Back Up Next ISO/IEC TR 27016 ISO/IEC TR 27016:2014 — Information technology — Security techniques — Information security management — Organisational economics (first edition) Up Abstract “ISO/IEC TR 27016:2014 provides guidelines on how an organisation can make decisions to protect information and understand the economic consequences of these decisions in the context of competing requirements for resources. ISO/IEC TR 27016:2014 is applicable to all types and sizes of organisations and provides information to enable economic decisions in information security management by top management who have responsibility for information security decisions.” [Source: ISO/IEC TR 27016:2014] Introduction There are substantial economic, financial and resourcing aspects to the management of information risks and security controls. Scope The ISO catalogue says ISO/IEC TR 27016 “provides guidelines on how an organisation can make decisions to protect information and understand the economic consequences of these decisions in the context of competing requirements for resources.” Structure Main clauses: 6: Information security economic factors - investment aspects 7: Economic objectives - asset values 8: Balancing information security economics for I nformation S ecurity M anagement - cost-benefit analysis Annex A: Identifcation of stakeholders and objectives for setting values Annex B: Economic decisions and key cost decision factors Annex C: Economic models appropriate for information security Annex D: Business cases calculation examples Status The current first edition was published in 2014 as a T echnical R eport since this was deemed a developing field of study. Evidently the field has not developed significantly (and I guess the first edition did such a good job) since work on a second edition ground to a halt due to lack of inputs from committee members. Commentary Some generic parts of the text may be more appropriate in the ISO27k overview sections of ISO/IEC 27000 . Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27551 ISO/IEC 27551:2021 — Information security, cybersecurity and privacy protection — Requirements for attribute-based unlinkable entity authentication (first edition) Up Abstract ISO/IEC 27551 "provides a framework and establishes requirements for attribute-based unlinkable entity authentication (ABUEA).” [Source: ISO/IEC 27551:2021] Introduction A ttribute-B ased U nlinkable E ntity A uthentication is a mechanism for authenticating unfamiliar parties through the services of a mutually-trusted third party, whilst maintaining privacy of the authenticated. ‘Unlinkable’ refers to the need to be able to handle and process personal information anonymously, in a way that precludes being able to identify the original data subjects from the information being communicated and processed. Scope The standard describes a framework and requirements for ABUEA - a way of avoiding the privacy leakage that can occur when (for instance) we use Internet sites, providing different information to each one or on each occasion, giving the possibility of linking our disparate disclosures back to us, specifically. Structure Main clauses: 5: General objectives of attribute-based entity authentication 6: Properties of attribute-based entity authentication protocols 7: Unlinkability properties of attribute-based entity authentication protocols 8: Attributes 9: Requirements for level N attribute-based unlinkable entity authentication Annex A: Formal definitions for security and unlinkability notions Annex B: Examples of attribute-based entity authentication protocols Annex C: ABUEA with OpenID & FIDO Annex D: Use cases for attribute-based unlinkable entity authentication Status The current first edition was published in 2021 . Commentary It would be a challenge to rewrite this standard in accordance with ISO’s version of plain English , given such a deep dive into the technology. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27034-5 ISO/IEC 27034-5:2017 — Information technology — Security techniques — Application security — Part 5: Protocols and application security controls data structure (first edition) Up Abstract ISO/IEC 27034 part 5 "outlines and explains the minimal set of essential attributes of Application Security Contorls (ASCs) and details the activities and roles of the Application Security Life Cycle Reference Model (ASLCRM).” Source: ISO/IEC 27034-5:2017] Introduction The ability to share and reuse properly specified, developed and assured application security functions is a powerful, efficient and effective approach to software development. Scope Part 5 facilitates the establishment of libraries of reusable application security functions that may be shared both within and between organisations. Structure Main clauses: 5: A pplication S ecurity C ontrol structure 6: Application Security Life Cycle Reference Model 7: ASC package Status The current first edition of part 5 was published in 2017 and confirmed in 2023. Commentary Part 5 facilitates the implementation of the ISO/IEC 27034 application security framework and the communication and exchange of ASCs by defining a formal structure for ASCs and certain other components of the framework. It defines the A pplication S ecurity C ontrols data structure, providing requirements, descriptions, graphical representations and XML schema for the data model. The XML schema, based on ISO 15000-1 “Electronic business eXtensible Markup Language ebXML ”, is designated as the standard interchange format for ASCs. It lays out a minimal set of essential attributes of ASCs and the Application Security Life Cycle Reference Model. Note : the accompanying standard ISO/IEC TS 27034-5-1:2018 — Information technology — Security techniques — Application security — Part 5-1: Protocols and application security controls data structure, XML schemas "defines XML Schemas that implement the minimal set of information requirements and essential attributes of ASCs and the activities and roles of the Application Security Life Cycle Reference Model (ASLCRM) from ISO/IEC 27034-5.” [Source: ISO/IEC 27034-5-1:2018] Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC TR 27024 ISO/IEC TR 27024 — Technical Report — Information security, cybersecurity and privacy protection — Information on government and regulatory use of information security standards [DRAFT] Up Abstract ISO/IEC TR 27024 "provides a list of national regulations that reference ISO/IEC 27001 as a requirement.” [Source: ISO/IEC JTC 1/SC 27 Committee Doc 11, May 2025] Introduction This T echnical R eport is meant to help determine which of the ISO27k standards (or rather "information security management system standards developed by ISO/IEC JTC 1/SC 27") are recommended or required for national compliance reasons (without being construed as legal advice), and to facilitate or encourage global harmonisation of the laws, regulations etc. in the field of information security management. Scope The T echnical R eport identifies laws, regulations and guidelines from a selection of countries that refer to ISO27k standards such as ISO/IEC 27001, 27002 and 27005, and explicitly concern: Information security Privacy/data protection Digitalisation and electronic archiving. Structure The main clause covers 20 countries (some of which are European) plus the European Union. Each one has a table: Citing reference document/s (mostly laws and regulations); Identifying the organisations that own/issued the reference documents (e.g. ministries); Stating which ISO27k standards are recommended or required; Plus comments explaining and expanding on the above. Status A T echnical R eport was prepared from ISO/IEC JTC 1/SC 27 S tanding D ocument 7 - an internal committee reference document. It is now at D raft T echnical R eport stage, having been submitted to the ISO secretariat for publication. It might even surface this year. Commentary Notably missing from the coverage list are the United States, China, Russia and all of Africa - in other words, this standard covers roughly a quarter of the globe. It's a start, I guess. Depending on how one interprets part 2 of the ISO Directives , this standard may be stillborn: "A document does not in itself impose any obligation upon anyone to follow it. However, an obligation can be imposed, for example, by legislation or by a contract which makes reference to the document. A document shall not include contractual requirements (e.g. concerning claims, guarantees, covering of expenses), or legal or statutory requirements." [clause 4] The standard progressed rapidly to D raft T echnical R eport stage and was planned for release way back in 2023. Patently, however, compiling and checking details on relevant laws and regs around the globe, along with editorial changes required by ISO, substantially delayed release. Under ISO/IEC's revised DIrectives and firm deadlines, this project would have been cancelled long ago. If this had remained a S tanding D ocument without the formalities of becoming a standard, it would have been easier, quicker and cheaper to update it as the referenced standards, laws and regs change, with the bonus of being freely available to those who need the information ... but in its infinite wisdom, the committee decided to publish (and consequently maintain) it as a T echnical R eport. The TR does not (explicitly) cover numerous other areas of law less directly/obviously concerned with the confidentiality, integrity or availability of information such as: Classified information and official secrets Contracts Cryptography Digital signatures Defence Family law Financial data integrity, reporting and accounting Forensics Fraud Governance Health and safety Intellectual property Medical records Misinformation Product quality/fitness for purpose Taxation ... nor more besides. Taking a broad perspective, there are clearly loads of laws and regs that have some relevance to the c onfidentiality, i ntegrity or a vailability of information. In the extreme, virtually every law involves forensic evidence with strong cia implications. Laws and regs relating to human safety are important to protect the valuable knowledge and competencies in our heads, while those relating to mental health affect our information processing capabilities. Laws and regs on tax and financial reporting and corporate governance all have information security implications. The standard is unlikely even to mention these, reflecting its arbitrary nature. This standards project faces a similar conundrum to ISO/IEC 27002 . It would be wonderful if the standard was truly comprehensive and up-to-date and could be relied upon as such, but ultimately that is infeasible. There is a risk that naive users may rely on the standard as definitive without seeking competent legal advice or researching (e.g. Googling) which laws and regs are in fact applicable - hopefully not you though, having read this cautionary note! Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27403 ISO/IEC 27403:2024 — Cybersecurity — IoT security and privacy — Guidelines for IoT-domotics (first edition) Up Abstract ISO/IEC 27403 "provides guidelines to analyse security and privacy risks and identifies controls that can be implemented in Internet of Things (IoT)-domotics systems.” [Source: ISO/IEC 27403:2024] Introduction “Domotics” was originally known as home automation or “smart homes”, where domicile or home is described as “The private, hence highly customizable area where someone lives, alone or with guests or cohabitants” that “includes dedicated infrastructure aimed to support those individuals, such as healthcare and wellness systems, building control systems, smart metering and systems for entertainment or gaming.” Setting the standard for information security and privacy of IoT things intended for home use is quite a challenge given the variety of things , homes and living arrangements, security and privacy issues and controls. Rapid innovation and change in this area further complicates matters. Scope This cybersecurity standard is aimed squarely at the designers, manufacturers and security/privacy assessors of IoT domotics rather than the “users” (consumers/retail customers). It covers the information security and privacy aspects of device-device interactions (e.g. hubs and subsystems) as well as human-device plus device-sensors/actuators that physically interact with the home, and networking both within the home and beyond (e.g. via Internet gateways). Structure Main clauses: 5: Overview of the stakeholders (IoT device manufacturers, service providers, regulatory authorities and users), the lifecycles for IoT domotics developers, service providers and users, an architectural reference model, and an introduction to the ‘security’ (meaning cybersecurity) and privacy aspects. 6: Risk assessment guidelines covering cybersecurity and privacy risks (referring to eight other standards!). 7: ’Security’ and privacy controls. Annex A: Use cases - six examples of the principles in action. Annex B: ‘Security’ and privacy concerns of various stakeholders with differing perspectives. Annex C: Stakeholders’ security and privacy responsibilities. Annex D: ‘Security measures’ (cybersecurity and privacy controls) for various IoT domotics devices. Status The current first edition was published in 2024 . Commentary Whereas “IoT” is a common abbreviation, “domotics” is a neologism derived from domus (Latin for house) and robotics. Rather than simply recommending a bunch of controls, the standard describes typical information [security and privacy] risks relating to domotics, and recommend information security controls to mitigate them, making this a risk-based ISO27k standard. Sounds good in theory, although strictly speaking several of the ‘risks’ described in the draft are in fact weak or missing controls, not risks. Information risks provide the rationale, context or basis for the controls. Helping readers identify and consider the information risks should give them a better appreciation of what the information security controls are meant to achieve - the control objectives. The risks and the controls in the standard are examples to stimulate readers into considering the risks and control objectives in their particular contexts. Challenges (risks) in the home environment include: Limited information security awareness and competence by most people. IoT things are generally just black-boxes. Ad hoc assemblages of networked IT systems - including things worn/carried about the person (residents and visitors) and work things, not just things physically permanently installed about the home (e.g. smart heating controls, door locks and cat feeders). Things are not [always] designed for adequate security or privacy since other requirements (such as low price and ease of use) generally take precedence. Finite processing and storage capacities, plus limited user interfaces, hamper or constrain their security capabilities. Lack of processes for managing security and privacy systematically at home. Any such activities tend to be ad hoc /informal and reactive rather than proactive. Informality: the home is a relatively unstructured, unmanaged environment compared to the typical corporate situation. Few domotics users even consider designing a complete system, although certain aspects or subsystems may be intentionally designed or at least assembled for particular purposes (e.g . entertainment). Dynamics and diversity: people, devices and services plus the associated challenges and risks, are varied and changeable. The home is a fairly fluid environment. Limited ability to control who may be present in/near the home and hence may be interacting with IoT devices e.g. adult residents plus children, owners, visitors, installers, maintenance people, neighbours, intruders ... Physically securing things against accidental or malicious interaction (e.g. someone reading the label with the default password, hitting the reset button, damaging or stealing the device) is difficult. Limited ability to manage or control IoT device and service upstream supply chains, as well as the downstream installation, configuration, use, monitoring and maintenance of devices and services, with little if any coordination among the parties. Given their number, variety and significance, I believe conventional, structured and systematic information risk management is largely impracticable for domotics: there is way too much to do here! In accordance with the risk-based approach that underpins all the ISO27k standards, this standard prioritises some significant information risks, encouraging IoT device and service providers to play their parts - although even that is difficult since they are only providing parts of a complex and dynamic system. The bigger picture remains of concern. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27036-2 ISO/IEC 27036-2:2022 — Cybersecurity — Supplier relationships — Part 2: Requirements (second edition) Up Abstract ISO/IEC 27036 part 2 “specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships. These requirements cover any procurement and supply of products and services, such as manufacturing or assembly, business process procurement, software and hardware components, knowledge process procurement, build-operate-transfer and cloud computing services ... To meet the requirements, it is expected that an organization has internally implemented a number of foundational processes or is actively planning to do so [such as] business management, risk management, operational and human resources management, and information security.” [Source: ISO/IEC 27036-2:2022 ] Introduction The controls recommended in part 2 cover various aspects of governance and business management (e.g. operations, HR management, IT management, relationship management, metrics) as well as information risk management (e.g. information risk analysis and treatment, security controls specification, security architecture/design, strategy). Scope Part 2 specifies fundamental information security requirements pertaining to business relationships between suppliers and acquirers of various products (goods and services). It helps them reach a common understanding of the associated information risks, and treat them accordingly to their mutual satisfaction. The introduction explicitly states that part 2 is not for certification despite having “Requirements” in the title and “shall” in the content [these are normally reserved words in ISO-land]. Structure Main clauses: 6: Information security in supplier relationship management 7: Information security in a supplier relationship instance Annex A: Correspondence between ISO/IEC/IEEE 15288 and this document Annex B: Correspondence between ISO/IEC 27002 controls and this document Annex C: Objectives from Clauses 6 and 7 Status The first edition of part 2 was published in 2014 . Following changes in ISO/IEC 15288 , the current second edition was published in 2022 . Commentary Although this is not intended to be a certifiable standard with formally-specified requirements that are mandatory for certification, wording along the lines of “The following minimum activities shall be executed by the acquirer to meet the objective defined at [a specific clause] ” leaves little latitude for organisations to interpret, adapt and apply the standard according to their particular business situations and needs, despite an explanatory note: ”The user of [ISO/IEC 27036-2] needs to correctly interpret each of the forms of the expression of provisions (e.g. “shall”, “shall not”, should” and “should not”) as being either requirements to be satisfied or recommendations where there is a certain freedom of choice.” It comes down to the business and legal arrangements in place between supplier and acquirer as to how much ‘freedom of choice’ there is in interpreting and applying this standard. In the absence of explicit, perfectly worded, unambiguous and binding contractual clauses, lawyers smile wryly and rub their hands together, their cartoon eyes rolling like an old fashioned cash register ... Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27566-1 ISO/IEC 27566-1:2025 — Information security, cybersecurity and privacy protection — Age assurance systems — Part 1: Framework [First edition] Up Abstract ISO/IEC 27566 part 1 "establishes a framework for age assurance systems and describes their core characteristics, including privacy and security, for enabling age-related eligibility decisions." [Source: ISO/IEC 27566-1:2025 ] Introduction This standard lays out the core principles and a framework for determining someone’s age or age-range independently of their identity, for use in age-related eligibility decisions. Scope Age assurance framework Structure Main clauses: 4: Overview of age assurance 5: Functional characteristics - functional requirements 6: Performance characteristics - assurance and metrics 7: Privacy characteristics - privacy requirements 8: Security characteristics - cybersecurity requirements 9: Acceptability characteristics - nondiscrimination requirements 10: Practice statements - documenting the arrangements Status The standard development project set out in 2022. The current first edition was published in 2025 . Commentary Whereas self-assertion (e.g. “Click here if you are an adult”) is a simple and commonplace but clearly pathetically weak control, the standard aims to standardise and where necessary strengthen the process of determining someone’s age or age-range without (necessarily) requiring them to disclose their identity and thereby risk compromising their privacy. The cunning grand plan is to develop and incorporate appropriate assurance controls systematically into the framework indicating confidence in the determined age or age-range, giving policy- and law-makers options when defining age-related criteria for various purposes. In situations where age is particularly important, additional confidence in the age determination is warranted, even if that implies completing a more involved and lengthy process of age verification, perhaps utilising a third party age-verification service or aggregating multiple age indicators (PII clustering?) taking account of any contraindications, inconsistencies or doubts. Conversely, if age verification is relatively unimportant, simpler, quicker, cruder approaches may suffice. Spoofing (e.g . where an older person pretends or claims to be, and completes the age-verification process on behalf of, a youngster, or a child simply presents a fake credential) is just one of the challenges relevant to users of this standard. There are also identities, credentials, tokens and age-verification subsystems and services, plus individual rights and freedoms to protect (such as privacy, of course, and inclusivity, prejudice and entitlement), in a framework that allows or encourages communication and collaboration between age-verifiers. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC TS 27568 ISO/IEC TS 27568 — Security and privacy of digital twins [DRAFT] Up Abstract ISO/IEC TS 27568 "provides a guidance for organizations to address security and privacy risks in digital twin systems. The guidance in this document helps organizations identify security and privacy risks throughout the digital twin systems lifecycles system lifecycle, and establishes mechanisms to evaluate the consequences of such risks and treat risks them. This document is applicable to all types and sizes of organizations, including public and private companies, government entities, academia, research institutions and not-for- profit organizations, that develop or use digital twin systems." Source: ISO.org page about the draft Introduction Digital twins are essentially digital analogues, representations or realistic models of real-world situations used for various purposes. Scope This T echnical S pecification is intended to address the security and privacy implications of digital twins, supporting other digital twinning standards as the field develops at pace. Structure ?? Status The standard development project launched in 2025. Publication as a T echnical S pecification is planned for 2028. It is currently at W orking D raft stage. Commentary [Nothing to say, yet. My head is empty. I have the thousand yard stare.] Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC TS 27022 ISO/IEC TS 27022:2021 — Information technology — Guidance on information security management system processes (first edition) Up Abstract ISO/IEC TS 27022 "defines a process reference model (PRM) for the domain of information security management, which is meeting the criteria defined in ISO/IEC 33004 for process reference models (see Annex A). It is intended to guide users of ISO/IEC 27001 to: incorporate the process approach as described by ISO/IEC 27000:2018, 4.3, within the ISMS; be aligned to all the work done within other standards of the ISO/IEC 27000 family from the perspective of the operation of ISMS processes; support users in the operation of an ISMS. [ISO/IEC TS 27022] is complementing the requirements-oriented perspective of ISO/IEC 27003 with an operational, process-oriented point of view.” [Source: ISO/IEC TS 27022:2021] Introduction The standard (a T echnical S pecification) “provides a process reference model (PRM) for information security management, which differentiates between ISMS processes and measures/controls initiated by them ... [and] describes the ISMS processes implied by ISO/IEC 27001.” The standard is based on a PhD thesis . Scope The standard lays out, in some detail, a P rocess R eference M odel comprising a generic suite of ISMS processes that organisations may wish to use as a basis for designing custom processes within their own ISMS. The standard “is intended to guide users of ISO/IEC 27001 to: incorporate the process approach as described by ISO/IEC 27000:2018 clause 4.3 within the ISMS be aligned to all the work done within other standards of the ISO/IEC 27000 family from the perspective of the operation of ISMS processes support users in the operation of an ISMS – the document will complement the requirements oriented perspective of ISO/IEC 27003 with an operational, process oriented point of view.” This advisory standard does not add or modify the ISMS requirements in ISO/IEC 27001 . Structure The ISMS processes described fall into 3 “categories” (types or groups) i.e. : Governance activities (confusingly titled ‘management processes’) - direction and oversight for the ISMS; Core operations e.g. information risk and security management, policy management, incident management, internal audits ...; and Support e.g. records management, communicating with interested parties about the ISMS, managing relationships with ISMS ‘customers’ ... The processes are each laid out in an Appendix, first as a table specifying: Process “category” denoting the type of process A brief description Objective/purposes Input[s] and Output[s] Activities/functions i.e. a few words for each of the main steps in the process Informative references. The table is followed by a flowchart summarising each process on one side or less. Status The current first edition was published in 2021 . An amendment updating references to ISO/IEC 27001:2022 and other ISO27k standards was in preparation in 2024 but the proposed revision of the standard was dropped due to lack of expert support. Commentary Mature organisations may already have processes for: Asset management; Audit management, both internal and external; Business continuity management (see ISO 22301: ISO/IEC 27001 is limited to continuity of information security operations during major incidents); Change management plus configuration management and version control; Continuous improvement and maturity management; Database [security] management; Exemption management (management-approved nonconformity with policies); Facilities management including power and other services for the computer room; Identity, access rights and user account management; Incident management including incident investigation and forensics; Information management in general; Information [security] risk management (partly covered by ISO/IEC 27005 ); Information security management (covered by ISO/IEC 27001 , 27002 , 27003 and others); IT! Internal audits and certification audits; Key management, plus the rest of cryptography; Log management, plus alarms and alerts; Metrics and management information management (partly covered by ISO/IEC 27004 ); Monitoring and oversight of the risk management and security arrangements; Patching, including emergency arrangements for urgent fixes; Performance and capacity management; Personnel/HR management including “onboarding” and “offboarding” (nasty neologisms!); Preventive and corrective actions; Quality management, especially quality assurance; Service management [organisations that are heavily process-oriented may be using ITIL/ISO 20000, in which case ISO/IEC 27013 is applicable]; Supplier/vendor relationship management, including telecomms, Internet and cloud services, outsourced development, contract security guards, maintenance/servicing, professional services (consulting, contracting, accounting, tax advising) etc. ; System and network [security] management; System/software development and testing ... ... and more. Providing generally-applicable advice without imposing further constraints is challenging. The processes need to be described without losing the flexibility to cater for myriad differences between organisations. In particular, the processes need to be valuable (cost-effective) in practice to justify their existence, for instance by: Removing unnecessary bureaucracy, rationalising and justifying whatever remains; Facilitating or encouraging process automation and innovation where applicable; Facilitating or encouraging use of existing processes, adapting them where necessary; Perhaps re-using effective ISMS processes elsewhere in the organisation; Managing the processes themselves e.g. management processes for monitoring, reviewing, evaluating and maintaining the ISMS processes, responding to changes, identifying and exploiting improvement opportunities etc . It would be unfortunate if ISMS processes were perceived as distinct from normal operations, rather than being integral to the organisation’s routine activities. The process for managing an information security or privacy incident, for example, is essentially the same as that for managing any other incident, hence it is generally unnecessary to create an alternative incident management process if the existing one (perhaps with a few tweaks) is effective. Up Up Up This page last updated: 19 August 2026