Due to an ISO policy decision, the current 2026 sixth edition dropped previous editions' extensive glossaries of dozens of ISO27k terms, leaving just a dozen actually used in this standard. However, the official definitions remain available online in ISO's Online Browsing Platform and IEC's Electropedia.  

Alternatively, the Cybersecurity Hyperglossary defines well over 5,000 terms in plain English, as well as quoting thousands of formal definitions. Get ~800 pages for two-thirds the price of these 11 !

Shameless plug!  Have you got yours yet? 

The 2026 edition includes a notable but easily-overlooked change regarding the identification of 'interested parties' (stakeholders) for an organisation's information security:  "Interested parties can include not only the organization’s customers, suppliers, business partners, employees, shareholders, but also government officials and, potentially, regulators. Competitors and criminals are also interested parties. Their requirements should be especially addressed by the information security controls of the ISMS. Indeed, a purpose of such information security controls is to protect the organization from the activities of such third parties."   So, an appreciation of the organisation's potential adversaries implies updating the risk identification, analysis, evaluation and treatment accordingly.  

ISO/IEC 27000 is quite liberal in its use of the word 'requirement' and similar terms such as 'need', 'necessary', 'objective', 'essential', 'expected'.  In ISO standards such as ISO/IEC 27001, 'requirement' generally means a statement formally defining or declaring something that is mandatory in order to claim conformity - a narrow interpretation.  ISO/IEC 27000 is not exclusively concerned with mandatory requirements for conformity assessment purposes, so has a more liberal interpretation.   

The information security controls in ISO/IEC 27001 (annex A), '27002, '27010, '27011, '27017 and '27019 are called “Candidate necessary information security controls” - a curiously ambiguous turn of phrase. ‘Necessary’ here is for management to determine according to its evaluation of the organisation's information risks relative to the risk appetite. ‘Candidate’ is clearly not ‘required’ and is less than ‘suggested’, but still some readers and inept auditors may feel the controls should or perhaps must be implemented.

[Spoiler alert] 

They don't.

The summary claims that ISO/IEC 27000 "clarifies how [18 ISO27k standards] relate to each other". While a table and diagram group the 18, the interrelationships or dependencies between them are not explained, unfortunately. For example, the 'sector-specific' standards ISO/IEC 27011, '27017 and '27019, identify information security controls (mostly drawn from ISO/IEC 27002) for telecoms, cloud and power companies, respectively: the processes of identifying and evaluating information risks to determine which controls are necessary, justifying the associated investments and implementation details, monitoring and managing them to achieve, maintain and gain assurance of their adequacy (efficiency and effectiveness) are covered by several other ISO27k standards. Again, those three standards do not mandate specific information security controls, nor are they comprehensive. They are generic suggestions.