO/IEC 15408) and the Common Evaluation Methodology (Article 3). source

Legal status

ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source

An evaluator follows ISO/IEC 18045 (the CEM), and a certification body issues the certificate: a national scheme under the CCRA or an accredited EUCC body.

Evaluation method

ISO/IEC 18045:2026 specifies the requirements and minimum actions for an evaluator conducting an evaluation against the ISO/IEC 15408 series. source

CCRA certificates

Common Criteria certificates are issued by Certification/Validation Bodies that must meet high and consistent standards under the CCRA. source

Free CC texts

CCRA members publish CC:2022 Release 1 (five parts) and CEM:2022 for download and grant CC users rights to reuse their text. source

Errata

Applying the latest published Errata and Interpretation document for CC:2022 and CEM:2022 is mandatory. source

EUCC

An accredited certification body issues the EUCC certificate after an evaluation by a testing lab, at assurance level "substantial" or "high". source

The standard itself sets no legal requirements. Under EUCC, national authorities supervise certification bodies and can withdraw certificates.

Legal force

ISO standards are voluntary and contain no contractual, legal or statutory requirements. source

EUCC supervision

National cybersecurity certification authorities supervise EUCC certification bodies and can withdraw certificates. source source

1. Standard ISO/IEC 15408-1:2026 Part 1: Introduction and general model (catalogue entry)
2. Standard ISO/IEC 18045:2026 Methodology for IT security evaluation (catalogue entry)
3. Standard Common Criteria CC:2022 Release 1, Part 1 (free PDF)
4. Standard Common Evaluation Methodology CEM:2022 Release 1 (free PDF)
5. Guidance Errata and Interpretation for CC:2022 and CEM:2022, version 1.2

1. EUCC

   EUCC is the EU certification scheme in law that uses ISO/IEC 15408 for evaluations; ISO/IEC 15408 is the evaluation criteria standard itself.

2. EU Cybersecurity Act

   The Cybersecurity Act is the EU regulation that sets up certification schemes such as EUCC; ISO/IEC 15408 supplies the evaluation criteria.

3. ISO 27001

   ISO/IEC 27001 certifies an organization's management system; ISO/IEC 15408 evaluates the security of a specific IT product.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to ISO 15408 (RSS)