Generic content to kick-start your ISMS - pretty basic but sound and FREE! These materials were kindly donated by members of the ISO27k Forum and website sponsors. ISO27k Toolkit The ISO27k Toolkit is a collection of generic ISMS-related materials contributed by members of the ISO27k Forum . We are very grateful for the generosity and community-spirit of the donors in allowing us to share them with you, free of charge. The materials have been donated by individuals with differing backgrounds, competence and expertise, working for a variety of organisations and contexts. They are models or templates, starting points if you will. Your information risks are unique, so it is incumbent on you to assess and treat your risks as you and your management see fit. Good luck! ISO27k Toolkit All of these files, packaged into a zip file All FREE! Updated Sept 2026 DOWNLOAD ISMS implementation and cert process French Merci a Laurent Jaunaux, Integr'Action Conseil DOWNLOAD ISMS implementation guideline Explains the requirements in ISO/IEC 27001 with pragmatic implementation guidance DOWNLOAD ISMS gap analysis questionnaire Portuguese Questionário para avaliar sistematicamente as práticas de gestão de segurança da informação em relação à norma ISO/IEC 27001. DOWNLOAD Adaptive SME security executive summary An executive summary for busy SME owners, CEOs or managers DOWNLOAD 4.4 ISMS documentation Checklist for 14 types of ‘documented information’ plus additional discretionary materials DOWNLOAD 6.1 Information risk register Systematically assess, evaluate, rank and decide how to treat your information risks DOWNLOAD 6.1 Plain SoA with metrics Generate and record your S tatement o f A pplicability, along with basic metrics DOWNLOAD 6.1.2 Information risk catalogue A checklist of 80 commonplace information risks for risk identification DOWNLOAD 7.3 Single-page FAQ awareness example Succinct set of F requently A sked Q uestions about "ISO 27001” DOWNLOAD 9.2 Audit exercise - crib sheet Suggested answers for the audit exercise, with tips on audit principles DOWNLOAD 9.2 ISMS internal audit procedure Describes the typical process for conducting ISMS internal audits DOWNLOAD A5.9 Information asset checkllist How can you protect your stuff if you don't know what you've got? DOWNLOAD A5.15 Policy on access control A skeleton to beef-up according to your needs DOWNLOAD A5.34 Policy on privacy Minimalist starting point for customisation DOWNLOAD A6.2 Policy on employment contracts Extreme minimalism - just 3 generic policy statements to elaborate on DOWNLOAD A7.4 Policy on physical security monitoring Bare bones, just 6 policy statements DOWNLOAD A7.14 Policy on secure disposal 8 policy statements about disposing of potentially valuable information DOWNLOAD A8.20 Policy on network security Just 9 policy statements scratch the surface of this deep topic DOWNLOAD ISO27k Toolkit terms and conditions A Creative Commons license covers most of the items DOWNLOAD ISMS implementation checklist Pragmatic guidance for ISO/IEC 27001 implementers DOWNLOAD ISMS implementation project estimator Excel model to estimate how long it will take to implement an ISO/IEC 27001 ISMS DOWNLOAD SME controls *NEW* Information security controls recommended for SMEs DOWNLOAD 4 Generic cost-benefit analysis The basis for an ISO27k ISMS business case, proposal or budget request DOWNLOAD 5.2 Policy management process Splits the process into policy development and operation DOWNLOAD 6.1 Iterative risk analysis Double-sided guide to a cyclical risk analysis method that revolves around incidents DOWNLOAD 6.1 Plain SoA Español Cristian Celdeiro ayudó en la traducción a Español DOWNLOAD 6.3 Change management policy Addresses the requirement to mange changes to the ISMS DOWNLOAD 7.4 Introduction and gap analysis email Template for a kick-off message introducing the ISMS implementation project DOWNLOAD 9.2 Audit exercise - Português Brasileiro Audit exercise translated to Português Brasileiro DOWNLOAD 9.3 ISMS management review agenda Agenda items for a meeting to discuss an ISMS management review DOWNLOAD A5.9 Technology types, risks and controls 3 pages outlining 5 types of technology with the associated risks and controls DOWNLOAD A5.19 Policy on outsourcing Model policy on risks and controls in business process outsourcing DOWNLOAD A5.34 Briefing on ISO27k for GDPR Where information security and privacy requirements coincide, go for common controls DOWNLOAD A6.3 Policy on awareness and training Rolling programme of security awareness and training for managers, staff, contractors etc. DOWNLOAD A7.9 Policy on working offsite 7 generic policy statements to bootstrap a workable policy DOWNLOAD A8.12 Policy on data leakage prevention 4 crude policy statements to expand upon DOWNLOAD A8.32 Policy on change management Construct your own policy, elaborating on these 5 brief statements DOWNLOAD ISMS implementation and certification process One-page diagram on building, implementing and certifying an ISMS DOWNLOAD ISMS implementation checklist Portuguese Checklist do projeto de implementação de um SGSI DOWNLOAD ISMS gap analysis questionnaire Generic questionnaire on conformity to ISO/IEC 27001 DOWNLOAD Adaptive SME security Pragmatic approach to information risk and security for SMEs, even micro-orgs DOWNLOAD 4.4 Documentation mind map Just the mandatory ISMS docs required by main body clauses DOWNLOAD 6.1 Security control attributes Use ‘control attributes’ to specify, select and improve information security controls DOWNLOAD 6.1 Smart SoA with custom controls Customise Annex A controls to address your organisation's unique situation DOWNLOAD 6.1 Plain SoA Português Cristian Celdeiro ajudou na tradução para o Português Brasileiro DOWNLOAD 7.3 Prepare to be audited leaflet Awareness on being audited by ISMS internal, certification or technology auditors DOWNLOAD 9.2 Audit exercise A basic exercise or test for ISMS auditors DOWNLOAD 9.2 Audit exercise - crib - Português Brasileiro Crib sheet in Português Brasileiro DOWNLOAD A5.4 Policy on mgmt responsibilities A bare-bones policy skeleton to flesh out DOWNLOAD A5.10 Professional services infosec checklist Security activities for the start, middle and end of professional services engagements DOWNLOAD A5.32 Policy on intellectual property 3 basic policy statements to set you off on the right foot DOWNLOAD A6 Policy on HR A very basic HR security policy starter: lots worth adding! DOWNLOAD A7.1 Policy on physical controls Another skeletal policy starter with a dozen policy statements to set you thinking DOWNLOAD A7.12 Policy on cabling security Just 5 simple policy statements to expand into an actual security policy DOWNLOAD A8.13 Policy on backups An important topic for strategies, policies and procedures DOWNLOAD Not quite what you need? Willing to contribute? Get in touch! Further toolkit contributions are most welcome, whether to plug the many gaps (e.g. materials covering other clauses and controls from ISO/IEC 27001 and 27002 ), offer constructive criticism, translate these materials or provide additional examples. Case study materials would be great. Novel ways of satisfying the standards’ requirements, plus creative, inspirational and innovative approaches are particularly welcome, but so too are simplifications, checklists, diagrams and starting points. Please get in touch if you are willing to donate or seek other materials. We'll see what we can do to help. Given name Family name Email Message Send

ISO27001 Security offers free information and guidance to help information risk and security professionals understand and get the most out of the ISO27k standards Tools and resources to help you implement ISO/IEC 27001 and the other ISO27k standards Read about all the ISO27k standards and check out the FAQ . Download the free ISO27k Toolkit and join 5,500 professional peers on the ISO27k Forum (also free!). Keep up with hot news about ISO27k on the new ISO27k Blog . Explore ISO27k ISO27k FAQ ISO27k Toolkit ISO27k Forum ISO27k Blog This website offers extensive, pragmatic guidance on the ISO/IEC 27000-series information risk and security management standards. In support of the global information risk and security community, we have up-to-date information on all 100 "ISO27k" standards and a user forum with over 5,000 professional members. All that, and more, for free! If you value this website, donations towards our costs are gratefully received. This not-for-profit initiative has run on a shoestring for decades. Our generous donors and advertisers (represented below) have stretched the shoestrings long enough to reach this far ... and we'd really like to keep going ... To play, press and hold the enter key. To stop, release the enter key. Hot news - cool blog

Back Up Next ISO/IEC 27003 ISO/IEC 27003:2017 — Information technology — Security techniques — Information security management systems — Guidance (second edition) Up Abstract “ISO/IEC 27003:2017 provides explanation and guidance on ISO/IEC 27001:2013.” [Source: ISO/IEC 27003:2017] Introduction ISO/IEC 27003 provides guidance for those implementing the ISO27k standards , covering the management system aspects in particular, as opposed to the information security controls which are summarised in ISO/IEC 27001 Annex A and explained more fully in ISO/IEC 27002. The standard supplements and builds upon other ISO27k standards (particularly ISO/IEC 27000 and ISO/IEC 27001 plus ISO/IEC 27004 , ISO/IEC 27005 and ISO/IEC 27014 ) and ISO 31000 . Scope The current edition of this standard primarily interprets or explains the requirements stated formally in ISO/IEC 27001:2013 . As a result of ISO’s intent to make all the M anagement S ystems S tandards consistent in structure, form and style, and in order for it to be usable for conformity assessment (ISMS certification) purposes, the language of ISO/IEC 27001 is inevitably formal, curt and stilted, leaving little room for interpretation. In contrast, ISO/IEC 27003 offers more pragmatic explanations of the requirements. Structure For convenience, ISO/IEC 27003 mirrors the structure of ISO/IEC 27001 , expanding clause-by-clause on ISO/IEC 27001 . The main clauses are therefore: 4: Context of the organisation 5: Leadership 6: Planning 7: Support 8: Operation 9: Performance evaluation 10: Improvement Annex: Policy framework [NOTE: this annex does not reflect or expand on the information security controls listed in ISO/IEC 27001 Annex A, since ISO/IEC 27002 already does that]. For each ISO/IEC 27001 clause and subclause, ISO/IEC 27003: Re-states the requirement/s; Explains the implications; and Offers a little practical guidance and supporting information including examples, to help implementers implement. For example, this is what ISO/IEC 27001 says in section 4.1, ‘Understanding the organisation and its context’: “The organisation shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system. NOTE Determining these issues refers to establishing the external and internal context of the organisation considered in Clause 5.3 of ISO 31000:2009.” Section 4.1 of ISO/IEC 27003 first succinctly re-states the ‘required activity’: “The organisation determines external and internal issues relevant to its purpose and affecting its ability to achieve the intended outcome(s) of the information security management system (ISMS).” Then it expands on the reasons why it is appropriate and necessary to ‘determine external and internal issues’, providing a page of explanation to supplement the succinct and somewhat hard to understand text from ISO/IEC 27001 . It explains, for instance, that the ‘internal issues’ include the organisation’s culture; its policies, objectives, and the strategies to achieve them; its governance, organisational structure, roles and responsibilities; and lists a further seven ‘internal issues’ to consider. It also identifies/cross-references other clauses that use this information. That alone would be a valuable expansion on ISO/IEC 27001 section 4.1 but ISO/IEC 27003 doesn’t stop there: it goes on to provide a further page of explanation, practical guidance and real-world examples in this area - 3 pages in total concerning that one short subclause. The end result is that the reader gains a better understanding of the formal requirements from the main body clauses of ISO/IEC 27001 and a clearer idea of how to go about satisfying them. Status The first edition was published in 2010 . It included implementation guidance. A substantially revised second edition, with more explanation but less implementation guidance, was issued in 2017. Work is under way now on a third edition: The revision project has reached D raft I ntrnational S tandard stage . The third edition was due to be published in 2027 but may be delayed to 2028 A new title is likely: “Information security, cybersecurity and privacy protection — Information security management systems — Guidance for the application of ISO/IEC 27001:2022 ”. An amended scope is also likely, appending “and the ISO/IEC 27001:2022/AMD 1:2024” , to acknowledge that climate change is to be considered. Work started in 2025 on another standard (either a second part to '27003 or a completely separate standard), with the development of a P reliminary W ork I nstruction. Whereas the second and third editions of ISO/IEC 27003 focus on explaining the formal ISMS requirements from ISO/IEC 27001 , ISO/IEC 27003-2 (or whatever number it is given) is intended to offer practical guidance on implementing an ISMS , for example ”setting up an implementation project, suitable top management involvement in the steering committee, setting a clear ambition level, appointment of a suitable project manager, etc.” It will hopefully rejuvenate and update the implementation advice from the 2010 first edition that has been eroded and largely lost. Commentary It takes years to prepare and release each new edition. Meanwhile , the ISO27k ISMS implementation guideline is a plain-English explanation of the requirements from ISO/IEC 27001 (based on the ISO Directives Part 1 Annex SL Appendix 2 concerning the wording and intent of the boilerplate text for all ISO’s management systems) plus pragmatic guidance for implementers (based on actual experience). The ISO27k guideline is a community product. not an official ISO/IEC standard but, hey, it’s free of charge ... and available now ! To my eyes, the proposed ISO/IEC 27003-2 resembles phase 3 of the current revision project ... so it is possible that the revision might stop and release the third edition after completing phase 2’s plain English rewording (which I suspect will involve a lot more work than was planned), deferring phase 3 to the new 'part 2;' project. Maybe. We shall see. Although excluded from the current revision project, the scope and purpose of ISO/IEC 27003 could - at some distant future point perhaps - usefully extend beyond the ISMS design, implementation and certification phase to offer pragmatic advice on the operation, management, monitoring and systematic improvement of the ISMS. Certification of an ISMS is, after all, merely a milestone on the never-ending journey towards security maturity. As information security becomes an integral and valuable part of the organisation’s routine business/operational activities and management, changes are bound to occur. Potentially ’27003 might distinguish, encourage and support beneficial ISMS changes while discouraging counterproductive or detrimental ones. Alternatively, developing a separate ISO27k standard in parallel with the ongoing revision of ISO/IEC 27003 might be a quicker (less glacial) option, hinting at the possibility of a part 3 to this standard. Up Up Up This page last updated: 30 September 2026

Back Up Next ISO/IEC 27050-3 ISO/IEC 27050-3:2020 — Information technology — Security techniques — Electronic discovery — Part 3: Code of practice for electronic discovery (second edition) Up Abstract ISO/IEC 27050 part 3 “provides requirements and recommendations on activities in electronic discovery, including, but not limited to, identification, preservation, collection, processing, review, analysis and production of electronically stored information (ESI). In addition, this document specifies relevant measures that span the lifecycle of the ESI from its initial creation through to final disposition. [Part 3] is relevant to both non-technical and technical personnel involved in some or all of the electronic discovery activities. It is important to note that the user is expected to be aware of any applicable jurisdictional requirements.” [Source: ISO/IEC 27050-3:2020 ] Introduction Part 3 of ISO/IEC 27050 identifies requirements and offers guidance on the seven main steps of eDiscovery noted in part 1 i.e . ESI: Identification - what information from/at a crime scene might be relevant and useful? Preservation - starting the chain of evidence. Collection - removing physical media etc, Processing - forensic bit-copies. Review - searching evidence for relevant info. Analysis - picking out the most weighty bits for court. Production - preparing to present evidence+analysis in court. Scope The structured processes involving E lectronically S tored I nformation. Structure Main clauses: 5: Electronic discovery background 6: Electronic discovery requirements and guidance Status The first edition was published in 2017 . The current second edition was published in 2020 . Commentary Part 3 is, essentially, a basic, generic how-to-do-it guide laying out the key elements that will no doubt form the basis of many digital forensics manuals. While full-time forensics specialists have their own well-practiced procedures, training, forms, tools etc. , corporate information security pro's who only get involved occasionally in this area may benefit from preparing the basics to get the process started properly, even if the management decision is soon made to call in eForensics specialists. If things are fouled-up at the beginning, they are unlikely to be recoverable later on, compromising potentially valid cases. Up Up Up This page last updated: 29 September 2026

Back Up Next ISO/IEC 27007 ISO/IEC 27007:2020 — Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing (third edition) Up Abstract ISO/IEC 27007 "provides guidance on managing an information security management system (ISMS) audit programme, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011. [ISO/IEC 27007] is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme.” [Source: ISO/IEC 27007:2020] Introduction ISO/IEC 27007 provides guidance for internal auditors, external/third party auditors (e.g. those performing supplier security assessments) and others auditing ISMSs against ISO/IEC 27001 i.e. auditing the Management System for conformity with the standard. For C ertification B odies' conformity assessors, it supplements or complements the mandatory accreditation requirements specified formally in ISO/IEC 27006-1 with additional discretionary advice. The standard covers the process of ISMS-specific conformity assessment or auditing, emphasising the 'management system' elements: Managing the ISMS audit programme (determining what conformity elements to audit, when and how; assigning appropriate auditors; managing audit risks; maintaining audit records; continuous process improvement); Performing an ISMS MS audit (audit process - planning, conduct, key audit activities including fieldwork, analysis, reporting and follow-ups); Managing ISMS auditors (competencies, skills, attributes and evaluation). Scope "[ISO/IEC 27007] provides guidance on managing an information security management system (ISMS) audit programme, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011 . [ISO/IEC 27007] is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme." [Source: ISO/IEC 27007:2020] Structure Main clauses: 4: Principles of auditing 5: Managing an audit programme 6: Conducting an audit 7: Competence and evaluation of auditors Annex A: Guidance for ISMS auditing practice - includes advice re the documentation required by ISO/IEC 27001:2013 such as the S tatement o f A pplicability. The main body of the standard mostly cites clauses from ISO 19011 . It provides limited advice for conformity auditing in the ISMS context, with a few not-terribly-helpful explanatory comments (e.g . audits are likely to involve sensitive proprietary or personal information, hence auditors may need to be security-cleared to the appropriate level before auditing, and to secure audit evidence appropriately). However the more valuable annex describes specific audit tests concerning an organisation’s conformity with the requirements of [the 2013 edition of] ISO/IEC 27001 . Status The first edition was published in 2011 . The second edition was published in 2017 . The current third edition was published in 2020 . A fourth edition is in the works, belatedly reflecting ISO/IEC 27001:2022 and now ISO 19011:2026 which, for instance, provides guidance on remote auditing of virtual locations such as geographically-dispersed data centres providing cloud services. CEN, the European Committee for Standardization, is collaborating with ISO and IEC on this one. The fourth edition is at D raft I nternational S tandard stage, on track for publication by mid-2027. Hopefully the terminology and concepts will align more closely with 27000 , 27001 , 27003 and 27005 without implying, suggesting or stating additional requirements beyond those formally stated in 27001 . Commentary As with ISO/IEC 27006-1 , this standard primarily concerns conformity or compliance auditing , a particular form of auditing with a specific goal: to determine whether the audited organisation’s ISMS conforms with (i.e. fulfills all the mandatory requirements specified formally by) ISO/IEC 27001 . Such audits are primarily performed for certification purposes so - confusingly - the standard defers to ISO/IEC 27006. Other types of audits (not addressed by 27007 ) have different assurance goals. Please don’t make the mistake of assuming that all auditors are so-called “tick-and-bash” compliance/conformity auditors, or that all audits are compliance/conformity audits. Specifically in relation to information risk and security management, competent technology auditors might for instance: Evaluate the organisation’s strategies and policies relating to information and privacy risk management, incident management, fraud etc. for aspects such as strategic fit, currency, relevance, readability, coverage, suitability and quality (fitness for purpose); Audit workers’ conformity with organisational policies, procedures, directives, guidelines, employment contracts etc. , in the general area of information risk, information security and privacy; Delve into the root causes of ongoing issues and repetitive or persistent incidents amd issues, including near-misses and lesser events; Examine the governance arrangements in this area e.g. organisational structure, internal and external reporting relationships, information flows within and between management layers, accountabilities, roles and responsibilities, recruitment practices, competences ... Audit the organisation’s compliance/conformity with other relevant obligations and expectations, apart from ISO/IEC 27001 e.g. privacy and data protection, intellectual property protection, health and safety, and employment laws and regulations; fire codes and building standards; technical security standards and protocols; supplier, partner and customer agreements and contracts; industry guidelines; ethical codes ... including the associated arrangements such as enforcement actions, and how the organisation stays up-to-date with changes in the requirements and expectations; Audit the effectiveness and efficiency of the ISMS, including aspects such as the net value (benefits less costs) it generates for the business, aiming to substantiate and release any unrealised potential; Examine ‘assurance’, ‘integrity’, ‘confidentiality’, ‘availability’, ‘risk’, ‘information risk management’, ‘compliance’, ‘privacy’ etc. in the broad, deliberately interpreting such words and phrases very widely to take in related aspects that are not usually considered in any depth; Review improvements made and explore further opportunities to improve the ISMS; Examine the organisation’s potential and actual exploitation of other standards, methods and frameworks relating to information risk and security management; Survey, compare and contrast various stakeholders’ opinions , comments and suggestions on the ISMS, teasing-out and addressing deeper, longstanding concerns and points of common interest that might otherwise remain chronic; Follow-up on previous ISMS audits, management reviews, penetration tests, security assessments, post incident reports etc. , delving deeper into areas of concern, perhaps extending the scope and picking-up on recurrent, widespread and politically-sensitive (hidden or suppressed) issues; Examining assurance management e.g. the manner in which various audits or assessments are scoped, approved, resourced, conducted, reported, actioned and closed off, treating ISMS or technology audits as important examples; Explore the business, strategic, management, operational and supply chain aspects of business continuity and resilience , including the IT and OT aspects such as dependence on single points of failure, legacy systems; Look into the integration and interoperability of various management systems such as the ISMS, PIMS, AIMS and others; Audit plans, preparations and progress for the impending transition to quantum-safe cryptography including architectural and business aspects such as crypto-agility; Examine the positive and negative impacts of AI on the organisation, whether realised, planned or potential, reviewing aspects such as the business and technical objectives, systems, processes, people, supply chain, risk and security implications, resilience, ethics, safety, capabilties, costs ... Audit the organisation’s information management as a whole, such as the integration of risk and security aspects with other business imperatives, and the proactive exploitation of information despite various risks; Benchmark the ISMS against comparable organisations or business units, or against other operational management systems e.g. quality assurance, environmental protection; Measure and comment on the organisation’s maturity in this general area; Review the organisation’s use of security metrics , reports and other management information. Despite being an incomplete list, there are clearly plenty of creative possibilities for auditing in the context of an ISMS. There's more to it than conformity-assessment tick-n-bash. IMNSHO one of the best things about auditing is the chance to do something different for a change, looking at things with fresh eyes from different angles. Exploit the auditors’ independence, competence, experience, skills, focus, information access, rigorous methods, trustworthiness, access to senior management etc. to delve into aspects that are rarely if ever addressed as part of routine management and operations - potentially including those awkward politically-charged issues that are studiously avoided, and longstanding problems that seem destined to remain, forever. Competent auditors have a knack of finding rut-escape routes. Some pessimists see audits as information threats to be avoided or minimised: speaking as a former (lapsed? Reformed!) IT auditor and optimist (realist!), I see audits as valuable business opportunities to be exploited to the max. Make the best of them. Milk the value. Less tick-n-bash, more tick-n-cash please! Up Up Up This page last updated: 24 September 2026

Back Up Next ISO/IEC 27033-6 ISO/IEC 27033-6:2016 Information technology — Security techniques — Network security — Part 6: Securing wireless IP network access (first edition) Up Abstract ISO/IEC 27033 part 6 “describes the threats, security requirements, security control and design techniques associated with wireless networks. It provides guidelines for the selection, implementation and monitoring of the technical controls necessary to provide secure communications using wireless networks. The information in [part 6] is intended to be used when reviewing or selecting technical security architecture/design options that involve the use of wireless network in accordance with ISO/IEC 27033-2. Overall, ISO/IEC 27033-6 will aid considerably the comprehensive definition and implementation of security for any organization's wireless network environment. It is aimed at users and implementers who are responsible for the implementation and maintenance of the technical controls necessary to provide secure wireless networks.” [Source: ISO/IEC 27033-6:2016] Introduction This is a generic wireless network security standard offering basic advice for WiFi, Bluetooth, 3G and other wireless networks. Scope Risks, design techniques and control issues for securing IP wireless networks. Relevant to those involved in the detailed planning, design and implementation of security for wireless networks (e.g. network architects and designers, network managers and network security admins). Structure Main clauses: 6: Overview 7: Security threats 8: Security requirements 9: Security controls 10: Security design techniques and considerations Annex A: Technical description of threats and countermeasures Status The current first edition of part 6 was published in 2016 and confirmed unchanged in 2021. Commentary The standard uses the curious term “wire line network”, more commonly known as a wired network. The standard repeatedly refers to “access network”, another curious term that is not defined (aside from Radio Access Network). I guess it may simply mean “network” but without a definition, I cannot be sure. The standard indicates that encryption is an integrity control, whereas normally other cryptographic controls and protocols provide the integrity functions, while encryption provides confidentiality. Yes, I'm splitting hairs here ... over an integrity failure. Similarly to Part 7 , this part lists a number of “threats” which are, in fact, attack modes or incident scenarios. The list would, I feel, have been more useful if the standard systematically addressed each of them, explaining how certain controls mitigate them. It doesn’t. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27070 ISO/IEC 27070:2021 — Information technology — Security techniques — Requirements for establishing virtualized roots of trust (first edition) Up Abstract ISO/IEC 27070"specifies requirements for establishing virtualized roots of trust.” [Source: ISO/IEC 27070:2021] Introduction The integrity and hence value of some security functions and subsystems (particularly those relating to cryptography) relies on their being based on trustworthy foundations known as the R oot o f T rust. Special RoT security arrangements are necessary to negate threats involving low-level exploitation of data-processing chips, devices or systems, in turn compromising the higher-level firmware, device drivers, operating system and application software that build upon the RoT. Whereas trusted computing generally involves some form of H ardware S ecurity M odule (e.g. an ISO/IEC 11889 T rusted P latform M odule) providing various cryptographic functions and key storage in a physically secure tamper-resistant enclosure, that architecture is not well suited to cloud computing. In the cloud, systems are virtualised, hence they cannot readily access and rely directly upon hardware-based RoT in the conventional manner. Scope The standard specifies functional requirements and information security controls supporting the provision of trustworthy foundations for cloud computing environments, where V irtual M achines are dynamically created to provide cloud services. Structure Main clauses: 5: Functional view - describes the architecture in functional/modular terms 6: Activity view - describes how the functional modules deliver the desired level of trusted computing. Annex A: relationship between activity and functional views Status The current first edition was published in 2021 . Commentary The trust, risk and security implications of this are, frankly, above my pay grade. As my withered little old brain understands it, the standard aims to establish a rock-solid foundation on which to build the house of cards delivering cloud computing services. Regardless of all the information risks and security controls at higher levels (of which there are many), providing a sound, trustworthy platform makes RoT a fundamental security requirement. Otherwise, we’re erecting skyscrapers in the swamp. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC TS 27560 ISO/IEC TS 27560:2023 — Privacy technologies — Consent record information structure (first edition) Up Abstract ISO/IEC TS 27560 "specifies an interoperable, open and extensible information structure for recording PII principals' consent to PII processing. [ISO/IEC TS 27560] provides requirements and recommendations on the use of consent receipts and consent records associated with a PII principal's PII processing consent, aiming to support the: provision of a record of the consent to the PII principal; exchange of consent information between information systems; management of the life cycle of the recorded consent.” [Source: ISO/IEC TS 27560:2023] Introduction This T echnical S pecification specifies an interoperable, open and extensible information structure for recording and potentially sharing PII Principals' (data subjects') consent to data processing. Scope In addition to the specification, the standard provides requirements and recommendations on the use of consent receipts and consent records associated with a PII Principal’s data processing consent to support the: Provision of a record of the consent to the PII Principal; Exchange of consent information between information systems; and Management of the lifecycle of the recorded consent. The standard does not specify an exchange protocol for receipts and records, nor an exact data structure for such exchanges. Structure Main clauses: 5: Overview of consent records and consent receipts 6: Elements of a consent record and consent receipt Annex A: Examples of consent records and receipts Annex B: Example of consent record life cycle Annex C: Performance and efficiency considerations Annex D: Consent record encoding structure Annex E: Security of consent records and receipts Annex F: Signals as controls communicating PII principal's preferences and decisions Annex G: Guidance on the application of consent receipts in the context of P rivacy I nformation M anagement S ystems Annex H: Mapping to ISO/IEC 29184 Status The first edition was published as a T echnical S pecification in 2023 . ISO made the downloadable standard free of charge in 2025 to encourage uptake and so promote the sharing of privacy consents. See https://www.iso.org/standard/80392.html A revision project is ongoing with an expanded scope to encompass the former ISO/IEC TS 27569 project (which has presumably been cancelled). The second edition is at 2nd C ommittee D raft stage with a new title: "Structure of personally identifiable information (PII) processing records.", revised scope and updated structure. It looks set to become a full I nternational S tandard rather than a T echnical S pecification. Commentary If only ISO would release all the ISO27k infosec standards free of charge, encouraging everyone to improve security, privacy and resilience for all! Nod if you agree. Better still, suggest it to your national body ... Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27034-7 ISO/IEC 27034-7:2018 — Information technology — Security techniques — Application security — Part 7: Assurance prediction framework (first edition) Up Abstract ISO/IEC 27034 part 7 ”describes the minimum requirements when the required activities specified by an Application Security Control (ASC) are replaced with a Prediction Application Security Rationale (PASR). The ASC mapped to a PASR define the Expected Level of Trust for a subsequent application. In the context of an Expected Level of Trust, there is always an original application where the project team performed the activities of the indicated ASC to achieve an Actual Level of Trust. The use of Prediction Application Security Rationales (PASRs), defined by [ISO/IEC 27034-7], is applicable to project teams which have a defined Application Normative Framework (ANF) and an original application with an Actual Level of Trust. Predictions relative to aggregation of multiple components or the history of the developer in relation to other applications is outside the scope of [ISO/IEC 27034-7].” [Source: ISO/IEC 27034-7:2018] Introduction Part 7 specifies a framework to deliver the assurance necessary to place trust in a computer program’s security arrangements, for example: When one program (such as an application) relies on another (e.g. a database management system, utility, operating system or companion program) to perform critical security functions (such as user authentication, logical access control or cryptography), or When an organisation updates or patches a trusted program. Scope Specifies minimum requirements when the required activities specified by an A pplication S ecurity C ontrol are replaced with a P rediction A pplication S ecurity R ationale. The ASC mapped to a PASR defines the Expected Level of Trust for a subsequent application. The use of PASRs is applicable to project teams which have a defined A pplication N ormative F ramework and an original application with an Actual Level of Trust. Structure Main clauses: 5: Prediction concepts 6: Predictions 7: Substantial changes 8: Confidence 9: Prediction application security rationale 10: PASR audit 11: PASR verification 12: PASR implementation 13: Expected level of trust report Annex A: Expected level of trust assurance case Annex B: Comparison of ASC to PASR Status The current first edition of part 7 was published in 2018 and confirmed unchanged in 2023. Commentary The language in part 7 is decidedly formal and stilted (e.g. “An application security claim is a claim that the application team implemented certain security controls and those controls mitigate specific security risks to an acceptable level. A security prediction is the transfer of confidence in the original claim to a claim that the same security controls are also present in a subsequent version of the application and mitigate, to the same acceptable level, the same specific security risks.” - got that?). It falls a long way short of ISO’s guidance on plain English . Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27032 ISO/IEC 27032:2023 — Cybersecurity — Guidelines for Internet security (second edition) Up Abstract ISO/IEC 27032 "provides: an explanation of the relationship between Internet security, web security, network security and cybersecurity; an overview of Internet security; identification of interested parties and a description of their roles in Internet security; high-level guidance for addressing common Internet security issues. [ISO/IEC 27032] is intended for organizations that use the Internet.” [Source: ISO/IEC 27032:2023] Introduction ISO/IEC 27032 addresses Internet security i.e. “protecting Internet-related services and related ICT systems and networks as an extension of network security”. Scope The abstract above covers the scope and purpose. The introduction notes that “[ISO/IEC 27032] does not specifically address controls that organizations can require for systems supporting critical infrastructure or national security. However, most of the controls mentioned in [ISO/IEC 27032] can be applied to such systems.” In other words it primarily concerns the ordinary everyday network security threats facing all Internet users, particularly businesses rather than the more extreme spooky threats of concern in the governmental and defence domain. Structure Main clauses: 5: Relationship between Internet security, web security, network security and cybersecurity. 6: Overview of Internet security. 7: Interested parties. 8: Internet security risk assessment and treatment. 9: Security guidelines for the Internet. Annex A: Cross-references between this standard and ISO/IEC 27002 . The annex cites a reasonable assortment of 50 controls from ISO/IEC 27002:2022 i.e.: 25 Organizational controls; 2 People controls; 0 Physical controls*; and 23 Technological controls. * It doesn't explicitly cover physical security for network cabling and equipment, nor the range and remote access concerns with wireless networking. Status The first edition was published in 2012 . The current second , thoroughly revised edition was published in 2023 . Commentary FWIW see also ISO/IEC TS 27100 . Since the term emerged in 1990, “cyber” as in “cybersecurity” has gradually become buzzword, buzzier than a hive fully of excited honeybees, and yet doubts and disagreements over what it actually means persists. SC 27 had the opportunity to clarify cyber-related terms when revising this standard but the second edition simply reproduces the definition of cybersecurity from ISO/IEC TS 27100:2020 vis “safeguarding of people, society, organizations and nations from cyber risks. Note 1 to entry: Safeguarding means to keep cyber risk at a tolerable level.” ... but fails to define "cyber" or “cyber risk”, failing yet again to clarify what it is that we are supposedly being safeguarded against. Other cyber terms defined in the first edition were simply dropped. Meanwhile, the second edition remains myopically focused on deliberate attacks perpetrated via the Internet by hackers, malware, phishers and spammers. If those are your only concerns relating to the Internet, well it appears you have led a very sheltered life ... Up Up Up This page last updated: 19 August 2026