National foreword

This British Standard is the UK implementation of EN 17640:2022.

The UK participation in its preparation was entrusted to Technical Committee IST/33, Information security, cybersecurity and privacy protection.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 March 2023.

This European Standard was approved by CEN on 15 August 2022.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN and CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

European foreword

This document (EN 17640:2022) has been prepared by Technical Committee CEN/CLC/JTC 13 “Cybersecurity and Data Protection”, the secretariat of which is held by DIN.

This European Standard shall be given the status of a national standard, either by publication of an identical text or by endorsement, at the latest by April 2023, and conflicting national standards shall be withdrawn at the latest by April 2023.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN shall not be held responsible for identifying any or all such patent rights.

Any feedback and questions on this document should be directed to the users’ national standards body. A complete listing of these bodies can be found on the CEN website.

According to the CEN-CENELEC Internal Regulations, the national standards organisations of the following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the United Kingdom.

Introduction

The foundation for a sound product certification is a reliable, transparent and repeatable evaluation methodology. Several product or scheme dependent evaluation methodologies exist. The Cybersecurity Act (CSA) [1] will cause new schemes to be created which in turn require (new) methodologies to evaluate the cybersecurity functionalities of products. These new methodologies are required to describe evaluation tasks defined in the CSA. This methodology also adds a concept, independent of the requirements of the CSA, namely the evaluation in a fixed time. Existing cybersecurity evaluation methodologies (e.g. EN ISO/IEC 15408 in combination with EN ISO/IEC 18045) are not explicitly designed to be used in a fixed time.

Scheme developers are encouraged to implement the evaluation methodology in their schemes. This can be done for general purpose schemes or in dedicated (vertical domain) schemes, by selecting aspects for self-assessment at CSA assurance level “basic” or third-party assessments. The self-assessment may be performed at CSA assurance level “basic”, the third-party evaluations at CSA assurance level “basic”, “substantial” or “high”. And the evaluation criteria and methodology might be subject to extra tailoring, depending on the requirements of the individual scheme. This cybersecurity evaluation methodology caters for all of these needs. This methodology has been designed so that it can (and needs to be) adapted to the requirements of each scheme.

Scheme developers are encouraged to implement the evaluation methodology for the intended use of the scheme, applicable for general purpose or in dedicated (vertical) domains, by selecting those aspects needed for self-assessment at CSA assurance level “basic” or third-party evaluation at any CSA assurance level required by the scheme.

This document provides the minimal set of evaluation activities defined in the CSA to achieve the desired CSA assurance level as well as optional tasks, which might be required by the scheme. Selection of the various optional tasks is accompanied by guidelines so scheme developers can estimate the impact of their choices. Further adaption to the risk situation in the scheme can be achieved by choosing the different evaluation tasks defined in the methodology or using the parameters of the evaluation tasks, e.g. the number of days for performing certain tasks.

If scheme developers choose tasks that are not defined in this evaluation methodology, it will be the responsibility of the scheme developer to define a set of companion requirements or re-use another applicable evaluation methodology.

Nonetheless, it is expected that individual schemes will instantiate the general requirements laid out in this evaluation methodology and provide extensive guidance for manufacturers (and all other parties) about the concrete requirements to be fulfilled within the scheme.

Evaluators, testers and certifiers can use this methodology to conduct the assessment, testing or evaluation of the products and to perform the actual evaluation/certification according to the requirements set up by a given scheme. It also contains requirements for the level of skills and knowledge of the evaluators and thus will also be used by accreditation bodies or National Cybersecurity Certification Authorities during accreditation or authorization, where appropriate, and monitoring of conformity assessment bodies.

Manufacturers and developers will find the generic type of evidence required by each evaluation task listed in the evaluation methodology to prepare for the assessment or evaluation. The evidence and evaluation tasks are independent from the fact of whether the evaluation is done by the manufacturer/developer (i.e. 1st party) or by someone else (2nd/3rd party).

Users of certified products (regulators, user associations, governments, companies, consumers, etc.) may also use this document to inform themselves about the assurance drawn from certain certificates using this evaluation methodology. Again, it is expected that scheme developers provide additional information, tailored to the domain of the scheme, about the assurance obtained by evaluations / assessments under this methodology.

Furthermore, this methodology is intended to enable scheme developers to create schemes which attempt to reduce the burden on the manufacturer as much as possible (implying additional burden on the evaluation lab and the certification body).

NOTE In this document the term “Conformity Assessment body” (CAB) is used for CABs doing the evaluation. Other possible roles for CABs are not considered in this document.

It should be noted that this document cannot be used “stand alone”. Each domain (scheme) needs to provide domain specific cybersecurity requirements (“technical specifications”) for the objects to be evaluated / certified. This methodology is intended to be used in conjunction with those technical specifications containing such cybersecurity requirements. The relationship of the methodology provided in this document to the activities in product conformity assessment is shown in Figure 1.

1 Scope

This document describes a cybersecurity evaluation methodology that can be implemented using pre-defined time and workload resources, for ICT products. It is intended to be applicable for all three assurance levels defined in the CSA (i.e. basic, substantial and high).

The methodology comprises different evaluation blocks including assessment activities that comply with the evaluation requirements of the CSA for the mentioned three assurance levels. Where appropriate, it can be applied both to third-party evaluation and self-assessment.

2 Normative references

3 Terms and definitions

4 Conformance

5 General concepts

5.1 Usage of this methodology

5.2 Knowledge of the TOE

5.3 Development process evaluation

5.4 Attack Potential

5.5 Knowledge building

6 Evaluation tasks

6.1 Completeness check

6.2 FIT Protection Profile Evaluation

6.3 Review of security functionalities

6.4 FIT Security Target Evaluation

6.5 Development documentation

6.6 Evaluation of TOE Installation

6.7 Conformance testing

6.8 Vulnerability review

6.9 Vulnerability testing

6.10 Penetration testing

6.11 Basic crypto analysis

6.12 Extended crypto analysis

Bibliography

BS EN 17640:2022

Fixed-time cybersecurity evaluation methodology for ICT products

Current

Published:

31 Mar 2023