Back Up Next ISO/IEC 27402 ISO/IEC 27402:2023 — Cybersecurity — IoT security and privacy — Device baseline requirements [first edition] Up Abstract ISO/IEC 27402 "provides baseline requirements for IoT devices to support security and privacy controls.” [Source: ISO/IEC 27402:2023] Introduction ISO/IEC 27400 describes commonplace information risks relevant to consumer and industrial IoT devices (things ) plus the associated network/cloud services, introducing the corresponding ICT security and privacy controls for the manufacturers and the users. In practice, however, as insecure things have been proliferating rapidly, the risks have generally increased. As an international standard, ISO/IEC 27402 is intended to ensure that all things at least provide a common set of foundational capabilities and functionality. IoT manufacturers using the suggested information risk management processes can build upon the standardised foundation, providing additional controls addressing the information risks relevant to various industrial and consumer applications. Scope The standard concerns basic information security and privacy controls for things . Structure Main clauses: 4: Overview - 1 paragraph 5: Requirements - for a cybersecurity and privacy baseline Annex: Risk management guidance based on ISO 31000 Status The current first edition was published in 2023 . Commentary The sheer scale, variety and rate of change in IoT makes developing information security and privacy standards challenging and yet important, arguably essential. Rapid innovation and intense market pressures on manufacturers seem unlikely to lead to voluntary adoption of this standard without additional factors (which are beyond the scope of the standard and ISO) ... unless a sufficient proportion of industrial and general consumers start inquiring about the security and privacy controls for IoT, voting with their budgets and wallets. The approach taken is to specify only a few fundamental information security and privacy controls in this ‘horizontal’ baseline standard (such as an information risk management process involving the identification, evaluation and treatment of information risks), with the intention of developing further standards specifying additional requirements for particular industry ‘verticals’, building on the generic baseline. It is anticipated that additional security controls will be required and defined in further standards for specific applications (e.g. for medical or vehicular things ). Noticeably absent from SC 27’s strategy (at present) are standards for implementing, using, managing, monitoring and administering IoT devices securely. The committee has thus far focused on getting appropriate security and privacy controls specified. As the controls are gradually designed and integrated into things (hopefully!), advice on the associated operational aspects may yet follow (possibly!). Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27004 ISO/IEC 27004:2016 — Information technology — Security techniques — Information security management ― Monitoring, measurement, analysis and evaluation (second edition) Up Abstract “ISO/IEC 27004:2016 provides guidelines intended to assist organisations in evaluating the information security performance and the effectiveness of an information security management system in order to fulfil the requirements of ISO/IEC 27001:2013, 9.1. It establishes: (a) the monitoring and measurement of information security performance; (b) the monitoring and measurement of the effectiveness of an information security management system (ISMS) including its processes and controls; [and] (c) the analysis and evaluation of the results of monitoring and measurement.” [Source: ISO/IEC 27004:2016] Introduction ISO/IEC 27004 concerns measurements or measures needed for information security management: these are commonly known as ‘security metrics’ in the profession (if not within ISO/IEC JTC 1/SC 27!). Scope The standard is intended to help an organisation evaluate the effectiveness and efficiency of its I nformation S ecurity M anagement S ystem, providing information necessary to manage and (where necessary) improve the ISMS systematically. It expands substantially on Clause 9.1 of ISO/IEC 27001 concerning ‘monitoring, measurement, analysis and evaluation’. Structure Main clauses: 4: Structure and overview - this standard supports and relates to ISO/IEC 27001 ; 5: Rationale - explains the value of measuring things e.g. to increase accountability and performance; 6: Characteristics - what to measure, monitor, analyse and evaluate, when to do it, and who should do it; 7: Types of measures - performance (efficiency) and effectiveness measures; 8: Processes - how to develop, implement and use metrics. Annex A is where most of the theoretical measurement model from the first edition of the standard now languishes. Annex B catalogs 35 metrics examples of varying utility and quality, using a typical metrics definition form. Annex C demonstrates a pseudo-mathematical way to describe a metric, or rather an ‘effectiveness measurement construct’ (!). Status The first edition was published in 2009 . It had a distinctly academic/theoretical style. A substantially revised (rewritten) second edition was published in 2016 . It is more practical. Work is under way on a third edition. The committee planned to: Update the main body and appendix references to reflect the 2022 editions of ISO/IEC 27001 , ISO/IEC 27002 and ISO/IEC 27005 . Adopt ISO’s version of plain English . This may involve extensive wording changes to make the standard even easier to understand and apply. Provide additional metrics examples to suit organisations of all sizes. Modify the title to “Information security, cybersecurity and privacy protection — Information security management — Monitoring, measurement, analysis and evaluation" . The DIS version passed a vote with mostly editorial comments, so the third edition remains on-track for publication during 2027. Commentary Since a management system is literally worse than useless without suitable metrics, it is appropriate for ISO/IEC 27001 to list this standard as a normative or essential standard. More than that, information security metrics are of value in all organisations, whether they have an ISO27k ISMS in place or not. I understand why ISO/IEC 27004 and several other ISO27k standards are aligned specifically to ISO/IEC 27001 : the narrow scope and tight focus increases the chances of the standards being completed and published in a reasonable timeframe (a problem that plagued the first edition of ISO/IEC 27004). That leaves a gap for broader-scope standards, including a general purpose information risk and security metrics standard ... or indeed an entire book . The example metrics in Annex B of the current second edition are a mixed bunch, poorly described. Please don’t think that you ought to be using them in your ISMS, unless they happen to address your specific management information needs. There are lots of moving parts to an ISMS, numerous objectives and hence plenty of measurable aspects. For example, the incident management process has numerous measureable parameters or factors at each of its eight phases: Prepare : readability of policies and procedures; team size, competencies; salaries. Identify : call-out rate; near-misses reported; Assess : incident breakdowns by type, severity etc .; Contain : investigation costs; business disruption; Investigate : incident root causes; causative factors; Resolve : impacts; time from occurrence to closure; repair costs; Learn : post-incident reviews completed; recurrent/persistent issues; actions arising; Overall : incident management process effectiveness and efficiency. The German standards body, DIN, suggested introducing the GQM (G oal-Q uestion-M etric) approach into the standard - an excellent idea raised too late for the second edition. Unfortunately, it seems the current revision project is once again missing the opportunity for this worthwhile improvement. Meanwhile, Lance Hayden’s book “IT Security Metrics ” ably explains using GQM to identify possible metrics, while “PRAGMATIC Security Metrics ” by Brotby and Hinson describes a systematic method to evaluate them and improve their quality and value. Up Up Up This page last updated: 18 September 2026

Back Up Next ISO/IEC TS 27110 ISO/IEC TS 27110:2021 — Information security, cybersecurity and privacy protection — Cybersecurity framework development guidelines (first edition) Up Abstract “[ISO/IEC TS 27110] specifies guidelines for developing a cybersecurity framework. It is applicable to cybersecurity framework creators regardless of their organisations' type, size or nature.” [Source: ISO/IEC TS 27110:2021)] Introduction This T echnical S pecification offers guidance for those within organisations who are creating cybersecurity frameworks, defined as “basic sets of concepts used to organize and communicate cybersecurity activities” . Scope The standard “specifies guidelines for developing a cybersecurity framework.” Structure Main clauses: 5: Overview 6: Concepts 7: Creating a cybersecurity framework Annex A: Considerations in the creation of a cybersecurity framework - outlines some inputs, activities and outputs for each of the identify, protect, detect, respond and recover stages Annex B: considerations in the integration of a cybersecurity framework - concerns its 'integration into practice' a.k.a. implementation Status The current first edition was published as a T echnical S pecification in 2021 and confirmed unchanged in 2024. Commentary The intended audience and purpose of this standard is hard to fathom. Who is it for, and what is a “cybersecurity framework” anyway? Whose ‘burden’ is it seeking to lighten, and what is the nature of their burden? According to the introduction, “business groups, government agencies, and other organisations produce documents and tools called cybersecurity frameworks to help organize and communicate cybersecurity activities of organisations” . My toolbox contains no “cybersecurity frameworks” so I guess this standard is not aimed at me; The standard makes no attempt to explain what it means by ‘cybersecurity’. This is yet another ISO27k ‘cybersecurity’ project that studiously avoids defining the term, using woolly language to confuse instead of clarify. So much for international standards pushing back the frontiers; The distinction between “creators” and “implementors” of “cybersecurity frameworks” implies a conventional waterfall approach i.e. someone first identifies requirements, designs and develops a solution (the “framework”) which someone else then puts into operation. There is no hint presently that the process might be iterative, or that both phases would need to be governed and managed appropriately. However, I’m guessing here since the standard does not elaborate: it simply states that framework creators are its intended audience; The ‘concepts’ that (according to the standard) “should be included in a cybersecurity framework” simply reflect the usual pre-, para- and post-incident stages, another simplistic linear timeline. This is hardly rocket surgery. However, the standard makes no attempt to justify why these specific ‘concepts’ ‘should’ be ‘included’, and completely ignores the possibility of other potential ‘concepts’ or framework structures (such as ISO/IEC 27001 to name but one of several); The examples listed in Annex C suggest a “cybersecurity framework” might be a strategic approach for dealing with (presumably IT and Internet-related information) risks to critical national infrastructures, implying therefore that the ‘cybersecurity framework creators’ would be government officials. But I’m guessing again, pecking between the lines like a hungry chicken for tiny crumbs of sense. The relationship between a “cybersecurity framework” and a conventional ISMS remains unclear at this point. Those “documents and tools” sound to me suspiciously like the embodiment of a management system, despite the draft standard stating categorically “This document is not intended to supersede or replace the requirements of an ISMS given in 27001” [sic] . To my cynical, perhaps jaundiced eye, this looks suspiciously like an attempt to align ISO27k with - or perhaps amend ISO27k to embody - NIST’s C yber S ecurity F ramework specifically. Organisations that prefer the CSF are of course free to adopt it, so why change ISO27k, especially while “cybersecurity” remains a solid-gold buzzword that consistently defies definition? Oh I despair! Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27555 ISO/IEC 27555:2021 — Information security, cybersecurity and privacy protection — Guidelines on personally identifiable information deletion (first edition) Up Abstract ISO/IEC 27555 "contains guidelines for developing and establishing policies and procedures for deletion of personally identifiable information (PII) in organisations by specifying: a harmonized terminology for PII deletion; an approach for defining deletion rules in an efficient way; a description of required documentation; a broad definition of roles, responsibilities and processes. ...” [Source: ISO/IEC 27555:2021] Introduction This standard gives guidance on the deletion of P ersonally I dentifiable I nformation using a systematic approach supporting ISO/IEC 29100 ’s “Privacy framework”. Scope The standard is intended for organisations that store and process PII “and other personal data”, in particular PII Controllers who are primarily accountable for compliance with privacy laws. It does not address: Specific provisions in laws and contracts (although it does reflect the general thrust of GDPR and other privacy laws and regulations based on the OECD privacy principles ); Specific deletion rules for particular types (“clusters”) of PII; Deletion mechanisms such as those for cloud storage; Security of the deletion mechanisms; nor Specific techniques for de-identification (anonymisation) of data. Standardising the approach may facilitate harmonized catalogues of PII deletion rules for industrial sectors, clarifying requirements for IT systems processing personal data. Structure Main clauses: 5: Framework for deletion 6: Clusters of PII 7: Specification of deletion periods 8: Deletion classes 9: Requirements for implementation 10: Responsibilities ~30 pages Status The current first edition was published in 2021 . It is currently being revised with publication of the second edition planned for mid-2027. Changes are mostly for readability and consistency, with minor technical updates e.g . PII clusters can include PII within or inferred from Machine Learning/AI models. Commentary The standard discusses deletion of “clusters” of PII, an intriguing yet complex concept relating to how PII is used for various business purposes. Whereas privacy standards, laws, regulations and guidelines typically focus on protecting distinct items of PII, the clustering or collation of PII items concerning individual people, drawn from various sources/systems and provided for various purposes with various constraints, potentially represents an insidious Big Brother-style threat. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27000 ISO/IEC 27000:2026 — Information security, cybersecurity and privacy protection — I nformation S ecurity M anagement S ystems — Overview (sixth edition) Up Abstract “ISO/IEC 27000 explains the core concepts and principles behind information security management systems , or ISMS. It provides an overview of the ISO/IEC 27000 family of standards, including ISO/IEC 27001, and clarifies how these documents relate to each other. The standard helps organizations understand the foundations of information security management before selecting, implementing or working with more specific ISMS standards.” [Source: ISO.org ) Introduction What is an I nformation S ecurity M anagement S ystem? What's the point? What is it for and what is it intended to achieve? How does it do that? What does it consist of? What is it not ? If questions of that nature puzzle you, this brief standard helps by explaining a 'management system', specifically a systematic way of managing information risks and information security controls. Scope ISO/IEC 27000 outlines the ISO27k 'family of standards': ISO/IEC 27001 - ISMS requirements ISO/IEC 27002 - information security controls ISO/IEC 27003 - ISMS guidance ISO/IEC 27004 - ISMS metrics ISO/IEC 27005 - information security risk management ISO/IEC 27006-1 - ISMS certification ISO/IEC 27007 - ISMS auditing ISO/IEC TS 27008 - information security controls assessment ISO/IEC 27010 - inter-sector and inter-organizational communications ISO/IEC 27011 - information security controls for telecommunications organizations ISO/IEC 27013 - integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1 (ITIL) ISO/IEC 27014 - governance of information security ISO/IEC TR 27016 - organizational economics IISO/IEC 27017 - information security controls for cloud services ISO/IEC 27019 - information security controls for energy utilities ISO/IEC 27021 - ISMS professional competencies ISO/IEC TR 27022 - ISMS processes ISO/IEC 27028 - information security control attributes It also mentions: ISO 31000 - risk management guidelines ISO/IEC 33004 - requirements for process reference, assessment and maturity ISO/IEC 17021-1 - conformity assessment ISO/IEC 17000 - conformity assessment vocabulary and general principles ISO 19011 - management systems auditing Structure The 11-page standard has just three main clauses: 3: Terms and definitions - formally defines 12 key terms used in this standard, 7 of which are shortened definitions form other standards (without their notes) leaving 5 unique definitions. [1½ pages] 4: Concepts and principles - introduces information security, risk and security management, and management systems. [4 pages] 5: Documents* related to ISMS including ISO/IEC 27001 - succinct descriptions (just a sentence or so) of each of the standards numbered 1 to 18 above. [3 pages] * Note: within ISO/IEC 27000, the term 'documents' means ISO and ISO/IEC standards, specifically, not documents in general. The mandatory and discretionary ISMS documents noted in ISO/IEC 27001 and other ISO27k standards are not described here, although a few are mentioned (e.g. ISMS scope and risk treatment plan). Status The first edition was published in 2009 . It was updated in 2012 , 2014 , 2016, 2018 and ... wait for it ... 2026 . The previous 5th edition was released by ISO for free as an introduction and promotion of ISO27k. A request has been lodged with ISO to make the current 6th edition free as well. Until that is approved and actioned, any copies of ISO/IEC 27000:2026 found loitering on the web are probably pirated. Commentary Due to an ISO policy decision, the current 2026 sixth edition dropped previous editions' extensive glossaries of dozens of ISO27k terms, leaving just a dozen actually used in this standard. However, the official definitions remain available online in ISO's Online Browsing Platform and IEC's Electropedia . Alternatively, the Cybersecurity Hyperglossary defines well over 5,000 terms in plain English, as well as quoting thousands of formal definitions. Get ~800 pages for two-thirds the price of these 11 ! Shameless plug! Have you got yours yet? The 2026 edition includes a notable but easily-overlooked change regarding the identification of 'interested parties' (stakeholders) for an organisation's information security: "Interested parties can include not only the organization’s customers, suppliers, business partners, employees, shareholders, but also government officials and, potentially, regulators. Competitors and criminals are also interested parties. Their requirements should be especially addressed by the information security controls of the ISMS. Indeed, a purpose of such information security controls is to protect the organization from the activities of such third parties." So, an appreciation of the organisation's potential adversaries implies updating the risk identification, analysis, evaluation and treatment accordingly. ISO/IEC 27000 is quite liberal in its use of the word 'requirement' and similar terms such as 'need', 'necessary', 'objective', 'essential', 'expected'. In ISO standards such as ISO/IEC 27001 , 'requirement' generally means a statement formally defining or declaring something that is mandatory in order to claim conformity - a narrow interpretation. ISO/IEC 27000 is not exclusively concerned with mandatory requirements for conformity assessment purposes, so has a more liberal interpretation. The information security controls in ISO/IEC 27001 (annex A), '27002 , '27010 , '2 7011 , '27017 and '27019 are called “Candidate necessary information security controls ” - a curiously ambiguous turn of phrase. ‘Necessary’ here is for management to determine according to its evaluation of the organisation's information risks relative to the risk appetite. ‘Candidate’ is clearly not ‘required’ and is less than ‘suggested’, but still some readers and inept auditors may feel the controls should or perhaps must be implemented. [Spoiler alert] They don't. The summary claims that ISO/IEC 27000 "clarifies how [18 ISO27k standards] relate to each other". While a table and diagram group the 18, the interrelationships or dependencies between them are not explained, unfortunately. For example, the 'sector-specific' standards ISO/IEC 27011 , '27017 and '27019 , identify information security controls (mostly drawn from ISO/IEC 27002 ) for telecoms, cloud and power companies, respectively: the processes of identifying and evaluating information risks to determine which controls are necessary, justifying the associated investments and implementation details, monitoring and managing them to achieve, maintain and gain assurance of their adequacy (efficiency and effectiveness) are covered by several other ISO27k standards. Again, those three standards do not mandate specific information security controls, nor are they comprehensive. They are generic suggestions. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27001 ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements (third edition) Up Abstract ISO/IEC 27001 "specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization. [It] also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization ...” [Source: ISO/IEC 27001:2022] Introduction ISO/IEC 27001:2022 (known colloquially as “ISO 27001”, “ISO27001”, “27001” or “two seven double-oh one”) formally specifies an I nformation S ecurity M anagement S ystem, a governance arrangement comprising a structured suite of organised activities with which to manage risks relating to the confidentiality, integrity and availability of information (called ‘information security risks’ in the standard). According to the ISO directives part 1 annex SL , an ISMS is a set of interrelated or interacting elements of an organisation to establish policies and objectives relating to the security of information, as well as processes to achieve those objectives. An ISMS is an overarching framework through which management identifies, evaluates and treats (addresses) the organisation’s information risks. The ISMS ensures that the security arrangements are appropriately designed and fine-tuned to keep pace with changes to the security threats, vulnerabilities and business impacts. Adaptation is important in such a dynamic field, and a key advantage of ISO27k’s flexible risk-driven approach as opposed to more prescriptive and rigid approaches such as PCI-DSS. Flexibility allows the standard to apply to all types of organisations (e.g . commercial enterprises, government agencies, non-profits, clubs) of all sizes (from micro-businesses to sprawling multinationals) in all industries (e.g . retail, banking, defence, healthcare, education and government), worldwide. Given such a huge brief, the standard is necessarily generic, specifying only the bare minimum, the core ISMS requirements common to all organisations. ISO/IEC 27001 does not formally demand specific information security controls since the controls that are required vary markedly between organisations. The information security controls from ISO/IEC 27002 are summarised in annex A of ISO/IEC 27001, rather like a menu. Organisations adopting ISO/IEC 27001 are free to choose whichever specific information security controls are applicable to their particular information risks, perhaps but not necessarily drawing on those listed in the menu and potentially supplementing or replacing them with other a la carte options (known as extended or custom control sets). The way to select "necessary" (applicable) controls is to undertake a comprehensive assessment of the organisation’s information risks within scope of the ISMS: this is one vital and mandatory part of the ISMS. Furthermore, management may elect to avoid, share or accept information risks rather than mitigate them through information security controls - a risk treatment decision within the specified risk management process. Appropriate governance arrangements and management controls are also appropriate to direct, control and oversee the ISMS: the standard gives fairly rudimentary and circumspect guidance in these areas. Scope The standard applies to any organisation that needs to protect and legitimately exploit information, systematically. 'Information' may include: Business information belonging to the organisation itself, such as its financial, HR and operating info, trade secrets, intellectual property such as trademarks, designs, patents and brands, plus workers' knowledge and experience; Business information belonging to third parties , such as commercial software and content licensed or given to the organisation for custodianship, plus public or community-owned info; and Personal information belonging to individual people such as workers or supplier/customer contacts. Structure The standard has 10 clauses plus an unnumbered introduction and an annex: Scope : it specifies generic ISMS requirements suitable for organisations of any type, size or nature, in any location. Normative references : only ISO/IEC 27000 is considered absolutely essential reading for users of ’27001. Terms and definitions : see ISO/IEC 27000 . Context of the organisation : understanding the organisational/business context, the needs and expectations of ‘interested parties’ and defining the scope of the ISMS. Section 4.4 starkly states that “The organisation shall establish, implement, maintain and continually improve” the ISMS, meaning that it must be operational, not merely designed and documented. Leadership : top management must demonstrate leadership and commitment to the ISMS, mandate policy, and assign information security roles, responsibilities and authorities. Planning : outlines the process to identify, analyse and plan to treat information risks, to clarify the objectives of information security, and to manage ISMS changes. Support : adequate, competent resources must be assigned, awareness raised, documentation prepared and controlled. Operation : more detail about assessing and treating information risks, managing changes, and documenting things (partly so that they may be audited by certification auditors: certification is optional). Performance evaluation : monitor, measure, analyse and evaluate/audit/review the information security controls, processes and management system, systematically improving things where necessary. Improvement : address the findings of audits and reviews (e.g. nonconformities and corrective actions), systematically refining the ISMS. Annex A - Information security control reference : this does little more than name the controls in ISO/IEC 27002 - one sentence summaries of 27002's one page descriptions. The annex is ‘normative’ meaning that certified organisations are required to use it to check their ISMS for completeness (according to clause 6.2), but that does not mean they are required to implement the controls: given their particular information risks, they may prefer other controls or risk treatments or the corresponding risks may be irrelevant (e.g. a totally virtual organisation with no business premises and no physical presence may determine that physical security controls are pointless). Refer to ISO/IEC 27002 for lots more detail on the security controls, including useful implementation guidance, and ISO/IEC 27005 to understand information risk management. Bibliography: points readers to related standards, plus part 1 of the ISO/IEC Directives , for more information. In addition, ISO/IEC 27000 is 'normative' and there are several references to ISO 31000 on risk management. Status The first edition, based on BS 7799 Part 2 (1999), was published in 2005 . The second edition, completely revised with substantial changes to align with other ISO management systems standards, was published in 2013 , followed by two corrigenda (corrections). The current third edition, published in 2022 , has some wording changes to the main-body clauses to reflect the revised ISO directives part 1 annex SL common structure/boilerplate for all the ISO management systems standards, plus a completely restructured and revised Annex A reflecting ISO/IEC 27002:2022 . An amendment to ISO/IEC 27001:2022 was published in 2024 , formally clarifying that, in clauses 4.1 and 4.2, the ‘relevance of climate change should be considered ’ - a timely reminder to think broadly when considering the context and purpose of the ISMS. Take a look at "Secure the planet " for clues about potential touch points between information security and climate change. Commentary Whereas ISO/IEC 27001 does not use the word ‘governance’, a ‘management system’ combines a governance structure with a number of management controls to ensure management’s strategic intent is put into effect, becoming an integral part of the organisation. In the case of an ISMS, the system enables management to direct, oversee, control and gain assurance in information risk, security, privacy and related areas. Other ISO management systems standards based on the same ISO boilerplate text presumably avoid the word ‘governance’ as well. This could be considered a systematic flaw in ISO’s management systems approach. However, companion standards such as ISO/IEC 27014 provide guidance in that area. Planning for updates to any certification standard is tricky because of the need to allow time for the accreditation and certification bodies to plan and enact their transition arrangements, although ISO deliberately and pointedly stays clear of accreditation and certification so, in theory , it should not really matter. In practice , it does, meaning a delicate and ambiguous relationship between standards and certification. An ISMS documented almost entirely in the form of thought-provoking diagrams, mindmaps or motivational videos rather than the usual boring, wordy, static documents would be novel, radical, creative, perhaps even brilliant ... if only someone was willing to give it a go ... Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27021 ISO/IEC 27021:2017 (amended ) — Information technology — Security techniques — Competence requirements for information security management systems professionals (first edition) Up Abstract “ISO/IEC 27021:2017 specifies the requirements of competence for ISMS professionals leading or involved in establishing, implementing, maintaining and continually improving one or more information security management system processes that conforms to ISO/IEC 27001.” [Source: ISO/IEC 27021:2017] Introduction To help stabilise and standardise the global market for training and certifying professionals for ISO27k implementation and audit work, this standard lays out the competence expected of ISMS professionals. Scope The standard concerns the competences (meaning the combination of knowledge and skills) required or expected of professionals managing an ISMS in accordance with ISO/IEC 27001 , ISO/IEC 27002 , ISO/IEC 27005 and ISO/IEC 27007 . Note : the standard does not specify a qualification scheme as such, but in effect serves as a reference for the organisations that offer such schemes. Note : the standard does not cover auditor competence. Structure Main clauses: 4: Concept and structure 5: Business management competence for ISMS professionals 6: Information security competence for ISMS professionals Annex A: Including knowledge for ISMS professionals as parr of a body of knowledge The standard starts by explaining that an ISMS is just one form of Management System, requiring a combination of competences in general business management (e.g. leadership and communication, planning and budgeting) plus information security/ISMS management (e.g. scoping the ISMS). The competences roughly mirror the main body clauses of ISO/IEC 27001 , except that most of the general management competences are not directly related to specific clauses. Each competence is described quite succinctly in four ways: Relevant ISO/IEC 27001 clause (where applicable) Intended outcome: what this part of the role entails and is expected to achieve Knowledge required: things the ISMS professional should know about Skills required: things the ISMS professional should be able to do Status The first edition was published in 2017 . Additional references to ISO/IEC 27001 clauses were added to plug gaps in the competencies table through an amendment in 2021: ISO/IEC 27021:2017/Amd1:2021 Information technology - Security techniques - Competence requirements for information security management systems professionals - Amendment 1: Addition of ISO/IEC 27001:2013 clauses or subclauses to competence requirements . Commentary Although the title of this standard includes the reserved word ‘requirements’, that should not be taken to imply this is a certifiable standard. The four standards listed in the scope section above may be the ‘core standards’ but they represent just a fraction of the growing ISO27k suite . It could be argued that several others are nearly as important - ISO/IEC 27003 and ISO/IEC 27004 for examples - which begs questions about the breadth and depth of knowledge and competencies truly expected of information security managers. Another aspect is that (ISO27k notwithstanding) information security management is materially different in different types/sizes of organisation, so perhaps there is a need for different levels or tiers of qualification (or practitioner maturity, you could say), from entry-level basics up to subject matter experts? A tiered scheme would also encourage career development and lifelong learning. Since the standard is intended to guide those developing courses and qualifications, it might make sense to incorporate or build the standard around a matrix listing the skills and competencies on one axis and the levels or tiers on another, indicating in the body of the matrix which items people at that level/tier are expected to know about and be competent to perform. The idea of a tiered scheme was agreed in principle by the project team, with e-CF and e-QF schemes (whatever they are!) being mentioned during drafting: maybe this suggestion will be revisited when the standard is next revised. The standard incorporates the idea of a B ody o f K nowledge defined in the standard to cover the core aspects of governing and managing an ISMS, but extendable by organisations to address their specific additional requirements in this area. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27036-4 ISO/IEC 27036–4:2016 — Information security — Security techniques — Information security for supplier relationships — Part 4: Guidelines for security of cloud services (first edition) Up Abstract ISO/IEC 27036 part 4 “provides cloud service customers and cloud service providers with guidance on (a) gaining visibility into the information security risks associated with the use of cloud services and managing those risks effectively, and (b) responding to risks specific to the acquisition or provision of cloud services that can have an information security impact on organizations using these services. [Part 4] does not include business continuity management/resiliency issues involved with the cloud service. ISO/IEC 27031 addresses business continuity. [Part 4] does not provide guidance on how a cloud service provider should implement, manage and operate information security. Guidance on those can be found in ISO/IEC 27002 and ISO/IEC 27017. The scope of [part 4] is to define guidelines supporting the implementation of information security management for the use of cloud services” [Source: ISO/IEC 27036-4:2016 ] Introduction There are numerous information risks involved in the supply of cloud computing services: this standard encourages suppliers and customers to identify and address them, collaboratively in some cases. Scope Part 4 guides the suppliers and customers of cloud services on information security management for cloud services. Structure Main clauses: 5: Key cloud concepts and security threats and risks 6: Information security controls in cloud service acquisition lifecycle 7: Information security controls in cloud service providers Annex A: Information security standards for cloud providers Annex B: Mapping to ISO/IEC 27017 controls Status The current first edition of part 4 was published in 2016 and confirmed unchanged in 2022. Commentary Part 4 explicitly describes the information risks that it addresses. Full marks! Various security controls are recommended to mitigate unacceptable risks so, in order for an organisation to choose appropriate controls, it helps to know what those risks are. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27556 ISO/IEC 27556:2022 — Information security, cybersecurity and privacy protection — User-centric privacy preferences management framework (first edition) Up Abstract ISO/IEC 27556 "provides a user-centric framework for handling personally identifiable information (PII), based on privacy preferences.” [Source: ISO/IEC 27556:2022] Introduction The standard lays out a “user-centric framework” (an architecture) to handle personal information in a controlled manner in accordance with the privacy-by-design and other requirements of applicable privacy laws and regulations. The standard outlines a mechanism for organisations handling personal data to comply with data subjects’ privacy requirements, even as those organisations share and collaborate on processing the data. Scope The standard describes a generic high-level system architecture without specifying the content and format of privacy preference information. The architecture, in turn, informs the design and implementation of IT systems handling personal information and communicating it between organisations, while managing the privacy preferences of data subjects (known as ‘PII Principals’ in the standard i.e. the people whose personal information is being handled). The standard expands upon ISO/IEC 29100’s “Privacy framework ”. Structure Main clauses: 5: User-centric framework for handling PII 6: Requirements and recommendations for the P rivacy P reference M anager (defined as “component providing a capability allowing PII principals to express privacy preferences and a capability to monitor PII processing according to these privacy preferences” - normally an IT system component, not a person) 7: Further considerations for the PPM in a P rivacy I nformation M anagement S ystem Annex A: Use cases of PII handling based on privacy preferences Annex B: Identifying an actor serving as a component for each example service Annex C: Guidance on configuration of privacy preferences management Annex D: Supporting the design of a privacy preference management Status The current first edition was published in 2022 . Commentary I appreciate the intent to standardise the handling and management of users’ privacy consents, perhaps allowing the preferences to be shared among systems. However, given strong commercial incentives for social media and related systems and companies to exploit every scrap of personal information they can obtain, it may take even stronger pressure from regulators and legislators on behalf of private individuals to see this widely adopted in practice. So, watch this space. Up Up Up This page last updated: 19 August 2026