All bloggings

Knotwork security, securing the net A Preliminary Work Item within ISO/IEC JTC 1/SC 27/WG4 has produced a detailed plan for the revision of the multi-part ISO/IEC 27033 network security standard. The plan is a work of art given the complexities involved. I'm impressed - and that's saying something. [Although I'd love to share it with you, the copyright belongs to ISO/IEC, not me. Sorry.] Here are some of the highlights (as I understand them at the moment - this is a bus

I'm currently working on a proposed new ISO27k information security standard for SMEs - Small to Mid-sized Enterprises with up to about 250 people. ISO/IEC 27001 makes business sense for organisations towards the upper end of the range and beyond, but what about those tiddlers buried at the bottom of the heap? SMEs are like krill, thumb-sized prawn-like sea creatures weighing just a gram or so ... yet a single blue whale scoops-up something like 20 tons (millions) of the ta

The fourth edition of ISO/IEC 27007 is on-track for publication by mid-2027. Aside from revising the title to "Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing", and updating numerous references to the current editions of ISO/IEC 27001 and ISO 19011, the forthcoming fourth edition remains largely unchanged from the third. It still concerns conformity or compliance "tick-n-bash" auditing, specifically

ISO/IEC JTC 1/SC 27/WG 1 is making progress on a proposed new ISO27k information security standard for Small to Mid-sized Enterprises with up to ~250 people. An initial rough draft will be fleshed-out over the coming years if the project is approved by the committee in its meeting at the end of this month. The draft's 39 SME information security controls are drawn from/basd loosely on ISO/IEC 27002 controls: Half the controls are classified as "Initial baseline", suggested a

After more than a decade, the first edition of ISO/IEC 27017 and ITU-T recommendation X.1631 has been updated. The standard advises both Cloud Service Customers and Cloud Service Providers, providing complementary security guidance side-by-side in tables. Clauses 5 through 8 in the new second edition adopt the structure of ISO/IEC 27002:2022: Clause 4 sets the scene with general guidance and concepts; Clause 5 covers organizational controls for cloud services; Clause 6 covers

ISO/IEC JTC 1/SC 27 is in the early stages of updating ISO/IEC 27002:2022 - the generic set of information security controls generally worth considering, whether as part of a '27001 Information Security Management System or not. Rather than leaping straight into the usual process of inviting then discussing and addressing comments and proposed changes, the revision project's editorial team is taking a different route this time around: the committee intends to decide what cha

ISO/IEC 27000:2016 clause 4.4 "Why an ISMS is important" explained the purpose of information security and an ISMS in about a page of 7 paragraphs. In ISO/IEC 27000:2026, that clause became 4.1.7 "Importance of an ISMS" and was condensed to half a page with 3 paragraphs. It's more than just a tightening-up of the wording, though, including this new text: "Interested parties can include not only the organization’s customers, suppliers, business partners, employees, shareholde

The brand new 2026 sixth edition of ISO/IEC 27000 takes just 11 shiny pages to outline an Information Security Management System and succinctly summarise a fifth of the ~100 ISO/IEC 27xxx (ISO27k) standards. Gone are 65 of the previous edition's definition of terms, leaving just 12, of which all bar 5 are shortened versions of definitions drawn from other ISO27k standards. The most useful part is clause 4 "Concepts and principles", four pages explaining why information securi

In three months (October 5th this year), an updated set of ISO/IEC directives will come into force. While most of the changes relate to the internal management structures of committees and projects, aligning ISO and IEC and simplifying the directives, the timescales for standards development are being tightened-up with implications for the way standards work is initiated, specified, planned and managed, and the nature of the standards produced. The following comments reflect

Earlier today I blogged about the tedium and risks of ISO's slow processes, both consequences of the effort needed to align all those involved in standardisation and produce worthwhile, generally-acceptable standards. Here's another topical example. ISO/IEC 27090 "Cybersecurity — Artificial Intelligence — Guidance for addressing security threats and compromises to artificial intelligence systems" is at FDIS stage and will hopefully emerge from the sausage machine "soon-as", m

Updates to both ISO/IEC 27000 and ISO/IEC 27017 have passed their votes at FDIS stage. 27000 (the overview and introduction to the ISO27k standards) received just a few minor comments and should be released very soon (which means within months, in ISO-land). 27017 (cloud security) received about 10 pages of comments - mostly minor grammatical corrections though, so it too remains on-track for release soon (hopefully this year). They should be published "soon-as". I often moa

Graças a Filipe Nicacio, agora oferecemos traduções para português brasileiro de alguns materiais do ISO27k Toolkit. Pedimos desculpas por eventuais erros: não consigo revisá-los, pois a única palavra em português que sei é "Obrigado!"... e meu sotaque é péssimo! [Courtesy of Filipe Nicacio, we now offer Brazilian Portuguese translations of some of the ISO27k Toolkit materials. Sorry about any mistakes: I can't really check them since about the only word of Portuguese I know

ISO/IEC 27002 - a generic catalogue of commonplace information security controls - expands substantially on Annex A of ISO/IEC 27001. Each of the 93 single-sentence control statements in Annex A merits about a page of more detailed explanation and guidance in '27002 ... but those details mean more work for ISO/IEC JTC 1/SC27 to maintain the standard. The committee is forever chasing after changes in the field such as the meteoric rise of generative AI since the release of Cha

Having now reached F inal D raft I nternational S tandard stage, ISO/IEC 27090 " Guidance for addressing security threats and compromises to artificial intelligence systems " is on-track for publication later this year, hopefully. This is a timely standard, giving the explosion of AI-with-everything at the moment. Hopefully it will prompt smart (and not-so-smart!) organisations to think carefully about the information risks associated with their use of AI, prioritising the

ISO/IEC 27565:2026 is a brand new ISO27k standard on Z ero- K nowledge P roofs. It explains how to go about collecting and verifying personal information for various legitimate purposes without 'over-collecting' i.e. requiring and gathering additional information beyond that strictly needed for the stated purpose - verifying whether a statement or claim is or is not true. Age verification is a common example. A new law in Australia, for instance, prohibits youngsters from

In part, the current (fifth, 2018) edition of ISO/IEC 27000 defines key terms of art used throughout the ISO27k standards . The standard is available as a legitimate free download from ISO . If you haven't already seen it, go ahead - download the standard for a good look at these 77 terms defined in clause 3: access control attack audit audit scope authentication authenticity availability base measure competence confidentiality conformity consequence continual improvement c

Cover page ISO/IEC TS 27103:2026 "Cybersecurity - Guidance on using ISO and IEC standards in a cybersecurity framework" is, essentially, a mapping of NIST's C yber S ecurity F ramework to ISO27k and other standards. The Technical Specification belatedly updates references to various clauses in the 2022 editions of ISO/IEC 27001 and 27002 from 2018's T echnical R eport. Read more about the standard here on this site and at ISO.org

Although ISO/IEC 27000 and most other standards incorporate definitions, the language is often formalised/stilted and very succinct. Being the product of committees within the larger structure of the global standards bodies means new terms have to be carefully word-crafted to avoid conflict with the existing body of knowledge. Reducing definitions to their essence may be worthwhile from an academic perspective, although I wonder about the poor reader trying to make sense of

No, not that kind of 'medium'! Two new ISO/IEC JTC 1/SC 27/WG 1 standards projects are under way, raising fundamental questions about how we standardise and promote information security. 1. Practical ISMS implementation guidance First, we are defining the scope and plan for a second part to ISO/IEC 27003 (possibly a distinct standard or some other format). This project aims to offer ISMS implementation advice for small, medium and large organizations, with a specific emphas

I've received the first W orking D raft for the revision of ISO/IEC 27102 :2019 - "Information security management - Guidelines for cyber-insurance ". With a new title already approved ("Information security, cybersecurity and privacy protection — Guidelines for applying ISO/IEC 27001 and related standards in support of cyber insurance ") and a revised scope, the committee intends to refocus the second edition more explicitly on the I nformation S ecurity M anagement S ystem