Back Up Next ISO/IEC 27045 ISO/IEC 27045 — Information technology — Big data security and privacy — Guidelines for managing big data risks [DRAFT] Up Abstract ISO/IEC 27045 "provides guidance on how to navigate the threats that can arise during the big data life cycle from the various big data characteristics that are unique to big data: volume, velocity, variety, variability, volatility, veracity and value, including when using big data for the design and implementation of AI systems. [ISO/IEC 27045] can help organizations build or enhance their big data security and privacy capabilities, including when using big data in the development and use of AI systems.” [Source: ISO/IEC JTC 1/SC 27 Committee Doc 11 May 2025] Introduction ‘Big data’ systems present numerous information security, privacy and technological challenges due to complexity plus the sheer quantity and volatility of the data. Scope The standard is intended to help organisations build or enhance their information security and privacy capabilities relating to big data systems, perhaps as part of AI systems design and implementation. Structure Main clauses: 4: Overview - a brief summary. 5: Big data - explores the information risk and security implications of big data in addition to the 'traditional' concerns for conventional IT systems. Describes the seven v's. 6: Security and privacy threats and controls to big data - stepping through the seven 'v ' characteristics of big data (v olume, v elocity, v ariety, v ariability, v olatility, v eracity and v alue), identifying pertinent threats and controls. 7: Big data risk management process - builds on the guidance in ISO/IEC 27005 . Annex A: maps the organisational and technological controls from clause 6 against the threats relating to the seven v's. Annex B: use cases . Status This standard was initially proposed in 2017. Having run off-the-rails in 2021, the drafting project re-started in 2024. It is currently at F inal D raft I nternational S tandard stage and (if approved) may be published towards the end of 2026, more likely in 2027. Commentary The definition of ‘big data’ quoted from ISO/IEC 20456:2019 does not (in my personal, rather jaundiced/cynical opinion) reflect its widespread use in the IT industry at present. “Extensive datasets primarily in the characteristics of volume, variety, velocity, and/or variability that require a scalable architecture for efficient storage, manipulation, and analysis ”. I prefer Wikipedia ’s description: “Current usage of the term big data tends to refer to the use of predictive analytics, user behavior analytics, or certain other advanced data analytics methods that extract value from data, and seldom to a particular size of data set. "There is little doubt that the quantities of data now available are indeed large, but that's not the most relevant characteristic of this new data ecosystem." Analysis of data sets can find new correlations to "spot business trends, prevent diseases, combat crime and so on." Scientists, business executives, practitioners of medicine, advertising and governments alike regularly meet difficulties with large data-sets in areas including Internet searches, fintech, urban informatics, and business informatics. Scientists encounter limitations in e-Science work, including meteorology, genomics, connectomics, complex physics simulations, biology and environmental research.” It seems to me a defining characteristic is that big data is (are!) so big that conventional database management systems are unable to cope with the complexity and dynamics/volatility, struggling to maintain integrity given so many coincident changes. Beyond the limits of their scalability, conventional architectures start to experience constraints and failures (including security control and privacy issues), no matter how much raw CPU power, network bandwidth and storage capacity is thrown at the challenge. That implies the need for fundamentally different approaches with novel information risks most likely requiring novel controls. It remains to be seen what this standard will actually recommend: this is cutting-edge stuff. Hopefully this standard will refer to others for the low-level and relatively conventional data security and privacy controls that apply to small and medium data, focusing instead on the high-level and novel aspects and processes that are unique to big data e.g. : Strategic management of big data sets, big data systems etc. , including governance arrangements to monitor and control the management and operational activities as a whole (e.g. overall programme as well as individual project management) and the business/strategy aspects and requirements (e.g. enormous financial investment in huge systems implies enormous expected returns); Architecture and design of big data systems - specifically the data security and privacy aspects including information risk assessment, compliance, ethics, data aggregation, inference, interconnectivity (both within and without the organisation), access controls, metadata management and security, resilience etc. ; Operation and use of big data systems e.g . how to classify and segregate data and functions, how to determine/define and assign access rights/permissions, what privacy and security roles and responsibilities might be appropriate; Maintenance and support of big data systems, including their security and privacy aspects; Capacity and performance management including the dynamics and challenges arising; Incident management, change management and so on (adapting conventional processes for the big data environment). Potentially, the standard could get into advanced/novel data/system security controls and privacy approaches involving artificial intelligence, instrumentation, anomaly and fraud detection, automated responses etc. ... but it looks as if the standard’s initial release will be a more modest starting point, and fair enough. Up Up Up This page last updated: 20 October 2026

ISO27k standards List ISO/IEC 27000 Open ISO/IEC 27000:2026 — Information security, cybersecurity and privacy protection — I nformation S ecurity M anagement S ystems — Overview (sixth edition) ISO/IEC 27001 Open ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements (third edition) ISO/IEC 27002 Open ISO/IEC 27002:2022 — Information security, cybersecurity and privacy protection — Information security controls (third edition) ISO/IEC 27003 Open ISO/IEC 27003:2017 — Information technology — Security techniques — Information security management systems — Guidance (second edition) ISO/IEC 27004 Open ISO/IEC 27004:2016 — Information technology — Security techniques — Information security management ― Monitoring, measurement, analysis and evaluation (second edition) ISO/IEC 27005 Open ISO/IEC 27005:2022 — Information security, cybersecurity and privacy protection — Guidance on managing information security risks (fourth edition ) ISO/IEC 27006-1 Open ISO/IEC 27006-1:2024 — Information technology, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General (fourth edition) ISO/IEC 27007 Open ISO/IEC 27007:2020 — Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing (third edition) ISO/IEC TS 27008 Open ISO/IEC TS 27008:2019 — Information technology — Security techniques — Guidelines for the assessment of information security controls (second edition) ISO/IEC 27010 Open ISO/IEC 27010:2015 — Information technology — Security techniques — Information security management for inter-sector and inter-organisational communications (second edition) ISO/IEC 27011 Open ISO/IEC 27011:2024 / ITU-T X.1051 — Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for telecommunications organizations (third edition) ISO/IEC 27013 Open ISO/IEC 27013:2021 (amended ) — Information security, cybersecurity and privacy protection — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 (third edition) ISO/IEC 27014 Open ISO/IEC 27014:2020 / ITU-T X.1054 — Information security, cybersecurity and privacy protection — Governance of information security (second edition) ISO/IEC TR 27016 Open ISO/IEC TR 27016:2014 — Information technology — Security techniques — Information security management — Organisational economics (first edition) ISO/IEC 27017 Open I SO/IEC 27017:2026 / ITU-T X.1631 — Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services [second edition] ISO/IEC 27018 Open ISO/IEC 27018:2025 — Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors (third edition) ISO/IEC 27019 Open ISO/IEC 27019:2024 — Information security, cybersecurity and privacy protection — Information security controls for the energy utility industry (second edition) ISO/IEC 27021 Open ISO/IEC 27021:2017 (amended ) — Information technology — Security techniques — Competence requirements for information security management systems professionals (first edition) ISO/IEC TS 27022 Open ISO/IEC TS 27022:2021 — Information technology — Guidance on information security management system processes (first edition) ISO/IEC TR 27024 Open ISO/IEC TR 27024 — Technical Report — Information security, cybersecurity and privacy protection — Information on government and regulatory use of information security standards [DRAFT] ISO/IEC 27028 Open ISO/IEC 27028 — Information security, cybersecurity and privacy protection — Guidance on using information security control attributes [DRAFT] ISO/IEC 27031 Open ISO/IEC 27031:2025 — Cybersecurity — Information and communication technology readiness for business continuity (second edition) ISO/IEC 27032 Open ISO/IEC 27032:2023 — Cybersecurity — Guidelines for Internet security (second edition) ISO/IEC 27033-1 Open ISO/IEC 27033-1:2015 — Information technology — Security techniques — Network security — Part 1: Overview and concepts (second edition) ISO/IEC 27033-2 Open ISO/IEC 27033-2:2012 Information technology — Security techniques — Network security — Part 2: Guidelines for the design and implementation of network security (first edition) ISO/IEC 27033-3 Open ISO/IEC 27033-3:2010 Information technology — Security techniques — Network security — Part 3: Reference networking scenarios — threats, design techniques and control issues (first edition) ISO/IEC 27033-4 Open ISO/IEC 27033-4:2014 Information technology — Security techniques — Network security — Part 4: Securing communications between networks using security gateways (first edition) ISO/IEC 27033-5 Open ISO/IEC 27033-5:2013 Information technology — Security techniques — Network security — Part 5: Securing communications across networks using Virtual Private Networks (VPNs) (first edition) ISO/IEC 27033-6 Open ISO/IEC 27033-6:2016 Information technology — Security techniques — Network security — Part 6: Securing wireless IP network access (first edition) ISO/IEC 27033-7 Open ISO/IEC 27033-7:2023 Information technology — Network security — Part 7: Guidelines for network virtualization security (first edition) ISO/IEC 27034-1 Open ISO/IEC 27034-1:2011 (corrected )— Information technology — Security techniques — Application security — Part 1: Overview and concepts (first edition) ISO/IEC 27034-2 Open ISO/IEC 27034-2:2015 — Information technology — Security techniques — Application security — Part 2: organisation normative framework (first edition) ISO/IEC 27034-3 Open ISO/IEC 27034-3:2018 — Information technology — Security techniques — Application security — Part 3: Application security management process (first edition) ISO/IEC 27034-5 Open ISO/IEC 27034-5:2017 — Information technology — Security techniques — Application security — Part 5: Protocols and application security controls data structure (first edition) ISO/IEC 27034-6 Open ISO/IEC 27034-6:2016 — Information technology — Security techniques — Application security — Part 6: Case studies (first edition) ISO/IEC 27034-7 Open ISO/IEC 27034-7:2018 — Information technology — Security techniques — Application security — Part 7: Assurance prediction framework (first edition) ISO/IEC 27035-1 Open ISO/IEC 27035-1:2023 — Information technology — Information security incident management — Part 1: Principles and process (second edition) ISO/IEC 27035-2 Open ISO/IEC 27035-2:2023 — Information technology — Information security incident management — Part 2: Guidelines to plan and prepare for incident response (second edition) ISO/IEC 27035-3 Open ISO/IEC 27035-3:2020 — Information technology — Information security incident management — Part 3: Guidelines for ICT incident response operations (first edition) ISO/IEC 27035-4 Open ISO/IEC 27035-4:2024 — Information technology — Information security incident management — Part 4: Coordination (first edition) ISO/IEC 27036-1 Open ISO/IEC 27036-1:2021 — Cybersecurity — Supplier relationships — Part 1: Overview and concepts (second edition) ISO/IEC 27036-2 Open ISO/IEC 27036-2:2022 — Cybersecurity — Supplier relationships — Part 2: Requirements (second edition) ISO/IEC 27036-3 Open ISO/IEC 27036-3:2023 — Cybersecurity — Supplier relationships — Part 3: Guidelines for hardware, software, and services supply chain security (second edition) ISO/IEC 27036-4 Open ISO/IEC 27036–4:2016 — Information security — Security techniques — Information security for supplier relationships — Part 4: Guidelines for security of cloud services (first edition) ISO/IEC 27037 Open ISO/IEC 27037:2012 — Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence (first edition) ISO/IEC 27038 Open ISO/IEC 27038:2014 — Information technology — Security techniques — Specification for digital redaction (first edition) ISO/IEC 27039 Open ISO/IEC 27039:2015 — Information technology — Security techniques — Selection, deployment and operations of intrusion detection and prevention systems (IDPS) (first edition) ISO/IEC 27040 Open ISO/IEC 27040:2024 — Information technology — Security techniques — Storage security (second edition) ISO/IEC 27041 Open ISO/IEC 27041:2015 — Information technology — Security techniques — Guidance on assuring suitability and adequacy of incident investigative method (first edition) ISO/IEC 27042 Open ISO/IEC 27042:2015 — Information technology — Security techniques — Guidelines for the analysis and interpretation of digital evidence (first edition) ISO/IEC 27043 Open ISO/IEC 27043:2015 — Information technology — Security techniques — Incident investigation principles and processes (first edition) ISO/IEC 27045 Open ISO/IEC 27045 — Information technology — Big data security and privacy — Guidelines for managing big data risks [DRAFT] ISO/IEC 27046 Open ISO/IEC 27046 — Information technology — Big data security and privacy — Implementation guidelines [DRAFT] ISO/IEC 27050-1 Open ISO/IEC 27050-1:2019 — Information technology — Security techniques — Electronic discovery — Part 1: Overview and concepts (second edition) ISO/IEC 27050-2 Open ISO/IEC 27050-2:2018 — Information technology — Security techniques — Electronic discovery — Part 2: Guidance for governance and management of electronic discovery (first edition) ISO/IEC 27050-3 Open ISO/IEC 27050-3:2020 — Information technology — Security techniques — Electronic discovery — Part 3: Code of practice for electronic discovery (second edition) ISO/IEC 27050-4 Open ISO/IEC 27050-4:2021 — Information technology — Electronic discovery — Part 4: Technical readiness (first edition) ISO/IEC 27070 Open ISO/IEC 27070:2021 — Information technology — Security techniques — Requirements for establishing virtualized roots of trust (first edition) ISO/IEC 27071 Open ISO/IEC 27071:2023 — Cybersecurity — Security recommendations for establishing trusted connections between devices and services (first edition) ISO/IEC 27090 Open ISO/IEC 27090:2026 — Cybersecurity — Artificial Intelligence (AI) — Addressing security threats and compromises to AI systems [First edition] ISO/IEC 27091 Open ISO/IEC 27091 — Cybersecurity and privacy — Artificial Intelligence — Privacy protection [DRAFT] ISO/IEC 27099 Open ISO/IEC 27099:2022 — Information technology — Public key infrastructure — Practices and policy framework (first edition) ISO/IEC TS 27100 Open ISO/IEC TS 27100:2020 — Information technology — Cybersecurity — Overview and concepts (first edition) ISO/IEC 27102 Open ISO/IEC 27102:2019 — Information security management — Guidelines for cyber-insurance (first edition) ISO/IEC TS 27103 Open ISO/IEC TS 27103:2026 — Cybersecurity — Guidance on using ISO and IEC standards in a cybersecurity framework (first edition*) ISO/IEC TR 27109 Open ISO/IEC TR 27109 — Information security, cybersecurity and privacy protection — Cybersecurity education and training [DRAFT] ISO/IEC TS 27110 Open ISO/IEC TS 27110:2021 — Information security, cybersecurity and privacy protection — Cybersecurity framework development guidelines (first edition) ISO/IEC TS 27115-1 Open ISO/IEC TS 27115-1 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 1: Introduction and framework overview (DRAFT) ISO/IEC TS 27115-2 Open ISO/IEC TS 27115-2 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 2: Security architecture evaluation (DRAFT) ISO/IEC TS 27115-3 Open ISO/IEC TS 27115-3 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 3: Security profiles [DRAFT] ISO/IEC TS 27116-1 Open ISO/IEC TS 27116-1 — Cybersecurity multipurpose evaluation — Part 1: Framework [DRAFT] ISO/IEC TR 27116-2 Open ISO/IEC TR 27116-2 Information security, cybersecurity and privacy protection — Best practices on reuse of single evaluations for multipurpose usage [DRAFT] ISO/IEC 27400 Open ISO/IEC 27400:2022 — Cybersecurity — IoT security and privacy — Guidelines (first edition) ISO/IEC 27402 Open ISO/IEC 27402:2023 — Cybersecurity — IoT security and privacy — Device baseline requirements [first edition] ISO/IEC 27403 Open ISO/IEC 27403:2024 — Cybersecurity — IoT security and privacy — Guidelines for IoT-domotics (first edition) ISO/IEC 27404 Open ISO/IEC 27404:2025 — Cybersecurity — IoT security and privacy — Cybersecurity labelling framework for consumer IoT [first edition] ISO/IEC 27503 Open ISO/IEC 27503 — Privacy and security guidelines on intelligent travel services [ P reliminary W ork I tem] ISO/IEC 27504 Open ISO/IEC 27504 — Privacy protection of user avatar and system avatar interactions in the metaverse [DRAFT] ISO/IEC TR 27550 Open ISO/IEC TR 27550:2019 — Information technology — Security techniques — Privacy engineering for system life cycle processes (first edition) ISO/IEC 27551 Open ISO/IEC 27551:2021 — Information security, cybersecurity and privacy protection — Requirements for attribute-based unlinkable entity authentication (first edition) ISO/IEC 27553-1 Open ISO/IEC 27553-1:2022 — Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 1: local modes (first edition) ISO/IEC 27553-2 Open ISO/IEC 27553-2:2025 — Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 2: remote modes (first edition) ISO/IEC 27554 Open ISO/IEC 27554:2024 — Information security, cybersecurity and privacy protection — Application of ISO 31000 for assessment of identity-related risk [first edition] ISO/IEC 27555 Open ISO/IEC 27555:2021 — Information security, cybersecurity and privacy protection — Guidelines on personally identifiable information deletion (first edition) ISO/IEC 27556 Open ISO/IEC 27556:2022 — Information security, cybersecurity and privacy protection — User-centric privacy preferences management framework (first edition) ISO/IEC 27557 Open ISO/IEC 27557:2022 — Information technology — Information security, cybersecurity and privacy protection — Application of ISO 31000:2018 for organizational privacy risk management (first edition) ISO/IEC 27559 Open ISO/IEC 27559:2022 — Information security, cybersecurity and privacy protection — Privacy-enhancing data de-identification framework (first edition) ISO/IEC TS 27560 Open ISO/IEC TS 27560:2023 — Privacy technologies — Consent record information structure (first edition) ISO/IEC 27561 Open ISO/IEC 27561:2024 — Information security, cybersecurity and privacy protection — Privacy operationalisation model and method for engineering (POMME) ( first edition) ISO/IEC 27562 Open ISO/IEC 27562:2024 — Information technology — Security techniques — Privacy guidelines for fintech services (first edition) ISO/IEC TR 27563 Open ISO/IEC TR 27563:2023 — Security and privacy in artificial intelligence use cases — Best practices (first edition) ISO/IEC TS 27564 Open ISO/IEC TS 27564:2025 — Privacy protection — Guidance on the use of models for privacy engineering [first edition] ISO/IEC 27565 Open ISO/IEC 27565:2026 — Information technology, cybersecurity and privacy protection — Guidelines on privacy preservation based on zero knowledge proofs [First edition] ISO/IEC 27566-1 Open ISO/IEC 27566-1:2025 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 1: Framework [First edition] ISO/IEC 27566-2 Open ISO/IEC 27566-2 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 2: Technical approaches and guidance for implementation [Draft] ISO/IEC 27566-3 Open ISO/IEC 27566-3 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 3: Approaches to analysis or comparison [DRAFT] ISO/IEC TS 27568 Open ISO/IEC TS 27568 — Security and privacy of digital twins [DRAFT] ISO/IEC TS 27569 Open ISO/IEC TS 27569 — Personal identifiable information (PII) processing record information structure [PROPOSAL] ISO/IEC TS 27570 Open ISO/IEC TS 27570:2021 — Privacy protection — Privacy guidelines for smart cities (first edition) ISO/IEC 27573 Open ??

All about the ISO/IEC 27000-series information risk and security management standards "ISO27k" refers to the ISO/IEC 27000 series standards, a set of 100 good practice guidelines for managing the risks affecting or involving information. They are listed below. "ISO/IEC" denotes the bodies that jointly developed the standards. ISO is the International Organization for Standardisation , IEC is the I nternational E lectrotechnical C ommission . Effective information risk management protects (secures) valuable information against harm whilst also permitting its use (exploitation) for business purposes. This involves systematically: Identifying risks of concern, analysing and evaluating them; Treating (avoiding, sharing, mitigating or accepting) the risks appropriately; Ensuring the risk treatments are working properly (gaining assurance ); and Handling changes and driving continual improvement (maturity ). The standards collectively comprise a ‘management system’ (a coherent suite of governance and management arrangements) that can be adapted to suit any organisation's unique situation - any size, any industry, any type, anywhere. Two key ISO27k standards are: ISO/IEC 27001 (I nformation S ecurity M anagement S ystem - the ISMS ); and ISO/IEC 27701 (P rivacy I nformation M anagement S ystem - the PIMS ). Other ISO27k standards expand on various aspects in more detail: ISO/IEC 27005 , for instance, elaborates on information risk management, ISO/IEC 27004 concerns security metrics and ISO/IEC 27002 covers cybersecurity and other technical controls. Click the More links below to explore any ISO27k standard, or use the magnifying glass above to search this website for specific words and phrases. Introduction The ISO27k standards ISO/IEC 27000 ISO/IEC 27000:2026 — Information security, cybersecurity and privacy protection — I nformation S ecurity M anagement S ystems — Overview (sixth edition) More ISO/IEC 27001 ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements (third edition) More ISO/IEC 27002 ISO/IEC 27002:2022 — Information security, cybersecurity and privacy protection — Information security controls (third edition) More ISO/IEC 27003 ISO/IEC 27003:2017 — Information technology — Security techniques — Information security management systems — Guidance (second edition) More ISO/IEC 27004 ISO/IEC 27004:2016 — Information technology — Security techniques — Information security management ― Monitoring, measurement, analysis and evaluation (second edition) More ISO/IEC 27005 ISO/IEC 27005:2022 — Information security, cybersecurity and privacy protection — Guidance on managing information security risks (fourth edition ) More ISO/IEC 27006-1 ISO/IEC 27006-1:2024 — Information technology, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General (fourth edition) More ISO/IEC 27007 ISO/IEC 27007:2020 — Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing (third edition) More ISO/IEC TS 27008 ISO/IEC TS 27008:2019 — Information technology — Security techniques — Guidelines for the assessment of information security controls (second edition) More ISO/IEC 27010 ISO/IEC 27010:2015 — Information technology — Security techniques — Information security management for inter-sector and inter-organisational communications (second edition) More ISO/IEC 27011 ISO/IEC 27011:2024 / ITU-T X.1051 — Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for telecommunications organizations (third edition) More ISO/IEC 27013 ISO/IEC 27013:2021 (amended ) — Information security, cybersecurity and privacy protection — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 (third edition) More ISO/IEC 27014 ISO/IEC 27014:2020 / ITU-T X.1054 — Information security, cybersecurity and privacy protection — Governance of information security (second edition) More ISO/IEC TR 27016 ISO/IEC TR 27016:2014 — Information technology — Security techniques — Information security management — Organisational economics (first edition) More ISO/IEC 27017 I SO/IEC 27017:2026 / ITU-T X.1631 — Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services [second edition] More ISO/IEC 27018 ISO/IEC 27018:2025 — Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors (third edition) More ISO/IEC 27019 ISO/IEC 27019:2024 — Information security, cybersecurity and privacy protection — Information security controls for the energy utility industry (second edition) More ISO/IEC 27021 ISO/IEC 27021:2017 (amended ) — Information technology — Security techniques — Competence requirements for information security management systems professionals (first edition) More ISO/IEC TS 27022 ISO/IEC TS 27022:2021 — Information technology — Guidance on information security management system processes (first edition) More ISO/IEC TR 27024 ISO/IEC TR 27024 — Technical Report — Information security, cybersecurity and privacy protection — Information on government and regulatory use of information security standards [DRAFT] More ISO/IEC 27028 ISO/IEC 27028 — Information security, cybersecurity and privacy protection — Guidance on using information security control attributes [DRAFT] More ISO/IEC 27031 ISO/IEC 27031:2025 — Cybersecurity — Information and communication technology readiness for business continuity (second edition) More ISO/IEC 27032 ISO/IEC 27032:2023 — Cybersecurity — Guidelines for Internet security (second edition) More ISO/IEC 27033-1 ISO/IEC 27033-1:2015 — Information technology — Security techniques — Network security — Part 1: Overview and concepts (second edition) More ISO/IEC 27033-2 ISO/IEC 27033-2:2012 Information technology — Security techniques — Network security — Part 2: Guidelines for the design and implementation of network security (first edition) More ISO/IEC 27033-3 ISO/IEC 27033-3:2010 Information technology — Security techniques — Network security — Part 3: Reference networking scenarios — threats, design techniques and control issues (first edition) More ISO/IEC 27033-4 ISO/IEC 27033-4:2014 Information technology — Security techniques — Network security — Part 4: Securing communications between networks using security gateways (first edition) More ISO/IEC 27033-5 ISO/IEC 27033-5:2013 Information technology — Security techniques — Network security — Part 5: Securing communications across networks using Virtual Private Networks (VPNs) (first edition) More ISO/IEC 27033-6 ISO/IEC 27033-6:2016 Information technology — Security techniques — Network security — Part 6: Securing wireless IP network access (first edition) More ISO/IEC 27033-7 ISO/IEC 27033-7:2023 Information technology — Network security — Part 7: Guidelines for network virtualization security (first edition) More ISO/IEC 27034-1 ISO/IEC 27034-1:2011 (corrected )— Information technology — Security techniques — Application security — Part 1: Overview and concepts (first edition) More ISO/IEC 27034-2 ISO/IEC 27034-2:2015 — Information technology — Security techniques — Application security — Part 2: organisation normative framework (first edition) More ISO/IEC 27034-3 ISO/IEC 27034-3:2018 — Information technology — Security techniques — Application security — Part 3: Application security management process (first edition) More ISO/IEC 27034-5 ISO/IEC 27034-5:2017 — Information technology — Security techniques — Application security — Part 5: Protocols and application security controls data structure (first edition) More ISO/IEC 27034-6 ISO/IEC 27034-6:2016 — Information technology — Security techniques — Application security — Part 6: Case studies (first edition) More ISO/IEC 27034-7 ISO/IEC 27034-7:2018 — Information technology — Security techniques — Application security — Part 7: Assurance prediction framework (first edition) More ISO/IEC 27035-1 ISO/IEC 27035-1:2023 — Information technology — Information security incident management — Part 1: Principles and process (second edition) More ISO/IEC 27035-2 ISO/IEC 27035-2:2023 — Information technology — Information security incident management — Part 2: Guidelines to plan and prepare for incident response (second edition) More ISO/IEC 27035-3 ISO/IEC 27035-3:2020 — Information technology — Information security incident management — Part 3: Guidelines for ICT incident response operations (first edition) More ISO/IEC 27035-4 ISO/IEC 27035-4:2024 — Information technology — Information security incident management — Part 4: Coordination (first edition) More ISO/IEC 27036-1 ISO/IEC 27036-1:2021 — Cybersecurity — Supplier relationships — Part 1: Overview and concepts (second edition) More ISO/IEC 27036-2 ISO/IEC 27036-2:2022 — Cybersecurity — Supplier relationships — Part 2: Requirements (second edition) More ISO/IEC 27036-3 ISO/IEC 27036-3:2023 — Cybersecurity — Supplier relationships — Part 3: Guidelines for hardware, software, and services supply chain security (second edition) More ISO/IEC 27036-4 ISO/IEC 27036–4:2016 — Information security — Security techniques — Information security for supplier relationships — Part 4: Guidelines for security of cloud services (first edition) More ISO/IEC 27037 ISO/IEC 27037:2012 — Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence (first edition) More ISO/IEC 27038 ISO/IEC 27038:2014 — Information technology — Security techniques — Specification for digital redaction (first edition) More ISO/IEC 27039 ISO/IEC 27039:2015 — Information technology — Security techniques — Selection, deployment and operations of intrusion detection and prevention systems (IDPS) (first edition) More ISO/IEC 27040 ISO/IEC 27040:2024 — Information technology — Security techniques — Storage security (second edition) More ISO/IEC 27041 ISO/IEC 27041:2015 — Information technology — Security techniques — Guidance on assuring suitability and adequacy of incident investigative method (first edition) More ISO/IEC 27042 ISO/IEC 27042:2015 — Information technology — Security techniques — Guidelines for the analysis and interpretation of digital evidence (first edition) More ISO/IEC 27043 ISO/IEC 27043:2015 — Information technology — Security techniques — Incident investigation principles and processes (first edition) More ISO/IEC 27045 ISO/IEC 27045 — Information technology — Big data security and privacy — Guidelines for managing big data risks [DRAFT] More ISO/IEC 27046 ISO/IEC 27046 — Information technology — Big data security and privacy — Implementation guidelines [DRAFT] More ISO/IEC 27050-1 ISO/IEC 27050-1:2019 — Information technology — Security techniques — Electronic discovery — Part 1: Overview and concepts (second edition) More ISO/IEC 27050-2 ISO/IEC 27050-2:2018 — Information technology — Security techniques — Electronic discovery — Part 2: Guidance for governance and management of electronic discovery (first edition) More ISO/IEC 27050-3 ISO/IEC 27050-3:2020 — Information technology — Security techniques — Electronic discovery — Part 3: Code of practice for electronic discovery (second edition) More ISO/IEC 27050-4 ISO/IEC 27050-4:2021 — Information technology — Electronic discovery — Part 4: Technical readiness (first edition) More ISO/IEC 27070 ISO/IEC 27070:2021 — Information technology — Security techniques — Requirements for establishing virtualized roots of trust (first edition) More ISO/IEC 27071 ISO/IEC 27071:2023 — Cybersecurity — Security recommendations for establishing trusted connections between devices and services (first edition) More ISO/IEC 27090 ISO/IEC 27090:2026 — Cybersecurity — Artificial Intelligence (AI) — Addressing security threats and compromises to AI systems [First edition] More ISO/IEC 27091 ISO/IEC 27091 — Cybersecurity and privacy — Artificial Intelligence — Privacy protection [DRAFT] More ISO/IEC 27099 ISO/IEC 27099:2022 — Information technology — Public key infrastructure — Practices and policy framework (first edition) More ISO/IEC TS 27100 ISO/IEC TS 27100:2020 — Information technology — Cybersecurity — Overview and concepts (first edition) More ISO/IEC 27102 ISO/IEC 27102:2019 — Information security management — Guidelines for cyber-insurance (first edition) More ISO/IEC TS 27103 ISO/IEC TS 27103:2026 — Cybersecurity — Guidance on using ISO and IEC standards in a cybersecurity framework (first edition*) More ISO/IEC TR 27109 ISO/IEC TR 27109 — Information security, cybersecurity and privacy protection — Cybersecurity education and training [DRAFT] More ISO/IEC TS 27110 ISO/IEC TS 27110:2021 — Information security, cybersecurity and privacy protection — Cybersecurity framework development guidelines (first edition) More ISO/IEC TS 27115-1 ISO/IEC TS 27115-1 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 1: Introduction and framework overview (DRAFT) More ISO/IEC TS 27115-2 ISO/IEC TS 27115-2 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 2: Security architecture evaluation (DRAFT) More ISO/IEC TS 27115-3 ISO/IEC TS 27115-3 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 3: Security profiles [DRAFT] More ISO/IEC TS 27116-1 ISO/IEC TS 27116-1 — Cybersecurity multipurpose evaluation — Part 1: Framework [DRAFT] More ISO/IEC TR 27116-2 ISO/IEC TR 27116-2 Information security, cybersecurity and privacy protection — Best practices on reuse of single evaluations for multipurpose usage [DRAFT] More ISO/IEC 27400 ISO/IEC 27400:2022 — Cybersecurity — IoT security and privacy — Guidelines (first edition) More ISO/IEC 27402 ISO/IEC 27402:2023 — Cybersecurity — IoT security and privacy — Device baseline requirements [first edition] More ISO/IEC 27403 ISO/IEC 27403:2024 — Cybersecurity — IoT security and privacy — Guidelines for IoT-domotics (first edition) More ISO/IEC 27404 ISO/IEC 27404:2025 — Cybersecurity — IoT security and privacy — Cybersecurity labelling framework for consumer IoT [first edition] More ISO/IEC 27503 ISO/IEC 27503 — Privacy and security guidelines on intelligent travel services [ P reliminary W ork I tem] More ISO/IEC 27504 ISO/IEC 27504 — Privacy protection of user avatar and system avatar interactions in the metaverse [DRAFT] More ISO/IEC TR 27550 ISO/IEC TR 27550:2019 — Information technology — Security techniques — Privacy engineering for system life cycle processes (first edition) More ISO/IEC 27551 ISO/IEC 27551:2021 — Information security, cybersecurity and privacy protection — Requirements for attribute-based unlinkable entity authentication (first edition) More ISO/IEC 27553-1 ISO/IEC 27553-1:2022 — Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 1: local modes (first edition) More ISO/IEC 27553-2 ISO/IEC 27553-2:2025 — Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 2: remote modes (first edition) More ISO/IEC 27554 ISO/IEC 27554:2024 — Information security, cybersecurity and privacy protection — Application of ISO 31000 for assessment of identity-related risk [first edition] More ISO/IEC 27555 ISO/IEC 27555:2021 — Information security, cybersecurity and privacy protection — Guidelines on personally identifiable information deletion (first edition) More ISO/IEC 27556 ISO/IEC 27556:2022 — Information security, cybersecurity and privacy protection — User-centric privacy preferences management framework (first edition) More ISO/IEC 27557 ISO/IEC 27557:2022 — Information technology — Information security, cybersecurity and privacy protection — Application of ISO 31000:2018 for organizational privacy risk management (first edition) More ISO/IEC 27559 ISO/IEC 27559:2022 — Information security, cybersecurity and privacy protection — Privacy-enhancing data de-identification framework (first edition) More ISO/IEC TS 27560 ISO/IEC TS 27560:2023 — Privacy technologies — Consent record information structure (first edition) More ISO/IEC 27561 ISO/IEC 27561:2024 — Information security, cybersecurity and privacy protection — Privacy operationalisation model and method for engineering (POMME) ( first edition) More ISO/IEC 27562 ISO/IEC 27562:2024 — Information technology — Security techniques — Privacy guidelines for fintech services (first edition) More ISO/IEC TR 27563 ISO/IEC TR 27563:2023 — Security and privacy in artificial intelligence use cases — Best practices (first edition) More ISO/IEC TS 27564 ISO/IEC TS 27564:2025 — Privacy protection — Guidance on the use of models for privacy engineering [first edition] More ISO/IEC 27565 ISO/IEC 27565:2026 — Information technology, cybersecurity and privacy protection — Guidelines on privacy preservation based on zero knowledge proofs [First edition] More ISO/IEC 27566-1 ISO/IEC 27566-1:2025 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 1: Framework [First edition] More ISO/IEC 27566-2 ISO/IEC 27566-2 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 2: Technical approaches and guidance for implementation [Draft] More ISO/IEC 27566-3 ISO/IEC 27566-3 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 3: Approaches to analysis or comparison [DRAFT] More ISO/IEC TS 27568 ISO/IEC TS 27568 — Security and privacy of digital twins [DRAFT] More ISO/IEC TS 27569 ISO/IEC TS 27569 — Personal identifiable information (PII) processing record information structure [PROPOSAL] More ISO/IEC TS 27570 ISO/IEC TS 27570:2021 — Privacy protection — Privacy guidelines for smart cities (first edition) More ISO/IEC 27573 ?? More ISO/IEC 27574 ISO/IEC 27574 Information security, cybersecurity and privacy protection— Privacy in brain computer interface (BCI) applications [DRAFT] More ISO/IEC 27575 ?? More ISO/IEC 27701 ISO/IEC 27701:2025 — Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance (second edition) More ISO/IEC 27706 ISO/IEC 27706:2025 — Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of privacy information management systems (first edition) More ISO 27799 ISO 27799:2025 — Health informatics — Information security controls in health using ISO/IEC 27002 (third edition) More

Back Up Next ISO/IEC 27090 ISO/IEC 27090:2026 — Cybersecurity — Artificial Intelligence (AI) — Addressing security threats and compromises to AI systems [First edition] Up Abstract “ ISO/IEC 27090 provides guidance on understanding, detecting and mitigating security threats specific to artificial intelligence (AI) systems throughout their life cycle. It explains how vulnerabilities can be exploited, what the consequences can be and which measures can help address them. For organizations developing or using AI, the standard helps identify what needs protecting, from training data to AI models. It addresses threats such as data poisoning and model theft, while recognizing that established cybersecurity practices remain essential.” [Source: ISO website ] Introduction The rampant proliferation of ‘smart systems’ means ever greater reliance on automation: computers are making decisions and reacting or responding to situations that would previously have required human beings. Currently, however, the tech smarts have limited intelligence, so systems utilising A rtificial I ntelligence don’t always react or behave as they should, or as expected. Furthermore, there are numerous potential threats in the operating environments, presenting numerous risks. Since smart systems provide their AI capabilities using conventional computer systems and networks, the AI-related risks add to those already present - the usual gamut of information c onfidentiality, i ntegrity and a vailability and cybersecurity concerns, plus risks relating to the way the 'systems' (as a whole) are designed, developed, tested, implemented (integrated into existing infrastructures and processes), used, monitored, managed, maintained and eventually decommissioned. There are governance, management and procedural aspects to this with strategic, tactical and operational implications, aside trom the CIA/technical/cyber ones. Bottom line: AI security is a complex, difficult and dynamic challenge! Scope ISO/IEC 27090 guides organisations on addressing [some] security threats to A rtificial I ntelligence systems. It: Discusses the potential organisational consequences of security threats that might compromise AI systems at various points in their lifecycles, drawing on ISO/IEC 22989 and ISO/IEC 5338 *; and Explains how to detect and mitigate such threats (risks), drawing on ISO/IEC 42001 and ISO/IEC 38507 *. * Several other references are noted in the text, reflecting the huge amount of interest in this area and the proliferation of guidance. Structure The main clauses are : 5: Application of information security 6: Types of potential compromise to AI systems 7: Mitigations and their interactions with threats and other applied mitigations Annex A: Mapping attacks to AI system life cycle and to assets Annex B: AI-specific versions of conventional attacks Annex C: Federated machine learning Bibliography The standard covers at least a dozen AI 'threats' (scenarios or types of incident involving deliberate attacks) such as: Poisoning - data and model poisoning e.g. deliberately injecting false information to mislead and hence harm a competitor’s AI system; Evasion - deliberately misleading the AI algorithms using carefully-crafted training or prompt inputs; Membership inference and model inversion - methods to distinguish [and potentially manipulate] the data points used in training the system; Model stealing - theft of the valuable intellectual property in a trained AI system/model, such as the model itself plus its training data and inputs/prompts; Prompt injection and output injection - downstream attacks exploiting vulnerabilities in operational AI systems. For each 'threat', the standard offers about a page of advice: Describing/characterising the threat; Discussing the potential consequences of an attack; Explaining how to detect and mitigate attacks. An extensive list of references directs readers to further information including relevant academic research and more pragmatic advice, including other ISO and non-ISO standards. Status ISO/IEC JTC 1/SC 27/WG 4 started developing this standard in 2022. The standard was published in October 2026 . Commentary Detecting ‘threats’ (which generally refers to impending or in-progress attacks) is a focal point for the standard, perhaps implying that security controls cannot respond to undetected attacks ... which may be generally true for active responses but not for passive, general purpose controls. As so often with ‘cybersecurity’, the standard is primarily concerned with active, deliberate, malicious, focused attacks on AI systems by motivated and capable adversaries , largely disregarding the possibility of natural and accidental threats such as design flaws, bugs and power issues, and threats from within i.e. insider threats within the organisations developing and using AI systems. The standard addresses ‘threats’ (attacks) to AI that are of concern to the AI system owner, rather than threats involving AI that are of concern to its users or to third parties e.g. hackers and spammers misusing AI systems to learn new malevolent techniques. The rapid proliferation of publicly-accessible generative AI systems such as ChatGPT during 2023 put a rather different spin on this area. The scope excludes ‘robot wars’ where AI systems are used to attack and exploit other AI systems. Scary stuff, if decades of science fiction and cinema blockbusters are anything to go by. The potentially significant value of AI systems in identifying, evaluating and responding to information risks and security incidents is not considered in this standard: the whole thing is quite pessimistic, focusing on the negatives, the problems associated with AI. However, the hectic pace of progress in the AI field is clearly a factor. This standard contributes to the field, complementing other AI security standards. We can expect updates as AI matures. Experience of actual AI-related incidents is already starting to accumulate and our knowledge concerning the risks and controls is improving all the time. Up Up Up This page last updated: 19 October 2026

Back Up Next ISO/IEC TS 27116-1 ISO/IEC TS 27116-1 — Cybersecurity multipurpose evaluation — Part 1: Framework [DRAFT] Up Abstract [ISO/IEC TS 27116-1] "defines a general framework for customized and multipurpose evaluation.” (!) [Source: P reliminary W ork I tem Oct 2025] Introduction ?? Scope ?? Structure [I don’t know what the ‘customised and multipurpose evaluations’ are for which this project intends to provide a 'framework'. No idea, sorry.] Status A standard development project commenced in 2024, producing a P reliminary W ork I tem in October 2025. In October 2026, the PWI project was cancelled and a T echnical S pecification project was approved, for "Support for customized or multipurpose evaluation". I'm none the wiser. Commentary Evaluation of what? Against what? Why? How? When? By whom? So many questions but next to no answers thus far. Apparently there is a dash-2 part to come as well. Sorry to be so vague. Hopefully I will pick up more of a clue as the project proceeds. Up Up Up This page last updated: 7 October 2026

Back Up Next ISO/IEC TR 27116-2 ISO/IEC TR 27116-2 Information security, cybersecurity and privacy protection — Best practices on reuse of single evaluations for multipurpose usage [DRAFT] Up Abstract "This TR complements ISO/IEC 27116-1 with examples of best practices." [Source: SC27 plenary Oct 2026] Introduction ?? Scope ?? Structure ?? Status Draft T echnical R eport ISO/IEC TR 26245 was renumbered 27116-2 in Oct 2026. It is at W orking D raft stage. Commentary ?? Up Up Up This page last updated: 7 October 2026

Back Up Next ISO/IEC 27034-1 ISO/IEC 27034-1:2011 (corrected )— Information technology — Security techniques — Application security — Part 1: Overview and concepts (first edition) Up Abstract “ISO/IEC 27034 provides guidance to assist organizations in integrating security into the processes used for managing their applications. [Part 1] presents an overview of application security. It introduces definitions, concepts, principles and processes involved in application security. ISO/IEC 27034 is applicable to in-house developed applications, applications acquired from third parties, and where the development or the operation of the application is outsourced.” [Source: ISO/IEC 27034-1:2011] Introduction As with other multipartite ISO27k standards , the first part sets the scene for the remainder, providing a general introduction and outlining the remaining parts. Scope The ISO/IEC 27034 standards take a process approach to specifying, designing, developing, testing, implementing and maintaining security functions and controls in application systems. For instance application security is not defined as the state of security of an application system (the results of the process) but as “a process an organisation can perform for applying controls and measurements to its applications in order the manage the risk of using them ”. They use the concept of defining a Targeted Level of Trust (similar to a security plan) for an application, designing and building the application to meet it, and then validating the application against it. Structure Main clauses: 5: Structure of ISO/IEC 27034 6: Introduction to application security 7: ISO/IEC 27034 overall processes 8: Concepts Annex A: Mapping an existing development process to ISO/IEC 27034 Case Study Annex B: Mapping ASC with an existing standard Annex C: ISO/IEC 27005 risk management process mapped with the ASMP This part is ~80 pages long with plenty of detail. Status The current first edition of part 1 was published in 2011 . Three minor corrections plus a revised figure were published in 2014 as a technical corrigendum. The corrected standard was confirmed in 2022. A project to update the ISO/IEC 27034 standards commenced in 2024. It will take years to complete. All parts of the standard should conform with JTC 1/SC 17’s standards on software engineering, plus relevant ISO27k standards , and the terminology should align with the ISO 31000 series . A major redesign of the scope of the individual ISO/IEC 27034 standards and the set as a whole is under way, with the intention of making them more relevant and useful for SMEs, and better aligned with other software engineering standards - in particular, ISO/IEC/IEEE 12207 (software life cycle processes) and ISO/IEC/IEEE 15288 (system life cycle processes). The revision project was therefore stopped and restarted in 2025 at P reliminary W ork I nstruction stage, then terminated again in 2026: "With the expert consensus on aligning with ISO/IEC/IEEE 12207 and the ongoing ISO/IEC PWI 26688 being close to completion, a new consensus was achieved during the 27034 PWI meeting on September 30, 2026 to terminate the 27034 PWI." Commentary The ISO/IEC 27034 standards draw on concepts such as auditing and certification of application systems similar in style to the C ommon C riteria and similar schemes primarily used for government and military systems. The text tends to emphasize deliberate threats arising from external adversaries implying the importance of confidentiality controls, arguably downplaying insider and accidental threats and the need for integrity and availability controls, but the process described ostensibly takes account of the full spectrum of security risks and controls. Rewriting all the parts to adopt ISO's guidance on plain English would be challenging but could substantially extend the utility and value of these standards. Up Up Up This page last updated: 7 October 2026

Back Up Next ISO/IEC 27033-2 ISO/IEC 27033-2:2012 Information technology — Security techniques — Network security — Part 2: Guidelines for the design and implementation of network security (first edition) Up Abstract ISO/IEC 27033 part 2 “gives guidelines for organizations to plan, design, implement and document network security.” [Source: ISO/IEC 27033-2:2012] Introduction Part 2 revised and replaced ISO/IEC 18028 part 2. Defines a network security architecture for providing end-to-end network security. The architecture can be applied to various kinds of networks where end-to-end security is a concern and independently of the network's underlying technology. Scope Planning, designing, implementing and documenting network security. Objective: “to define how organisations should achieve quality network technical security architectures, designs and implementations that will ensure network security appropriate to their business environments, using a consistent approach to the planning, design and implementation of network security, as relevant aided by the use of models/frameworks. (In this context, a model/framework is used to outline a representation or description showing the structure and high level workings of a type of technical security architecture/design)” . Structure Main clauses: 6: Preparing for design of network security 7: Design of network security 8: Implementation Annex A: Cross-references between ISO/IEC 27001:2005 /ISO/IEC 27002:2005 network security-related controls and ISO/IEC 27033-2:2012 clauses Annex B: Example documentation templates Annex C: ITU-T X.805 framework and ISO/IEC 27001:2005 control mapping Status ISO/IEC 27033-2 revised and replaced ISO/IEC 18028-2. The current first edition of part 2 was published way back in 2012 and confirmed unchanged in 2018. It is now seriously out of date, referring to old editions of other standards and missing out on current networking security issues such as cloud security and virtual networking. In October 2026, SC27 WG4 agreed to revise it and combine it with ISO/IEC 27033-3 as part of the restructuring on the 27033 standards. Commentary Defines a network security architecture for providing end-to-end network security. The architecture can be applied to various kinds of networks where end-to-end security is a concern and independently of the network's underlying technology. Serves as a foundation for detailed recommendations on end-to-end network security. Covers risks, design, techniques and control issues. Refers to other parts of ISO/IEC 27033 for more specific guidance. Up Up Up This page last updated: 7 October 2026

Back Up Next ISO/IEC TS 27115-2 ISO/IEC TS 27115-2 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 2: Security architecture evaluation (DRAFT) Up Abstract ?? Introduction ?? Scope ISO/IEC TS 27115-2 "provides a framework to evaluate the cybersecurity of complex systems, including systems of systems, based on ISO/IEC TS 27115-1. The framework uses basic architecture concepts to support model-based, comprehensive and scalable security solutions and their evaluation." Structure ?? Status Part 2 is due out in 2028. Commentary TBA Up Up Up This page last updated: 7 October 2026

Back Up Next ISO/IEC TS 27115-1 ISO/IEC TS 27115-1 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 1: Introduction and framework overview (DRAFT) Up Abstract ISO/IEC TS 27115[-1] "provides the foundations and concepts for the cybersecurity evaluation of complex systems. Two frameworks are defined: [ISO/IEC TS 27115-2] is used to specify the cybersecurity of a complex system, including system of systems. [ISO/IEC TS 27115-3] is used to evaluate the corresponding cybersecurity solutions. The frameworks use basic architecture concepts: to enable description of reference or solution cybersecurity architectures; to support model-based, comprehensive and scalable security solutions and their evaluation; and to allow for the definition of architecture-based cybersecurity profiles and hierarchies of profiles.” [Source: adapted from ISO.org info page ] Introduction Using concepts and terms similar to the C ommon C riteria such as T arget O f E valuation and security profile, this three-part T echnical S pecification intends to explain how to: (a) Develop a security architecture (or design) for a complex system (a 'system of systems'); and (b) Evaluate a complex system against the security architecture. Scope The W orking D raft's formal definition of "complex system" as "a system or system of systems" is self-referential and unhelpful. The WD introduction refers somewhat obtusely to complex systems: The complexity of security and legislation for privacy, cybersecurity or AI (hinting, perhaps, at 'the complex system' being a computer system of some sort plus its associated security arrangements ... and perhaps the associated compliance framework/s?); 'Scaling up towards' ecosystems, or socio-technical systems (your guess is as good as mine on that one!); Systems of systems ... which apparently means subsystems or discrete systems that interact to provide services, within an environment. "System" is defined in some other standard misquoted in the WD as "arrangement of parts or elements that together exhibit a stated behaviour or meaning that the individual constituents do not Note 1 to entry: A system is sometimes considered as a product or as the services it provides. Note 2 to entry: In practice, the interpretation of its meaning is frequently clarified by the use of an associative noun, e.g. aircraft system. Alternatively, the word “system” is substituted simply by a context-dependent synonym (e.g. aircraft), though this potentially obscures a system principles perspective. Note 3 to entry: A complete system includes all of the associated equipment, facilities, material, computer programs, firmware, technical documentation, services, and personnel required for operations and support to the degree necessary for self-sufficient use in its intended environment. " Structure Main clauses (in a draft before the standard was split into three parts): 5: Overview 6: Security architecture description - "concepts and elements supporting the framework for constructing a security architecture description" 7: Security architecture evaluation - evaluating systems against criteria declared in their security profiles 8: Architecture-based security profiles 9: Composed security profiles - compilation of security profiles from individual systems comprising system-of-systems Annex A: Architecture foundations Annex B: Guidance for elaborating a security architecture Annex C: Guidance for evaluating a security architecture Annex D: Security example for a network infrastructure Status The standard development project commenced in 2023. It is now at C ommittee D raft stage, split into three parts: ISO/IEC TS 27115-1 Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 1: Introduction and framework overview (due out in 2027). Scope: part 1 provides a framework to specify the cybersecurity of complex systems, including systems of systems. The framework uses basic architecture concepts to enable description of reference or solution security architectures. ISO/IEC TS 27115-2 Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 2: Security architecture evaluation (due in 2028). Scope: part 2 provides a framework to evaluate the cybersecurity of complex systems, including systems of systems, based on ISO/IEC TS 27115-1. The framework uses basic architecture concepts to support model-based, comprehensive and scalable security solutions and their evaluation. ISO/IEC TS 27115-3 Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 3: Security profiles (due in 2029). Scope: part 3 provides a framework to describe security profiles based on ISO/IEC TS 27115-1 and ISO/IEC TS 27115-2. The framework uses basic architecture concepts to enable the definition of architecture-based security profiles and composition of profiles. Commentary This is all Greek to me, patently not my area of expertise. It is theoretical or adademic rather than pragmatic. It doesn't help that the latest draft I've seen has hardly any usable references, most being replaced by "Error: Reference source not found ", while what I presume are internal references within the text to particular figures (e.g . "Figure 11) or tables are completely missing (e.g . "The security process can be iterative, as shown on step H in ,"). So no clues there either. The very notion of 'complex systems' puzzles me. Presumably it is a matter of scale, since systems are fractal in nature: any system is both composed of subunits ('subsystems') and comprises part of larger systems (infrastructures, frameworks, concepts or whatever). From the very tiniest subatomic particles to the entire universe, it's all one massive "system-of-systems" that are complex at every level due, in part, to interactions within and without each 'system'. In information security, context is [almost] everything: maybe that's what this set of three standards will address? Up Up Up This page last updated: 7 October 2026