December 2025: New Competence Standard for IT Security Assessment Bodies Published

In December 2025, the field of information technology receives a pivotal update with the publication of EN ISO/IEC 19896-1:2025, establishing a unified set of concepts and requirements for personnel competence in IT security conformance assessment bodies. As cybersecurity threats evolve and regulatory demands intensify worldwide, this standard provides organizations and professionals with a shared baseline for capability, consistency, and trust in security testing and certification. This latest release, which is part one of a comprehensive series, addresses the critical need for clarity in what makes IT security evaluators, testers, certifiers, and validators effective in their roles.

Overview

Information technology underpins every industry, driving both opportunity and risk. As digital infrastructure becomes more complex, the value of trustworthy information security assurance rises sharply. International standards lay the groundwork for consistent, reliable cybersecurity and privacy protection across organizations, supply chains, and markets.

EN ISO/IEC 19896-1:2025 sets out foundational concepts and terminology for evaluating the competence of IT security conformance testing bodies and their personnel. For organizations responsible for evaluating and certifying software, hardware, and digital processes, meeting defined competence requirements is both a business and compliance imperative.

In this article, you will learn:

• The scope and structure of this new competence standard
• Highlights of essential requirements for IT security evaluation staff
• Implications for conformance assessment bodies, regulators, and technology providers
• Best practices and compliance considerations based on the latest guidance

Detailed Standards Coverage

EN ISO/IEC 19896-1:2025 – Overview and Concepts for IT Security Conformance Assessment Competence

Information security, cybersecurity and privacy protection – Requirements for the competence of IT security conformance assessment body personnel – Part 1: Overview and concepts (ISO/IEC 19896-1:2025)

What this standard covers:

This foundational document establishes the core principles, terminology, and relationships necessary for a shared understanding of competence requirements for IT security conformance assessment personnel. It creates the conceptual base for the entire ISO/IEC 19896 series—guiding conformance testers, evaluators, validators, and certifiers towards globally harmonized practices.

Scope and Application:

• Defines key terms (e.g., knowledge, skills, competence, conformance tester, certifier, evaluator)
• Outlines the roles involved in IT security compliance (including testing, evaluation, validation, and certification)
• Introduces the framework for describing required competencies and the rationale for standardized competency criteria
• Addresses stakeholders such as certification bodies, security evaluation labs, vendors, technology providers, and credentialing organizations

Key Requirements and Specifications:

• Elements of Competence: Delineates required knowledge, skills, and the process for recording and measuring these elements for individuals performing IT security assessment tasks
• Competency Levels: Details a multi-level approach for both testers/evaluators and validators/certifiers, with clear criteria for each level relating to depth of expertise, responsibility, and independence
• Measurement and Documentation: Establishes how organizations should capture and assess competence through ongoing evaluation and recordkeeping
• Conceptual Framework: Supplies an annex with a template for mapping and describing competence requirements, enabling consistency in recruitment, training, and assessment

Who Needs to Comply:

• IT security conformance assessment bodies and their personnel
• Information security evaluation and testing laboratories
• Technology vendors whose products are subject to assessment
• Certification authorities and professional credentialing organizations
• Regulatory agencies overseeing information assurance

Practical Implications:

• Sets clear hiring, training, and credentialing benchmarks for roles involved in IT product security evaluation and certification
• Supports comparability and reliability of assessment outcomes across organizations and international boundaries
• Provides an auditable framework for demonstrating due diligence in staff competence to clients, regulators, and business partners

Notable Changes from Previous Edition:

• Restructured document for clarity and usability
• Removal of outdated subclauses related to experience, education, and effectiveness (now streamlined)
• Technical updates introducing distinct competence concepts for validators and certifiers
• Refined focus on knowledge and skills as measurable components, harmonized based on international conformity assessment feedback (notably CASCO guidance)

Key highlights:

• Introduces a shared vocabulary and framework for IT security competence
• Defines multi-level competency requirements for both evaluators/testers and certifiers/validators
• Embeds a measurement and documentation approach for sustainable compliance

Access the full standard:View EN ISO/IEC 19896-1:2025 on iTeh Standards

Industry Impact & Compliance

The adoption of EN ISO/IEC 19896-1:2025 marks a significant step forward in establishing robust, defensible processes for personnel competence in IT security assurance. For assessment bodies, this standard means:

• Modernizing and harmonizing staff qualification requirements across roles
• Providing clients with confidence in security certification outcomes
• Satisfying customer, regulatory, and contractual demands for transparency in competence

Compliance Considerations:

• Organizations should conduct a gap analysis to compare current staff competencies and documentation practices with the new requirements
• Compliance will likely influence third-party audit outcomes and eligibility for accreditation or approved status
• The standard supports phased adoption—enabling organizations to prioritize high-risk assessment roles first, then build out competence frameworks across the board
• Regulatory and customer-driven compliance timelines may vary, but proactive alignment will reduce future risk and cost

Benefits of adoption:

• Facilitates global recognition of personnel and conformance assessments
• Reduces the risk of inconsistent or subpar security assurance
• Enhances operational credibility, supporting new business opportunities and market access

Risks of non-compliance:

• Loss of certification/accreditation status
• Reduced customer and stakeholder trust
• Increased exposure to non-conformance penalties or regulatory sanctions

Technical Insights

Common Technical Requirements:

• Application of well-defined knowledge and skills for each role type (tester, evaluator, validator, certifier)
• Ongoing measurement, documentation, and validation of competence (including training records, experience portfolios, role-specific checklists)
• Clear pathways for advancement across competency levels, based on demonstrable capabilities rather than subjective assessment

Implementation Best Practices:

1. Map existing personnel roles against the new framework – Use the annexed templates for robust comparison.
2. Train and upskill staff – Prioritize areas where knowledge or skill gaps exist.
3. Formalize documentation processes – Leverage digital recordkeeping to support audits and accreditation.
4. Build competence development into HR and quality management programs – Connect with recruitment, professional development, and internal review cycles.
5. Participate in peer review and industry benchmarking – Ensure competencies reflect evolving real-world threats and technology changes.

Testing and Certification Considerations:

• Align competence assessment with accredited test methods and schemes
• Engage in external reviews or certification of staff where possible
• Use the framework for internal audits preceding formal third-party assessments

Conclusion / Next Steps

The December 2025 release of EN ISO/IEC 19896-1:2025 provides a new reference point for professionalism, effectiveness, and trust in IT security assessment. By adopting its framework, organizations create a solid foundation for their people—the key asset in any assurance, evaluation, or certification process.

Key Takeaways:

• The revised standard clarifies competence expectations and standardizes measurement across the IT security conformance sector.
• Proactive adoption will position organizations to excel in a landscape increasingly driven by regulatory and customer demands for demonstrable competence.
• Start with a comprehensive review of your internal practices, and leverage the standard’s framework for ongoing improvement and compliance.

Recommendations:

• Quality managers, compliance leads, and IT security professionals should download and review the full standard for detailed requirements.
• Develop an action plan to close identified gaps and train key staff
• Bookmark iTeh Standards for further updates and additional parts of the ISO/IEC 19896 series as they become available

Stay ahead of evolving industry requirements—explore EN ISO/IEC 19896-1:2025 and equip your organization for world-class IT security assurance.