All bloggings

ISO/IEC JTC 1/SC 27 is in the early stages of updating ISO/IEC 27002:2022 - the generic set of information security controls generally worth considering, whether as part of a '27001 Information Security Management System or not. Rather than leaping straight into the usual process of inviting then discussing and addressing comments and proposed changes, the revision project's editorial team is taking a different route this time around: the committee intends to decide what cha

ISO/IEC 27000:2016 clause 4.4 "Why an ISMS is important" explained the purpose of information security and an ISMS in about a page of 7 paragraphs. In ISO/IEC 27000:2026, that clause became 4.1.7 "Importance of an ISMS" and was condensed to half a page with 3 paragraphs. It's more than just a tightening-up of the wording, though, including this new text: "Interested parties can include not only the organization’s customers, suppliers, business partners, employees, shareholde

The brand new 2026 sixth edition of ISO/IEC 27000 takes just 11 shiny pages to outline an Information Security Management System and succinctly summarise a fifth of the ~100 ISO/IEC 27xxx (ISO27k) standards. Gone are 65 of the previous edition's definition of terms, leaving just 12, of which all bar 5 are shortened versions of definitions drawn from other ISO27k standards. The most useful part is clause 4 "Concepts and principles", four pages explaining why information securi

In three months (October 5th this year), an updated set of ISO/IEC directives will come into force. While most of the changes relate to the internal management structures of committees and projects, aligning ISO and IEC and simplifying the directives, the timescales for standards development are being tightened-up with implications for the way standards work is initiated, specified, planned and managed, and the nature of the standards produced. The following comments reflect

Earlier today I blogged about the tedium and risks of ISO's slow processes, both consequences of the effort needed to align all those involved in standardisation and produce worthwhile, generally-acceptable standards. Here's another topical example. ISO/IEC 27090 "Cybersecurity — Artificial Intelligence — Guidance for addressing security threats and compromises to artificial intelligence systems" is at FDIS stage and will hopefully emerge from the sausage machine "soon-as", m

Updates to both ISO/IEC 27000 and ISO/IEC 27017 have passed their votes at FDIS stage. 27000 (the overview and introduction to the ISO27k standards) received just a few minor comments and should be released very soon (which means within months, in ISO-land). 27017 (cloud security) received about 10 pages of comments - mostly minor grammatical corrections though, so it too remains on-track for release soon (hopefully this year). They should be published "soon-as". I often moa

Graças a Filipe Nicacio, agora oferecemos traduções para português brasileiro de alguns materiais do ISO27k Toolkit. Pedimos desculpas por eventuais erros: não consigo revisá-los, pois a única palavra em português que sei é "Obrigado!"... e meu sotaque é péssimo! [Courtesy of Filipe Nicacio, we now offer Brazilian Portuguese translations of some of the ISO27k Toolkit materials. Sorry about any mistakes: I can't really check them since about the only word of Portuguese I know

ISO/IEC 27002 - a generic catalogue of commonplace information security controls - expands substantially on Annex A of ISO/IEC 27001. Each of the 93 single-sentence control statements in Annex A merits about a page of more detailed explanation and guidance in '27002 ... but those details mean more work for ISO/IEC JTC 1/SC27 to maintain the standard. The committee is forever chasing after changes in the field such as the meteoric rise of generative AI since the release of Cha

Having now reached F inal D raft I nternational S tandard stage, ISO/IEC 27090 " Guidance for addressing security threats and compromises to artificial intelligence systems " is on-track for publication later this year, hopefully. This is a timely standard, giving the explosion of AI-with-everything at the moment. Hopefully it will prompt smart (and not-so-smart!) organisations to think carefully about the information risks associated with their use of AI, prioritising the

ISO/IEC 27565:2026 is a brand new ISO27k standard on Z ero- K nowledge P roofs. It explains how to go about collecting and verifying personal information for various legitimate purposes without 'over-collecting' i.e. requiring and gathering additional information beyond that strictly needed for the stated purpose - verifying whether a statement or claim is or is not true. Age verification is a common example. A new law in Australia, for instance, prohibits youngsters from

In part, the current (fifth, 2018) edition of ISO/IEC 27000 defines key terms of art used throughout the ISO27k standards . The standard is available as a legitimate free download from ISO . If you haven't already seen it, go ahead - download the standard for a good look at these 77 terms defined in clause 3: access control attack audit audit scope authentication authenticity availability base measure competence confidentiality conformity consequence continual improvement c

Cover page ISO/IEC TS 27103:2026 "Cybersecurity - Guidance on using ISO and IEC standards in a cybersecurity framework" is, essentially, a mapping of NIST's C yber S ecurity F ramework to ISO27k and other standards. The Technical Specification belatedly updates references to various clauses in the 2022 editions of ISO/IEC 27001 and 27002 from 2018's T echnical R eport. Read more about the standard here on this site and at ISO.org

Although ISO/IEC 27000 and most other standards incorporate definitions, the language is often formalised/stilted and very succinct. Being the product of committees within the larger structure of the global standards bodies means new terms have to be carefully word-crafted to avoid conflict with the existing body of knowledge. Reducing definitions to their essence may be worthwhile from an academic perspective, although I wonder about the poor reader trying to make sense of

No, not that kind of 'medium'! Two new ISO/IEC JTC 1/SC 27/WG 1 standards projects are under way, raising fundamental questions about how we standardise and promote information security. 1. Practical ISMS implementation guidance First, we are defining the scope and plan for a second part to ISO/IEC 27003 (possibly a distinct standard or some other format). This project aims to offer ISMS implementation advice for small, medium and large organizations, with a specific emphas

I've received the first W orking D raft for the revision of ISO/IEC 27102 :2019 - "Information security management - Guidelines for cyber-insurance ". With a new title already approved ("Information security, cybersecurity and privacy protection — Guidelines for applying ISO/IEC 27001 and related standards in support of cyber insurance ") and a revised scope, the committee intends to refocus the second edition more explicitly on the I nformation S ecurity M anagement S ystem

I fixed a curious issue with page navigation today. If we open any of the detailed pages on the ISO27k standards, there are 2 sets of 3 buttons, top and bottom of the page, making it easy to navigate to the previous page (the detailed page for the next lower numbered ISO27k standard), the next page (the next higher numbered one) , or to go 'up' to the list of ISO27k standards. In testing, they all worked OK except for the next button on the page for ISO/IEC 27031. It refuse

Today I updated several pages concerning the current status of various ISO27k standards development projects - nothing particularly significant. I am struggling to keep up with the work of ISO/IEC JTC 1/SC 27 Working Group 5. I'm not sure at the moment whether I am not receiving WG5 emails with updates, or not reading them properly and taking note of them. Either way, it is hard for me to keep track and update this site for the WG5 standards. Also today, I noticed a curious

Having seen yet another comment on social media this morning along the lines of "I'm petrified that the certification auditor will raise a nonconformity if we don't adopt specific Annex A controls", I've added an ISO27k FAQ under the assurance section . This is one of the most frequent of F requently A sked Q uestions, a frustratingly persistent concern relating to the natural anxieties about being audited. I've been audited. I've been an auditor. Audits are challenging,

I'm intrigued by the notion of 'adversaries' being classed and treated as 'stakeholders' for risk management purposes. Adversaries' interests, concerns, requirements and expectations are (on the whole) diametrically opposed to the organisation's and its more conventional stakeholders. However, as with all stakeholders ( e.g . owners, workers, partners, suppliers, customers, authorities, communities, society ...), they are willing to invest in achieving the outcomes they desir

ISO/TC 215 has updated ISO 27799 to reflect ISO/IEC 27002:2022 , omitting the previous edition's content re ISO/IEC 27001 . The standard now concentrates on the implementation of organisational, people, physical and technological controls within the healthcare industry.