<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[ISO27001security]]></title><description><![CDATA[Free advice, tools and support for the global comuunity of information risk and security professionals using the ISO27k standards]]></description><link>https://www.iso27001security.com/blog</link><generator>RSS for Node</generator><lastBuildDate>Fri, 02 Oct 2026 19:36:43 GMT</lastBuildDate><atom:link href="https://www.iso27001security.com/blog-feed.xml" rel="self" type="application/rss+xml"/><item><title><![CDATA[27033 network security update]]></title><description><![CDATA[Knotwork security, securing the net A Preliminary Work Item within ISO/IEC JTC 1/SC 27/WG4 has produced a detailed plan for the revision of the multi-part ISO/IEC 27033 network security standard.   The plan is a work of art given the complexities involved.  I'm impressed - and that's saying something.  [Although I'd love to share it with you, the copyright belongs to ISO/IEC, not me. Sorry.]   Here are some of the highlights (as I understand them at the moment - this is a busy,...]]></description><link>https://www.iso27001security.com/post/27033-network-security-update</link><guid isPermaLink="false">6abec3d37a453d4647451e34</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Security]]></category><pubDate>Thu, 01 Oct 2026 21:30:15 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_b258664af22b48f994dacca2bff5ea6d/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[SME controls - a new ISO27k standard?]]></title><description><![CDATA[I'm currently working on a proposed new ISO27k information security standard for SMEs  - Small to Mid-sized Enterprises with up to about 250 people. ISO/IEC 27001 makes business sense for organisations towards the upper end of the range and beyond, but what about those tiddlers buried at the bottom of the heap? SMEs are like krill, thumb-sized prawn-like sea creatures weighing just a gram or so ... yet a single blue whale scoops-up something like 20 tons (millions)  of the tasty little...]]></description><link>https://www.iso27001security.com/post/sme-controls-a-new-iso27k-standard</link><guid isPermaLink="false">6abc2a592f78325a451122d9</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Security]]></category><category><![CDATA[Website]]></category><pubDate>Wed, 30 Sep 2026 01:46:43 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_8336debe3e904f2e957ec0439c4b1d8b~mv2.jpg/v1/fit/w_450,h_920,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[27007 audit standard "on-track"]]></title><description><![CDATA[The fourth edition of ISO/IEC 27007 is on-track for publication by mid-2027. Aside from revising the title to "Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing", and updating numerous references to the current editions of ISO/IEC 27001 and ISO 19011, the forthcoming fourth edition remains largely unchanged from the third.  It still concerns conformity or compliance "tick-n-bash" auditing, specifically, largely...]]></description><link>https://www.iso27001security.com/post/27007-audit-standard-on-track</link><guid isPermaLink="false">6ab41ae15693ed03b3e9a3da</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Security]]></category><pubDate>Wed, 23 Sep 2026 19:09:24 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_1674def90f49410f94c8a672a123ddf9/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[ISO27k SME infosec guide]]></title><description><![CDATA[ISO/IEC JTC 1/SC 27/WG 1 is making progress on a proposed new ISO27k information security standard for Small to Mid-sized Enterprises with up to ~250 people. An initial rough draft will be fleshed-out over the coming years if the project is approved by the committee in its meeting at the end of this month.  The draft's 39 SME information security controls are drawn from/basd loosely on ISO/IEC 27002 controls: Half the controls are classified as "Initial baseline", suggested as likely...]]></description><link>https://www.iso27001security.com/post/iso27k-sme-infosec-guide</link><guid isPermaLink="false">6a99c4d13f51da93f34135c7</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Security]]></category><pubDate>Thu, 03 Sep 2026 19:07:28 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_172449ef2df543f298c5e9142e59b830~mv2.jpg/v1/fit/w_729,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[ISO/IEC 27017 (cloud security) updated]]></title><description><![CDATA[After more than a decade, the first edition of ISO/IEC 27017 and ITU-T recommendation X.1631 has been updated. The standard advises both Cloud Service Customers and Cloud Service Providers, providing complementary security guidance side-by-side in tables. Clauses 5 through 8 in the new second edition adopt the structure of ISO/IEC 27002:2022: Clause 4 sets the scene with general guidance and concepts; Clause 5 covers organizational controls for cloud services; Clause 6 covers people controls...]]></description><link>https://www.iso27001security.com/post/iso-iec-27017-cloud-security-updated</link><guid isPermaLink="false">6a84a34508752169b9aa3c27</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Website]]></category><category><![CDATA[Control]]></category><category><![CDATA[Security]]></category><category><![CDATA[Risk]]></category><pubDate>Tue, 18 Aug 2026 19:43:06 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_627f7898487a4195b52179be10e14cea/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Generic infosec controls]]></title><description><![CDATA[ISO/IEC JTC 1/SC 27 is in the early stages of updating ISO/IEC 27002:2022 - the generic set  of information security controls generally worth considering, whether as part of a '27001 Information Security Management System or not. Rather than leaping straight into the usual process of inviting then discussing and addressing comments and proposed changes, the revision project's editorial team is taking a different route this time around: the committee intends to decide what changes are required...]]></description><link>https://www.iso27001security.com/post/generic-infosec-controls</link><guid isPermaLink="false">6a5bd662830cbda37bbf62e8</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Security]]></category><pubDate>Sun, 19 Jul 2026 01:22:16 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_778b37082d3245d9aadcdc996482b3c5/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Adversaries as 'interested parties']]></title><description><![CDATA[ISO/IEC 27000:2016 clause 4.4 "Why an ISMS is important" explained the purpose of information security and an ISMS in about a page of 7 paragraphs. In ISO/IEC 27000:2026, that clause became 4.1.7 "Importance of an ISMS" and was condensed to half a page with 3 paragraphs.  It's more than just a tightening-up of the wording, though, including this new text: "Interested parties can include not only the organization’s customers, suppliers, business partners, employees, shareholders, but also...]]></description><link>https://www.iso27001security.com/post/adversaries-as-interested-parties</link><guid isPermaLink="false">6a567d785e603ccfb32f8ec9</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Security]]></category><category><![CDATA[Policy]]></category><pubDate>Wed, 15 Jul 2026 21:12:08 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_e8ac47a5721545c1af095a74eb8477bf/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Slimline ISO/IEC 27000 published]]></title><description><![CDATA[The brand new 2026 sixth edition of ISO/IEC 27000 takes just 11 shiny pages to outline an Information Security Management System and succinctly summarise a fifth of the ~100 ISO/IEC 27xxx (ISO27k) standards. Gone are 65 of the previous edition's definition of terms, leaving just 12, of which all bar 5 are shortened versions of definitions drawn from other ISO27k standards. The most useful part is clause 4 "Concepts and principles", four pages explaining why information security can and should...]]></description><link>https://www.iso27001security.com/post/slimline-iso-iec-27000-published</link><guid isPermaLink="false">6a49a8bdfa58f0a255d300ad</guid><category><![CDATA[ISO27k standards]]></category><pubDate>Sun, 05 Jul 2026 01:10:47 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_c5194fb9e9e44204ad03e85bba05690b/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Updated ISO/IEC Directives]]></title><description><![CDATA[In three months (October 5th this year), an updated set of ISO/IEC directives will come into force. While most of the changes relate to the internal management structures of committees and projects, aligning ISO and IEC and simplifying the directives, the timescales for standards development are being tightened-up with implications for the way standards work is initiated, specified, planned and managed, and the nature of the standards produced.  The following comments reflect my personal,...]]></description><link>https://www.iso27001security.com/post/updated-iso-iec-directives</link><guid isPermaLink="false">6a46d71f950901ce7a6c1434</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Policy]]></category><pubDate>Thu, 02 Jul 2026 21:33:21 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_ed8fe2cd734b46c384fdeac19b1b9c35/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[AI security standard 27090]]></title><description><![CDATA[Earlier today I blogged about the tedium and risks of ISO's slow processes, both consequences of the effort needed to align all those involved in standardisation and produce worthwhile, generally-acceptable standards. Here's another topical example. ISO/IEC 27090 "Cybersecurity — Artificial Intelligence — Guidance for addressing security threats and compromises to artificial intelligence systems" is at FDIS stage and will hopefully emerge from the sausage machine "soon-as", meaning this year....]]></description><link>https://www.iso27001security.com/post/ai-security-standard-27090</link><guid isPermaLink="false">6a23a2bef64e529b409e2bae</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Security]]></category><category><![CDATA[AI]]></category><pubDate>Sat, 06 Jun 2026 04:33:18 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_c1f53ded7f71450d8b425f5243fec9f8/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[27000 &#38; 27017 updates "soon-as"]]></title><description><![CDATA[Updates to both ISO/IEC 27000 and ISO/IEC 27017 have passed their votes at FDIS stage. 27000 (the overview and introduction to the ISO27k standards) received just a few minor comments and should be released very soon (which means within months, in ISO-land). 27017 (cloud security) received about 10 pages of comments - mostly minor grammatical corrections though, so it too remains on-track for release soon (hopefully this year). They should be published "soon-as".  I often moan about ISO's...]]></description><link>https://www.iso27001security.com/post/updated-27000-27017-soon</link><guid isPermaLink="false">6a2322193919feaaedf9343b</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Security]]></category><pubDate>Fri, 05 Jun 2026 19:27:07 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_bb45293a2e1a44378b4acbff63cd0226/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Portuguese toolkit materials]]></title><description><![CDATA[Graças a Filipe Nicacio, agora oferecemos traduções para português brasileiro de alguns materiais do ISO27k Toolkit. Pedimos desculpas por eventuais erros: não consigo revisá-los, pois a única palavra em português que sei é "Obrigado!"... e meu sotaque é péssimo! [Courtesy of Filipe Nicacio, we now offer Brazilian Portuguese translations of some of the ISO27k Toolkit materials.  Sorry about any mistakes: I can't really check them since about the only word of Portuguese I know is "Obrigado!"...]]></description><link>https://www.iso27001security.com/post/portuguese-toolkit-materials</link><guid isPermaLink="false">69e805e887a5c2e7c137a568</guid><category><![CDATA[Website]]></category><category><![CDATA[Security]]></category><pubDate>Wed, 22 Apr 2026 04:19:22 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_b5199209a4c149d4a5db282919551163/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Losing faith in ISO27k]]></title><description><![CDATA[ISO/IEC 27002 - a generic catalogue of commonplace information security controls - expands substantially on Annex A of ISO/IEC 27001. Each of the 93 single-sentence control statements in Annex A merits about a page of more detailed explanation and guidance in '27002 ... but those details mean more work for ISO/IEC JTC 1/SC27 to maintain the standard. The committee is forever chasing after changes in the field such as the meteoric rise of generative AI since the release of ChatGPT at the end...]]></description><link>https://www.iso27001security.com/post/losing-faith-in-iso27k</link><guid isPermaLink="false">69de74bb66c8cbf1f4c1a630</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Security]]></category><pubDate>Thu, 16 Apr 2026 00:46:57 GMT</pubDate><enclosure url="http://video.wixstatic.com/video/51ee86_330d42dddd2c4da9aa81a138e7087677/720p/mp4/file.mp4" length="0" type="video"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[AI security standard at FDIS]]></title><description><![CDATA[Having now reached F inal D raft I nternational S tandard stage, ISO/IEC 27090  " Guidance for addressing security threats and compromises to artificial intelligence systems " is on-track for publication later this year, hopefully. This is a timely standard, giving the explosion of AI-with-everything at the moment.  Hopefully it will prompt smart (and not-so-smart!) organisations to think carefully about the information risks associated with their use of AI, prioritising the most significant...]]></description><link>https://www.iso27001security.com/post/ai-security-standard-at-fdis</link><guid isPermaLink="false">699793ecb8ed19d283744dbe</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Risk]]></category><category><![CDATA[AI]]></category><category><![CDATA[Security]]></category><pubDate>Thu, 19 Feb 2026 23:11:12 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_c4adf11cac1045bc84aa9f15e9eda66c~mv2.jpg/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[ISO/IEC 27565 published]]></title><description><![CDATA[ISO/IEC 27565:2026 is a brand new ISO27k standard on Z ero- K nowledge P roofs.  It explains how to go about collecting and verifying personal information for various legitimate purposes without 'over-collecting' i.e.  requiring and gathering additional information beyond that strictly needed for the stated purpose - verifying whether a statement or claim is or is not true. Age verification is a common example.  A new law in Australia, for instance, prohibits youngsters from accessing and...]]></description><link>https://www.iso27001security.com/post/iso-iec-27565-published</link><guid isPermaLink="false">69935acd159d7fac9641901e</guid><category><![CDATA[Website]]></category><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Privacy]]></category><category><![CDATA[Control]]></category><pubDate>Mon, 16 Feb 2026 18:36:01 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_0420e4303a294c8da801fc8e54de134c~mv2.jpg/v1/fit/w_316,h_446,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[12 << 5555 ]]></title><description><![CDATA[In part, the current (fifth, 2018) edition of ISO/IEC 27000  defines key terms of art used throughout the ISO27k standards . The standard is available as a legitimate free download from ISO .  If you haven't already seen it, go ahead - download the standard for a good look at these 77 terms defined in clause 3: access control attack audit audit scope authentication authenticity availability base measure competence confidentiality conformity consequence continual improvement control control...]]></description><link>https://www.iso27001security.com/post/12-5555</link><guid isPermaLink="false">6992a07d884976137da888bb</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Security]]></category><pubDate>Mon, 16 Feb 2026 04:59:01 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_62883f8dcd1f4733baecc91633cb8df2~mv2.jpg/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[ISO/IEC TS 27103 published]]></title><description><![CDATA[Cover page ISO/IEC TS 27103:2026 "Cybersecurity - Guidance on using ISO and IEC standards in a cybersecurity framework"  is, essentially, a mapping of NIST's C yber S ecurity F ramework  to ISO27k  and other standards. The Technical Specification belatedly updates references to various clauses in the 2022 editions of ISO/IEC 27001  and 27002  from 2018's T echnical R eport. Read more about the standard here on this site  and at ISO.org]]></description><link>https://www.iso27001security.com/post/iso-iec-ts-27103-published</link><guid isPermaLink="false">698a2d7f3445fa1b6263b9e6</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Security]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Control]]></category><pubDate>Mon, 09 Feb 2026 19:11:35 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_0553f4cfa5bc43c7995ca150d528dbee~mv2.png/v1/fit/w_314,h_444,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Painting the Forth bridge]]></title><description><![CDATA[Although ISO/IEC 27000 and most other standards incorporate definitions, the language is often formalised/stilted and very succinct.  Being the product of committees within the larger structure of the global standards bodies means new terms have to be carefully word-crafted to avoid conflict with the existing body of knowledge.  Reducing definitions to their essence may be worthwhile from an academic perspective, although I wonder about the poor reader trying to make sense of it all.  The...]]></description><link>https://www.iso27001security.com/post/painting-the-forth-bridge</link><guid isPermaLink="false">697fd7f2423a54390b958a18</guid><category><![CDATA[ISO27k standards]]></category><pubDate>Mon, 02 Feb 2026 00:13:10 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_7a9279fd5bfc473cb33b4acf125cde67~mv2.png/v1/fit/w_1000,h_736,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Two new ISO27k projects: ISMS guidance for the neglected mediums and the SME dilemma]]></title><description><![CDATA[No, not that kind of 'medium'! Two new ISO/IEC JTC 1/SC 27/WG 1  standards projects are under way, raising fundamental questions about how we standardise and promote information security. 1. Practical ISMS implementation guidance First, we are defining the scope and plan for a second part to ISO/IEC 27003  (possibly a distinct standard or some other format). This project aims to offer ISMS implementation advice for small, medium and large organizations, with a specific emphasis on the...]]></description><link>https://www.iso27001security.com/post/two-new-iso27k-projects-isms-guidance-for-the-neglected-mediums-and-the-sme-dilemma</link><guid isPermaLink="false">69729f489f5bcea228501592</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Security]]></category><pubDate>Thu, 22 Jan 2026 23:49:54 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_a744121319be4e10b4c88d82bafc6e5b~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item><item><title><![CDATA[Cyber-insurance standard update]]></title><description><![CDATA[I've received the first W orking D raft for the revision of ISO/IEC 27102 :2019 - "Information security management - Guidelines for cyber-insurance ". With a new title already approved ("Information security, cybersecurity and privacy protection — Guidelines for applying ISO/IEC 27001 and related standards in support of cyber insurance ") and a revised scope, the committee intends to refocus the second edition more explicitly on the I nformation S ecurity M anagement S ystem "to make this...]]></description><link>https://www.iso27001security.com/post/cyber-insurance-standard-update</link><guid isPermaLink="false">696a933f3e23fce293736d37</guid><category><![CDATA[ISO27k standards]]></category><category><![CDATA[Control]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Policy]]></category><category><![CDATA[Security]]></category><pubDate>Fri, 16 Jan 2026 20:39:37 GMT</pubDate><enclosure url="https://static.wixstatic.com/media/51ee86_e0b55d6972004645b03ae5771a10a020~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png" length="0" type="image/png"/><dc:creator>Gary Hinson</dc:creator></item></channel></rss>