PD ISO/IEC TS 19608:2018

Guidance for developing security and privacy functional requirements based on ISO/IEC 15408. | Status: Confirmed, Current

What is ISO/IEC TS 19608 about?

ISO/IEC TS 19608 provides guidance for:

• selecting and specifying security functional requirements (SFRs) from ISO/IEC 15408-2 to protect Personally Identifiable Information (PII);
• the procedure to define both privacy and security functional requirements in a coordinated manner; and
• developing privacy functional requirements as extended components based on the privacy principles defined in ISO/IEC 29100 through the paradigm described in ISO/IEC 15408-2

Who is ISO/IEC TS 19608 for?

ISO/IEC TS 19608 on security and privacy functional requirements is useful for:

• Developers who implement products or systems
• Authors of Protection Profiles
• Security evaluators

Why should you use ISO/IEC TS 19608?

ISO/IEC 29100 defines a framework of privacy principles that should be considered when developing systems or applications that deal with personally identifiable information (PII). ISO/IEC TS 19608 those principles and maps them, where possible, to the security functional requirements defined in ISO/IEC 15408-2. Where such a mapping is not possible, ISO/IEC TS 19608 derives new security functional requirements collected in one new class that contains several families of privacy-related security functional components following the guidance for developing new classes, families, and components provided in ISO/IEC 15408-1 and ISO/IEC 15408-2. ISO/IEC TS 19608 can also be used as guidance for developing further privacy functional requirements using the framework of ISO/IEC 15408. The class, families, and components defined in ISO/IEC TS 19608 can be extended for cases where the components defined here are not sufficient to express specific privacy functional requirements