ISO 23195:2021

Security objectives of information systems of third-party payment services

Standard Details

This document defines a common terminology to be used in the context of third-party payment (TPP). Next, it establishes two logical structural models in which the assets to be protected are clarified. Finally, it specifies security objectives based on the analysis of the logical structural models and the interaction of the assets affected by threats, organizational security policies and assumptions. These security objectives are set out in order to counter the threats resulting from the intermediary nature of TPPSPs offering payment services compared with simpler payment models where the payer and the payee directly interact with their respective account servicing payment service provider (ASPSP).

This document assumes that TPP-centric payments rely on the use of TPPSP credentials and the corresponding certified processes for issuance, distribution and renewal purposes. However, security objectives for such processes are out of the scope of this document.

NOTE This document is based on the methodology specified in the ISO/IEC 15408 series. Therefore, the security matters that do not belong to the TOE are dealt with as assumptions, such as the security required by an information system that provides TPP services and the security of communication channels between the entities participating in a TPP business.

General Information

Status : Published

Standard Type: Main

Document No: ISO 23195:2021

Document Year: 2021

Pages: 40

Edition: 1

Section Volume:
ISO/TC 68/SC 2. Financial Services, security

ICS:
03.060 Finances. Banking. Monetary systems. Insurance
35.240.40 IT applications in banking

Preview Document

Life Cycle

Currently Viewing

Published

ISO 23195:2021

ISO 23195:2021

Standard Details

General Information

Life Cycle

Add Standards To Trackedge

Enquiry Form