UNE-CEN ISO/TS 17574:2017

This document provides a guideline for preparation and evaluation of security requirementsspecifications, referred to as Protection Profiles (PP) in ISO/IEC 15408 (all parts) and inISO/IEC TR 15446.By Protection Profile (PP), it means a set of security requirements for a category of products or systemsthat meet specific needs. A typical example would be a PP for On-Board Equipment (OBE) to be used inan EFC system. However, the guidelines in this document are superseded if a Protection Profile alreadyexists for the subsystem in consideration.The target of evaluation (TOE) for EFC is limited to EFC specific roles and interfaces as shown inFigure 1. Since the existing financial security standards and criteria are applicable to other externalroles and interfaces, they are assumed to be outside the scope of TOE for EFC.The security evaluation is performed by assessing the security-related properties of roles, entities andinterfaces defined in STs, as opposed to assessing complete processes which often are distributed overmore entities and interfaces than those covered by the TOE of this document.NOTE Assessing security issues for complete processes is a complimentary approach, which may well bebeneficial to apply when evaluating the security of a system.