Back Up Next ISO/IEC 27400 ISO/IEC 27400:2022 — Cybersecurity — IoT security and privacy — Guidelines (first edition) Up Abstract ISO/IEC 27400 "provides guidelines on risks, principles and controls for security and privacy of Internet of Things (IoT) solutions.” [Source: ISO/IEC 27400:2022] Introduction The standard provides guidance on the principles, [information] risks, and the corresponding information security and privacy controls to mitigate those risks associated with the I nternet o f T hings. Insecure things can impact security and privacy in ways that differ from more conventional IT systems (e.g. desktops, laptops and servers). Therefore, appropriate security and privacy controls are needed to mitigate unacceptable risks. Things can be considered both as discrete electronic devices, and as components in larger, more complex ‘ecosystems’ potentially including: The operating systems and applications they run, delivering various services; The network infrastructure (personal, local and wide area networks); The physical world with which they interact through sensors and actuators; The people who specify, acquire, configure, use and manage them; The organisations that design and manufacture, use/operate and manage them; Society at large since things are ‘everywhere’. Challenges and information risks in the context of IoT include: Huge variety, innovation and ubiquity with things penetrating ever deeper into our businesses, homes, vehicles and lives; Vulnerabilities in the systems, applications and networks, plus the associated processes and activities (e.g. simply compiling, let alone maintaining and using, an inventory of things is tricky and costly - as we discovered during the Y2k crisis); Threats, both deliberate (e.g. hackers and malware) and natural (e.g . adverse physical operating conditions, power cuts, static discharge, design flaws, bugs/coding errors, user accidents and ineptitude); Impacts, potentially including safety hazards and property damage as well as the usual information security and privacy incidents (e.g . data corruption, disclosure, loss); Lifecycle implications (e.g. cheap, disposable, unmanaged and/or deeply embedded things may hang around for years and are unlikely to be supported or patched, ever); Ordinary users may not have an interest in or understand the security and privacy of their things , while even IT professionals may not have the time, leaving fit-and-forget things largely unmanaged, unmonitored and unmaintained; Concerns around interoperability, interaction and dependencies between things, and with other networked devices; Individually, most things have limited functionality, accessibility (e.g. minimalist human-machine interfaces) and computing performance (e.g. little processing and storage capacity); Mobility, dynamics and complexity verging on chaos and anarchy; Applications/use cases and situations may not have been anticipated by their designers/manufacturers (e.g . when things are re-purposed, combined or customised for novel applications); Things may change hands over time, affecting the context and raising the possibility of insecure configurations and inappropriate disclosure of stored information (e.g . when casually sold-on, lost or discarded). IoT designers/manufacturers and users, both individuals and organisations, may be oblivious to the information risks and appropriate/necessary controls, hence the standard (and this website!) has a role in raising awareness and trustworthiness, driving up maturity on both the supply (vendor) and the demand (customer) sides. Scope The standard is specific to IoT, covering both information security and privacy. Structure Main clauses: 5: IoT concepts 6: Risk sources for IoT systems 7: Security and privacy controls Annex A: IoT monitoring camera sample risk scenario Status The current first edition was published in 2022 . It was proposed to change this standard into a “horizontal deliverable” spanning several ISO/IEC committees with common interests in IoT, becoming a foundational standard defining the underlying concepts or principles. [I don’t know if that was accepted.] Commentary The standard strikes me as idealistic - a stretch goal for the IoT market as a whole, a reasonable strategy for an international standard. It may get traction in the area of industrial and safety-critical IoT. As to consumer grade things, it’s hard to predict much progress on security and privacy given the cost constraints and present lack of demand for security and privacy - a classic example of the need for pragmatic standards. The standard identifies some generic ‘risk sources’ and ‘risk scenarios’ relevant to IoT, essentially a selection of examples for consideration. I have some concerns about the selection and the wording, and the lack of direct linkages between the IoT security controls recommended elsewhere in the standard and the identified risks that they are presumably intended to mitigate. However, discussing relevant [information] risks in an ISO27k standard is, I feel, a positive move in its own right. Most ISO27k standards leap directly to recommending a bunch of information security controls, barely even mentioning the information risks. This standard goes a step beyond the “Just do this:” style, albeit a small step. It’s a start, a prompt for users of the standards to identify, consider and evaluate the information risks in their own contexts. I hope the information risk-aligned approach will spread to all the ISO27k standards in due course ... although so far I have seen no hint of strategic intent expressed by SC 27 along these lines, and such a change would undoubtedly take decades. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27036-4 ISO/IEC 27036–4:2016 — Information security — Security techniques — Information security for supplier relationships — Part 4: Guidelines for security of cloud services (first edition) Up Abstract ISO/IEC 27036 part 4 “provides cloud service customers and cloud service providers with guidance on (a) gaining visibility into the information security risks associated with the use of cloud services and managing those risks effectively, and (b) responding to risks specific to the acquisition or provision of cloud services that can have an information security impact on organizations using these services. [Part 4] does not include business continuity management/resiliency issues involved with the cloud service. ISO/IEC 27031 addresses business continuity. [Part 4] does not provide guidance on how a cloud service provider should implement, manage and operate information security. Guidance on those can be found in ISO/IEC 27002 and ISO/IEC 27017. The scope of [part 4] is to define guidelines supporting the implementation of information security management for the use of cloud services” [Source: ISO/IEC 27036-4:2016 ] Introduction There are numerous information risks involved in the supply of cloud computing services: this standard encourages suppliers and customers to identify and address them, collaboratively in some cases. Scope Part 4 guides the suppliers and customers of cloud services on information security management for cloud services. Structure Main clauses: 5: Key cloud concepts and security threats and risks 6: Information security controls in cloud service acquisition lifecycle 7: Information security controls in cloud service providers Annex A: Information security standards for cloud providers Annex B: Mapping to ISO/IEC 27017 controls Status The current first edition of part 4 was published in 2016 and confirmed unchanged in 2022. Commentary Part 4 explicitly describes the information risks that it addresses. Full marks! Various security controls are recommended to mitigate unacceptable risks so, in order for an organisation to choose appropriate controls, it helps to know what those risks are. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27033-4 ISO/IEC 27033-4:2014 Information technology — Security techniques — Network security — Part 4: Securing communications between networks using security gateways (first edition) Up Abstract ISO/IEC 27033 part 4 “gives guidance for securing communications between networks using security gateways (firewall, application firewall, Intrusion Protection System, etc.) in accordance with a documented information security policy of the security gateways, including: identifying and analysing network security threats associated with security gateways; defining network security requirements for security gateways based on threat analysis; using techniques for design and implementation to address the threats and control aspects associated with typical network scenarios; and addressing issues associated with implementing, operating, monitoring and reviewing network security gateway controls.” [Source: ISO/IEC 27033-4:2014] Introduction Part 4 gives an overview of security gateways , describing different architectures. Scope Guidance on securing communications between networks through gateways, firewalls, application firewalls, Intrusion Protection System [sic ] etc . in accordance with a policy. Includes identifying and analysing network security threats, defining security control requirements, and designing, implementing, operating, monitoring and reviewing the controls. Structure Main clauses: 6: Overview 7: Security threats 8: Security requirements 9: Security controls 10: Design techniques 11: Guidelines for product selection Status ISO/IEC 27033-4 revised and replaced ISO/IEC 18028-3 . The current first edition of part 4 was published in 2014 and confirmed unchanged in 2019. It is slightly more up to date than other parts of ISO/IDC 27033 in that it mentions 'cloud', twice, and even VoIP. Gosh. Denial-Of-Service attacks on corporate networks were evidently a big concern back in 2014, but ransomware was yet to make its big entrance stage right. Commentary The standard outlines how security gateways (a.k.a. firewalls) analyse and control network traffic through: Packet filtering; Stateful packet inspection; Application proxy (application firewalls); N etwork A ddress T ranslation; Content analysis and filtering. It guides the selection and configuration of security gateways, choosing the right type of architecture for a security gateway which best meets the security requirements of an organisation. It refers to various kinds of firewall as examples of security gateways. [Firewall is a commonplace term of art that is curiously absent from ISO/IEC 27000 and ISO/IEC 27002 , neither is it defined explicitly in this standard. I wonder if some ancient ISO standard had already 'taken' the term to describe a physical barrier impeding the spread of fire and smoke e.g. from the engine into the passenger compartments of a car?]. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27017 I SO/IEC 27017:2026 / ITU-T X.1631 — Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services [second edition] Up Abstract "ISO/IEC 27017 provides guidance for implementing information security controls in cloud services . It builds on ISO/IEC 27002 by adding cloud-specific guidance and additional controls for both cloud service customers and cloud service providers. The standard helps organizations address security risks that arise from the shared nature of cloud computing. It clarifies how information security controls can be applied across customer and provider environments, including situations where responsibilities, infrastructure and operational activities are divided between multiple parties. ISO/IEC 27017 applies to all cloud deployment models, including public, private and hybrid cloud environments. Its controls should be selected and applied according to the organization’s risk assessment and any relevant legal, regulatory, contractual or cloud-specific security requirements.” [Source: ISO/IEC 27017:2026] Introduction This standard provides guidance on the information security aspects of cloud computing to assist with the implementation of cloud-specific information security controls. Scope The standard provides additional information security controls implementation advice, supplementing the guidance in ISO/IEC 27002 and other ISO27k standards in the context of cloud computing services. Structure The standard advises both Cloud Service Customers and Cloud Service Providers , the complementary security guidance for each audience being laid out side-by-side in clauses 5 to 8 mirroring the structure of ISO/IEC 27002 : Clause 4 sets the scene with general guidance and concepts; Clause 5 covers organizational controls for cloud services [controls such as policy that don't fit neatly into the people, physical or technological domains]; Clause 6 covers people controls for cloud services; Clause 7 covers physical controls for cloud services; Clause 8 covers technological controls for cloud services; Annex A maps the first edition of the standard to the second; Annex B concerns cloud service [security] monitoring . There are 4 cloud-specific information security controls adding to the 93 in ISO/IEC 27002 : 5.38 - Shared roles and reponsibilities within a cloud computing environment [managing the security aspects as part of commercial relationship management] 5.39 - Agreement on the roles and responsibilities of the cloud service partner [meaning both 'sides'!] 8.35 - Segregation in virtual computing environments [keeping tenants isolated from each other and protecting the CSP's platform and internal services from tenants] 8.36 - Detection and prevention of unauthorized use of cloud services [primarily a CSC concern] Status The first edition was published in 2015 . Having been developed jointly by ISO/IEC and ITU-T, the standard was dual-numbered ISO/IEC 27017 and ITU-T X.1631 with identical content. Work on a second edition started in 2022 as a collaboration between ISO/IEC SC 27 and SC 38, ITU-T SG17 and the C loud S ecurity A lliance , reconsidering and reorganising the controls as per ISO/IEC 27002:2022 . The second edition was published in August 2026 , more than a decade after the first . Commentary In my opinion, ISO/IEC 27017 still takes an unrealistically simplistic view of cloud service provider and customer relationships as individual one-to-one interactions. In reality, cloud services are often provided by multiple suppliers to multiple clients in different organisations, and nothing remains static for long. In practice, inter-organisational business relationships often extend through complex cloud supply chains or supply networks, with multiple parties involved in collaborating to assemble, deliver and manage cloud services (e.g . network, data centre, physical servers, virtual servers, operating systems, database management systems and other layered software, applications, and all the associated services). Consequently, there are numerous supplier-customer relationship risks to manage, such as organisational interdependence, contracting and subcontracting, complexity, dynamics and compliance. There are risk visibility and trust issues, resourcing challenges, commercial angles, technological challenges and more to contend with. Cloud-related information risks are, well, cloudy! Risk treatments for cloud and other information risks may include risk sharing, avoidance and acceptance - not just risk mitigation using security controls. Neither this standard nor ISO/IEC 27002 pay much attention to risk treatments other than mitigation using security controls - a persistent systematic bias throughout ISO27k. Particularly for small or immature organisations, cloud services providing email, file storage and office apps etc . may be treated as mere commodities, procured without adequate consideration of information risk, security, privacy etc . However, some cloud services may be critical for core business, and cloud generally increases the organisation’s attack surface and vulnerabilities. [This issue may be more relevant to ISO/IEC 27005 and ISO/IEC 27036 .] Cloud services proved their value for resilience and flexible working through COVID. There are general principles and lessons here that can help organisations be better prepared to cope with future widespread/global challenges such as further pandemics, wars, Internet connectivity issues etc. The challenge is to draw them out, considering and embedding them where appropriate. ISO does not intend to develop a formal requirements specification standard against which to certify the security of Cloud Service Providers specifically. CSPs can, however, be certified against ISO/IEC 27001 , ISO/IEC 27701 and other standards in the usual way, while there are non-ISO cloud security assessment and certification, classification, benchmarking or assurance schemes such as CSA STAR . Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27002 ISO/IEC 27002:2022 — Information security, cybersecurity and privacy protection — Information security controls (third edition) Up Abstract ISO/IEC 27002 "provides a reference set of generic information security controls including implementation guidance. [ISO/IEC 27002] is designed to be used by organisations: (a) within the context of an information security management system (ISMS) based on ISO/IEC27001; (b) for implementing information security controls based on internationally recognized best practices; [and] (c) for developing organisation-specific information security management guidelines.” [Source: ISO/IEC 27002:2022] Introduction ISO/IEC 27002 is a popular international standard describing a generic selection of ‘good practice’ information security controls, typically used to mitigate unacceptable risks to the confidentiality, integrity and availability of information. It was based on British Standard BS 7799 in the mid-1990s, itself based on an oil company's proprietary information security manual. ISO/IEC 27002 is an advisory document, a guideline or recommendation rather than a formal specification such as ISO/IEC 27001 . Organisations are advised to identify and evaluate their own information risks, selecting or designing and applying suitable information security controls to mitigate unacceptable risks using ISO/IEC 27002 and other relevant standards and sources for guidance. Scope Like governance and risk management, information security management is a broad topic with ramifications for all organisations. Information security, and hence ISO/IEC 27002, is relevant to all types of organisation including commercial enterprises of all sizes (from one-man-bands up to multinational giants), not-for-profits, charities, clubs, government departments and quasi-autonomous bodies - in fact any organisation that handles and depends on information. The specific information risks and hence control requirements differ in detail between organisations but there is a lot of common ground, for instance most organisations need to address information risks relating to their employees plus contractors, consultants and third party suppliers of various information and IT services such as networking and cloud computing. The standard is explicitly concerned with information security, meaning the security of all forms of information (e.g. computer data, documentation, knowledge and intellectual property) - not just IT/systems/network/cyber/digital security. It includes those, of course, but there's more to secure. Structure The standard lays out a ‘reference set’ of 93* generic information security controls with guidance, categorised into 4 main clauses or ‘themes’: 5: Organisational controls - a large and misleadingly-named catch-all group of 37* controls that don’t fit neatly into the following themes; 6: People controls - 8* controls involving or relating to people e.g. individuals’ behaviors, activities, roles and responsibilities, terms and conditions of employment etc .; 7: Physical controls - 14* tangible controls to secure tangible information assets; 8: Technological controls - 34* controls involving or relating to technologies, IT in particular. The 93* controls are each tagged with one or more values for each of 5 attributes so they can be grouped, selected or filtered in other ways too. The attributes and attribute values are: Control type : preventive, detective and/or corrective - relating to stages of incidents at which the controls act; Information security properties : confidentiality, integrity and/or availability - which of these information characteristics they protect; Cybersecurity concepts : identify, protect, detect, respond and/or recover - a more detailed breakdown of the incident timeline; Operational capabilities : governance, asset management, information protection, human resource security, physical security, system and network security, application security, secure configuration, identity and access management, threat and vulnerability management, continuity, supplier relationships securit, legal and compliance, information security event management, and information security assurance - reflecting the structure used in the previous edition of this standard; Security domains : governance and ecosystem, protection, defence and resilience - another way to classify controls. The control attribute tagging reflects these complexities: A given control may have several worthwhile applications (e.g. backups help protect against malware, hacks, bugs, accidents, mechanical breakdowns, fires etc. , and can include deputies and multi-skilled replacements for critical people, and alternative suppliers/sources of necessary information services, as well as data backups); An unacceptable risk typically requires several controls (e.g. malware can be mitigated using backups, awareness, antivirus, network access controls plus IDS/IPS, authentication, patching, testing, system integrity controls etc ., while avoiding infection can be a powerful approach if bolstered with controls such as policies and procedures, blacklisting etc .); Many of the ‘controls’ identified in the standard are not atomic, being composed of several smaller elements or pieces (e.g. backups involve strategies, policies and procedures, software, hardware, testing, incident recovery, physical protection of backup media etc. ). Some of the themes and attributes are arbitrarily assigned: for example, a commercial card access lock on a building entrance may fall into any, arguably all four of the themes listed above, but if it and other such controls were covered several times, the standard would become unwieldy. More likely, it would be categorised as - primarily - a physical control, possibly with references to other elements. Organisations can usefully define and use their own attributes as well. ISO/IEC 27028 will soon provide guidance on that. * Note: there are 21 fewer control clauses in the third edition than the second despite adding 11 new ones since several second edition control clauses were updated or merged. Each clause is in fact comprised of or incorporates numerous ‘atomic’ controls at a more detailed level of analysis. ISO/IEC 27002 notes or implies hundreds of detailed information security controls , in fact, way more than the nominal and often-stated total of “93”. Status The first edition was published in 2005 . The second edition was published in 2013 . The completely restructured and updated third edition was published in 2022 . A P reliminary W ork I tem will explore the need for a revision of ISO/IEC 27002, assessing the relevance and applicability of the current set of controls and supporting guidance and perhaps new. The intent is to reflect changes "in organizational practices, business, operations, technology and cyber-risks". The committee is also considering offering guidance on information security controls tailored for small organisations. A PWI will clarify the scope and purpose of such an SME infosec guideline, if indeed it gets enough support. Commentary In my considered opinion, one of the most distinctive, innovative and valuable features of the original Shell policy manual, the UK DTI Code of Practice/DISC standard PD003 and British Standard BS 7799 was that they explicitly addressed information security, recommending approaches and controls to secure information in any form - not just computer data, systems, apps, networks and technologies. The focus was clearly on protecting the intangible, vulnerable and valuable information content. Over the decades since ISO/IEC adopted it as an international standard, it has gradually evolved into a tech-centric IT, ICT or cyber-security standard. The third edition of ‘27002 continues along the same trajectory. The third edition misses numerous opportunities to encourage users to consider their “information risks” in order to determine whether various controls are even needed to avoid or mitigate the risks, and if so what controls are appropriate, taking account of their effectiveness, costs, value, reliability etc . It is as if the controls laid out in the standard are not merely good practices worth considering under various circumstances, but required or mandatory to the extent that not implementing them might perhaps be considered inept, unprofessional or bad practice. There is a subtle presumption that most if not all the controls should be employed by all organisations, regardless of the diversity of organisations in scope and their differing information risks. This is misleading, and has remained an issue for several years. I miss the ‘control objectives ’ from BS 7799: these succinctly explained what the controls were expected to achieve, giving them a business-related purpose that was readily interpreted in the particular context of an individual organisation. If management accepted that an objective was valid, the controls were worth considering not in the sense of being obligatory or even recommended, so much as examples of the kinds of things that could be put in place to achieve the objective. In the third edition, the risk-based control objectives have become watered-down and often self-serving ‘purposes’, with little to no explicit reference to the organisation’s information risks that the suggested controls are supposed to mitigate - a retrograde step as far as I’m concerned ... potentially presenting an opportunity to fill in the gaps (watch this space!). However, some experts complained of ‘challenging conversations’ between auditors and management: I suspect the underlying issue there was a failure to understand the true nature of information risk and risk treatment options. While the restructured third edition is readable and usable on paper, the tagging and cross-linking strongly of controls favours database applications (even something as simple as Excel) allowing users to filter or select and sort the controls by whatever criteria or questions they pose - for instance, “Which physical security controls are relevant to privacy?” or “What preventive controls do not involve technology?”. Given a suitable database application, the sequence is almost irrelevant compared to the categorisation, tagging and description of the controls. It will be interesting to see how this turns out. I am dismayed that the standard has been infected with the “cyber” virus, begging questions about definition and interpretation. Some contributors wanted the standard to cover both information security and cybersecurity controls, implying that they consider those to be distinct domains, while others first want to understand the differences before classifying controls ... and I must say I‘m in the second group. What is the true meaning and scope of “cybersecurity”, in fact ? Similarly, the committee hoped to resolve confusion over the meaning of “policy” in the second edition by distinguishing three variants or hierarchical levels in the third : “Information security policy ” refers to the overall, high-level corporate policy at the peak of the classical policy pyramid, approved by ‘top management’. ‘Strategy’ might have been a better term for this, at the risk of creating yet more confusion, but the ISO management systems standard boilerplate requires 'policy', so 'policy' (singular) it is; “Topic-specific policy ” refers to mid-level policies e.g. topic-specific policies on access control and clear desk and clear screen” (the latter sounds, to me, more like a rule than a mid-level policy ... and indeed, as expressed by the project team, the topic-specific policy concept includes guidelines and rules, making this layer a blend, transition or link between the upper and lower levels). These are aligned with and support the high level policy, approved by ‘the appropriate management level’, and [within reason] may be adapted/interpreted locally by departments, business units etc . where their specific contexts (information risks, security requirements, business situations, locations etc .) differ from the overall corporate context; “Rule ” is the lowest, most detailed/specific level, defined as an “accepted principle or instruction that states the organisation’s expectations on what should be done, what is allowed or not allowed” (I’m not sure an organisation, per se , can ‘expect’ anything, or should have expectations on rather than of something: in a corporate context, rules are generally imposed by management on behalf of the organisation and its stakeholders ... but this definition was a bone of contention within SC 27 so a compromise is needed). Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27556 ISO/IEC 27556:2022 — Information security, cybersecurity and privacy protection — User-centric privacy preferences management framework (first edition) Up Abstract ISO/IEC 27556 "provides a user-centric framework for handling personally identifiable information (PII), based on privacy preferences.” [Source: ISO/IEC 27556:2022] Introduction The standard lays out a “user-centric framework” (an architecture) to handle personal information in a controlled manner in accordance with the privacy-by-design and other requirements of applicable privacy laws and regulations. The standard outlines a mechanism for organisations handling personal data to comply with data subjects’ privacy requirements, even as those organisations share and collaborate on processing the data. Scope The standard describes a generic high-level system architecture without specifying the content and format of privacy preference information. The architecture, in turn, informs the design and implementation of IT systems handling personal information and communicating it between organisations, while managing the privacy preferences of data subjects (known as ‘PII Principals’ in the standard i.e. the people whose personal information is being handled). The standard expands upon ISO/IEC 29100’s “Privacy framework ”. Structure Main clauses: 5: User-centric framework for handling PII 6: Requirements and recommendations for the P rivacy P reference M anager (defined as “component providing a capability allowing PII principals to express privacy preferences and a capability to monitor PII processing according to these privacy preferences” - normally an IT system component, not a person) 7: Further considerations for the PPM in a P rivacy I nformation M anagement S ystem Annex A: Use cases of PII handling based on privacy preferences Annex B: Identifying an actor serving as a component for each example service Annex C: Guidance on configuration of privacy preferences management Annex D: Supporting the design of a privacy preference management Status The current first edition was published in 2022 . Commentary I appreciate the intent to standardise the handling and management of users’ privacy consents, perhaps allowing the preferences to be shared among systems. However, given strong commercial incentives for social media and related systems and companies to exploit every scrap of personal information they can obtain, it may take even stronger pressure from regulators and legislators on behalf of private individuals to see this widely adopted in practice. So, watch this space. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO 27799 ISO 27799:2025 — Health informatics — Information security controls in health using ISO/IEC 27002 (third edition) Up Abstract ISO 27799:2025 "contains a set of information security controls for health organizations. It considers all the controls in ISO/IEC 27002:2022 and, in some cases, supplements the controls or provides guidance on their application in health. There are also some additional controls specific to health which are not derived from any in ISO/IEC 27002:2022 ” [Source: ISO 27799:2025 ] Introduction This standard offers guidance on information security controls applicable to the health industry and medical-related organisations of various kinds - hospitals, labs, surgeries, medical insurers, medical device suppliers etc. Information security controls are appropriate to mitigate unacceptable risks to the confidentiality, integrity and availability of: Personal information, including private health information and safety-related time-sensitive information; Health-related information provided by or released to third parties such as lab test results, medical histories/records and research studies; Data processed by medical devices such as electronic heart monitors, pacemakers and various scanners. Healthcare companies also face risks associated with non-health commercial information in any business, such as the information used for financial, personnel and commercial management. Furthermore, they are required to comply with various laws, regulations, standards and codes, some of which relate to information security, privacy, safety, essential infrastructure services etc . Although not explicitly excluded from the scope, such areas are not the focus of ISO 27799. Scope The standard helps medical/healthcare-related organisations, plus professionals working for them on information risk, security, privacy and related matters (including assurance), interpret and apply information security controls from ISO/IEC 27002 (with some extensions) plus ISO 81001-1 Health software and health IT systems safety, effectiveness and security — Part 1: Principles and concepts and other cited references. Structure Main clauses: 4 - General 5 - Organizational controls 6 - People controls 7 - Physical controls 8 - Technological controls Annex A - Information security controls for health reference (checklist?) Annex B - Correspondence between the second and third editions of ISO 27799 Annex C - Information security in health organizations (overview?) Annex D - Example infosec and privacy requirements (risks?) mapped to controls Status The first edition was published in 2008 . It was developed by ISO/TC215 Health informatics , not ISO/IEC JTC 1/SC 27, based on ISO/IEC 17799:2005. The second edition, updated to reflect ISO/IEC 27001:2013 and ISO/IEC 27002:2013 , was published in 2016 . The current third edition was published in 2025 . It was updated for ISO/IEC 27002:2022 , and is now focused on the information security controls, omitting the ISO/IEC 27001 I nformation S ecurity M anagement S ystem aspects from the previous edition. Commentary Unfortunately I don't have access to the content of this standard so have nothing substantial to add beyond the general information provided publically on ISO.org . However, speaking as a former phamaceuticals infosec pro, I wonder how much of the medical supply chain is in-scope e.g. are pharmaceuticals suppliers covered, given that they accumulate, generate, process, use, manage and disclose often sensitive commercial and technical information on drugs including clinical trials, extremely valuable intellectual property and, of course, safety-critical information about drug use and efficacy? Pharmacies and pharmacists? And as a former microbial geneticist, what about medical-related research on, say, infectious diseases such as COVID? What about public health and statistical information on disease outbreaks, 'cancer clusters', obesity etc., or the effectiveness and side effects of various treatments (not just conventional, approved drugs - 'alternative therapies' such as homeopathy, herbalism and self-administed narcotics spring to mind here)? Forensic pathology? Councelling? Rehabilitation? Smart prosthetics ? Gyms and sports coaches? And then what about animal health e.g . veterinarians? Non-human animals' privacy may be of no concern to humans but again there are commercial, healthcare and safety aspects. Bottom line: this standard may have some application and value way beyond its stated scope. Maybe not. If you are involved in any way with the intersection of health and information, I suggest taking a good look at this standard. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27042 ISO/IEC 27042:2015 — Information technology — Security techniques — Guidelines for the analysis and interpretation of digital evidence (first edition) Up Abstract “ISO/IEC 27042:2015 provides guidance on the analysis and interpretation of digital evidence in a manner which addresses issues of continuity, validity, reproducibility, and repeatability. ...” [Source: ISO/IEC 27042:2015] Introduction The fundamental purpose of the ISO27k digital forensics standards is to promote good practice methods and processes for forensic capture and investigation of digital evidence. While individual investigators, organisations and jurisdictions may well retain certain methods, processes and controls, it is hoped that standardisation will (eventually) lead to the adoption of similar if not identical approaches internationally, making it easier to compare, combine and contrast the results of such investigations even when performed by different people or organisations and potentially across different jurisdictions. Scope As the title suggests, this standard offers guidance on the process of analysing and interpreting digital evidence, which is of course just a part of the forensics process. It lays out a generic framework encapsulating good practices in this area. Aside from the standard evidential controls (maintaining the chain of custody, scrupulous documentation etc .), the standard emphasizes the integrity of the analytical and interpretational processes such that different investigators working on the same digital evidence ought to come up with essentially the same results - or at least any differences should be traceable to choices they made along the way. Given the volume, variety and complexity of digital evidence these days, that’s quite a challenge, hence the drive for standardization, good practices, common terminology and sound, rational approaches. The standard touches on issues such as the selection and use of forensic tools, plus proficiency and competency of the investigators. Structure Main clauses: 5: Investigation 6: Analysis 7: Analytical models 8: Interpretation 9: Reporting 10: Competence 11: Proficiency Annex A: Examples of Competence and Proficiency Specifications Status The current first edition was published in 2015 and confirmed unchanged in 2021. Commentary I am puzzled why SC 27 publishes and maintains several distinct forensics standards covering different aspects of forensics, when they are in reality complementary parts of the same process: ISO/IEC 27037 concerns the initial capturing of digital evidence. ISO/IEC 27041 offers guidance on the assurance aspects of digital forensics e.g. ensuring that the appropriate methods and tools are used properly. This standard covers what happens after digital evidence has been collected i.e. its analysis and interpretation. ISO/IEC 27043 covers the broader incident investigation activities, within which forensics usually occur. ISO/IEC 27050 (in 4 parts) concerns electronic discovery ... which is pretty much what the other standards cover. British Standard BS 10008 “Evidential weight and legal admissibility of electronically stored information (ESI), Specification.” may also be of interest. I understand the decision not to integrate this content into ISO/IEC 27037 but a multi-part standard would make more sense to me personally, with an overview part 1 explaining how the jigsaw pieces fit together. The editors rejected such a proposal, claiming that it was considered and rejected when the forensics standards development projects were launched. So, sorry valued customers, it seems you will have to buy and correlate multiple standards if you choose to adopt the complete ISO27k forensics suite. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC TR 27024 ISO/IEC TR 27024 — Technical Report — Information security, cybersecurity and privacy protection — Information on government and regulatory use of information security standards [DRAFT] Up Abstract ISO/IEC TR 27024 "provides a list of national regulations that reference ISO/IEC 27001 as a requirement.” [Source: ISO/IEC JTC 1/SC 27 Committee Doc 11, May 2025] Introduction This T echnical R eport is meant to help determine which of the ISO27k standards (or rather "information security management system standards developed by ISO/IEC JTC 1/SC 27") are recommended or required for national compliance reasons (without being construed as legal advice), and to facilitate or encourage global harmonisation of the laws, regulations etc. in the field of information security management. Scope The T echnical R eport identifies laws, regulations and guidelines from a selection of countries that refer to ISO27k standards such as ISO/IEC 27001, 27002 and 27005, and explicitly concern: Information security Privacy/data protection Digitalisation and electronic archiving. Structure The main clause covers 20 countries (some of which are European) plus the European Union. Each one has a table: Citing reference document/s (mostly laws and regulations); Identifying the organisations that own/issued the reference documents (e.g. ministries); Stating which ISO27k standards are recommended or required; Plus comments explaining and expanding on the above. Status A T echnical R eport was prepared from ISO/IEC JTC 1/SC 27 S tanding D ocument 7 - an internal committee reference document. It is now at D raft T echnical R eport stage, having been submitted to the ISO secretariat for publication. It might even surface this year. Commentary Notably missing from the coverage list are the United States, China, Russia and all of Africa - in other words, this standard covers roughly a quarter of the globe. It's a start, I guess. Depending on how one interprets part 2 of the ISO Directives , this standard may be stillborn: "A document does not in itself impose any obligation upon anyone to follow it. However, an obligation can be imposed, for example, by legislation or by a contract which makes reference to the document. A document shall not include contractual requirements (e.g. concerning claims, guarantees, covering of expenses), or legal or statutory requirements." [clause 4] The standard progressed rapidly to D raft T echnical R eport stage and was planned for release way back in 2023. Patently, however, compiling and checking details on relevant laws and regs around the globe, along with editorial changes required by ISO, substantially delayed release. Under ISO/IEC's revised DIrectives and firm deadlines, this project would have been cancelled long ago. If this had remained a S tanding D ocument without the formalities of becoming a standard, it would have been easier, quicker and cheaper to update it as the referenced standards, laws and regs change, with the bonus of being freely available to those who need the information ... but in its infinite wisdom, the committee decided to publish (and consequently maintain) it as a T echnical R eport. The TR does not (explicitly) cover numerous other areas of law less directly/obviously concerned with the confidentiality, integrity or availability of information such as: Classified information and official secrets Contracts Cryptography Digital signatures Defence Family law Financial data integrity, reporting and accounting Forensics Fraud Governance Health and safety Intellectual property Medical records Misinformation Product quality/fitness for purpose Taxation ... nor more besides. Taking a broad perspective, there are clearly loads of laws and regs that have some relevance to the c onfidentiality, i ntegrity or a vailability of information. In the extreme, virtually every law involves forensic evidence with strong cia implications. Laws and regs relating to human safety are important to protect the valuable knowledge and competencies in our heads, while those relating to mental health affect our information processing capabilities. Laws and regs on tax and financial reporting and corporate governance all have information security implications. The standard is unlikely even to mention these, reflecting its arbitrary nature. This standards project faces a similar conundrum to ISO/IEC 27002 . It would be wonderful if the standard was truly comprehensive and up-to-date and could be relied upon as such, but ultimately that is infeasible. There is a risk that naive users may rely on the standard as definitive without seeking competent legal advice or researching (e.g. Googling) which laws and regs are in fact applicable - hopefully not you though, having read this cautionary note! Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27403 ISO/IEC 27403:2024 — Cybersecurity — IoT security and privacy — Guidelines for IoT-domotics (first edition) Up Abstract ISO/IEC 27403 "provides guidelines to analyse security and privacy risks and identifies controls that can be implemented in Internet of Things (IoT)-domotics systems.” [Source: ISO/IEC 27403:2024] Introduction “Domotics” was originally known as home automation or “smart homes”, where domicile or home is described as “The private, hence highly customizable area where someone lives, alone or with guests or cohabitants” that “includes dedicated infrastructure aimed to support those individuals, such as healthcare and wellness systems, building control systems, smart metering and systems for entertainment or gaming.” Setting the standard for information security and privacy of IoT things intended for home use is quite a challenge given the variety of things , homes and living arrangements, security and privacy issues and controls. Rapid innovation and change in this area further complicates matters. Scope This cybersecurity standard is aimed squarely at the designers, manufacturers and security/privacy assessors of IoT domotics rather than the “users” (consumers/retail customers). It covers the information security and privacy aspects of device-device interactions (e.g. hubs and subsystems) as well as human-device plus device-sensors/actuators that physically interact with the home, and networking both within the home and beyond (e.g. via Internet gateways). Structure Main clauses: 5: Overview of the stakeholders (IoT device manufacturers, service providers, regulatory authorities and users), the lifecycles for IoT domotics developers, service providers and users, an architectural reference model, and an introduction to the ‘security’ (meaning cybersecurity) and privacy aspects. 6: Risk assessment guidelines covering cybersecurity and privacy risks (referring to eight other standards!). 7: ’Security’ and privacy controls. Annex A: Use cases - six examples of the principles in action. Annex B: ‘Security’ and privacy concerns of various stakeholders with differing perspectives. Annex C: Stakeholders’ security and privacy responsibilities. Annex D: ‘Security measures’ (cybersecurity and privacy controls) for various IoT domotics devices. Status The current first edition was published in 2024 . Commentary Whereas “IoT” is a common abbreviation, “domotics” is a neologism derived from domus (Latin for house) and robotics. Rather than simply recommending a bunch of controls, the standard describes typical information [security and privacy] risks relating to domotics, and recommend information security controls to mitigate them, making this a risk-based ISO27k standard. Sounds good in theory, although strictly speaking several of the ‘risks’ described in the draft are in fact weak or missing controls, not risks. Information risks provide the rationale, context or basis for the controls. Helping readers identify and consider the information risks should give them a better appreciation of what the information security controls are meant to achieve - the control objectives. The risks and the controls in the standard are examples to stimulate readers into considering the risks and control objectives in their particular contexts. Challenges (risks) in the home environment include: Limited information security awareness and competence by most people. IoT things are generally just black-boxes. Ad hoc assemblages of networked IT systems - including things worn/carried about the person (residents and visitors) and work things, not just things physically permanently installed about the home (e.g. smart heating controls, door locks and cat feeders). Things are not [always] designed for adequate security or privacy since other requirements (such as low price and ease of use) generally take precedence. Finite processing and storage capacities, plus limited user interfaces, hamper or constrain their security capabilities. Lack of processes for managing security and privacy systematically at home. Any such activities tend to be ad hoc /informal and reactive rather than proactive. Informality: the home is a relatively unstructured, unmanaged environment compared to the typical corporate situation. Few domotics users even consider designing a complete system, although certain aspects or subsystems may be intentionally designed or at least assembled for particular purposes (e.g . entertainment). Dynamics and diversity: people, devices and services plus the associated challenges and risks, are varied and changeable. The home is a fairly fluid environment. Limited ability to control who may be present in/near the home and hence may be interacting with IoT devices e.g. adult residents plus children, owners, visitors, installers, maintenance people, neighbours, intruders ... Physically securing things against accidental or malicious interaction (e.g. someone reading the label with the default password, hitting the reset button, damaging or stealing the device) is difficult. Limited ability to manage or control IoT device and service upstream supply chains, as well as the downstream installation, configuration, use, monitoring and maintenance of devices and services, with little if any coordination among the parties. Given their number, variety and significance, I believe conventional, structured and systematic information risk management is largely impracticable for domotics: there is way too much to do here! In accordance with the risk-based approach that underpins all the ISO27k standards, this standard prioritises some significant information risks, encouraging IoT device and service providers to play their parts - although even that is difficult since they are only providing parts of a complex and dynamic system. The bigger picture remains of concern. Up Up Up This page last updated: 19 August 2026