Search Results

Back Up Next ISO/IEC 27706 ISO/IEC 27706:2025 — Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of privacy information management systems (first edition) Up Abstract ISO/IEC 27706 "specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701, in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in [ISO/IEC 27706] are demonstrated in terms of competence and reliability by bodies providing PIMS certification. The guidance contained in [ISO/IEC 27706] provides additional interpretation of these requirements for bodies providing PIMS certification. NOTE [ISO/IEC 27706] can be used as a criteria document for accreditation, peer assessment or other audit processes.” [Source: ISO/IEC 27706:2025 ] Introduction This accreditation standard guides certification bodies on the formal processes they must follow when auditing clients’ P rivacy I nformation M anagement S ystems against ISO/IEC 27701 in order to certify or register them. The accreditation processes laid out in the standard give assurance that ISO/IEC 27701 certificates issued by accredited organisations are valid, comparable, meaningful and hence commercially valuable. Scope This standard is primarily aimed at PIMS certification auditors ("conformity assessors"). It may also be used for peer assessment or other PIMS audit processes such as internal or supplier privacy audits. For consistency across the globe, any properly-accredited body providing ISO/IEC 27701 certificates must fulfill the requirements in this standard plus ISO/IEC 17021-1 . Their auditors’ competence, suitability and reliability to perform their work properly is necessary to ensure that issued ISO/IEC 27701 certificates are meaningful and valuable: if literally anyone issues PIMS certificates without necessarily following the certification processes specified by this standard, even substantially non-conformant organisations could conceivably buy their certificates or simply ‘self-certify’ (assert rather than demonstrate conformity). Accreditation of the certification bodies is an important assurance control for those who depend or rely upon the certificates - including, by the way, the certified organisations themselves. Structure The standard formally specifies requirements and offers guidance for conformity auditing specifically in the context of PIMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 plus ISO/IEC 17000 and ISO/IEC 27701 . ISO/IEC 27706 is firmly based on ISO/IEC 17021-1 , with the same structure. Main clauses: 4: Principles 5: General requirements 6: Structural requirements 7: Resource requirements 8: Information requirements 9: Process requirement 10: Management system requirements for certification bodies Annex A: audit time Annex B: methods for audit time calculations Annex C: required knowledge and skills Most sections repetitively and tediously state "The requirements of ISO/IEC 17021-1, [section number] apply”. Status The current first edition was published in 2025 to coincide with the 2025 update to ISO/IEC 27701. This standard updated and replaced ISO/IEC TS 27006-2:2021 , replacing references in the first edition to ISO/IEC 27001 with references to ISO/IEC 17021-1. ISO/IEC 27006-2 was officially withdrawn at this time. Commentary Just as ISO/IEC 27006-1 specifies requirements for certification of an ISMS against ISO/IEC 27001 , the PIMS certification process involves auditing the management system (specifically) for conformity to the mandatory requirements in ISO/IEC 27701 . Conformity assessors have only a passing interest in the actual privacy arrangements that are being managed by the management system, doing sufficient checks to confirm that the PIMS is operational. It is presumed that any organisation with a PIMS that conforms to the standard probably does in fact have suitable privacy controls in place, and will ensure they remain appropriate and functional due to the operation of said PIMS. More subtly, the standard does not demand particular, detailed privacy arrangements or controls that may be inappropriate or insufficient if implemented in some situations, and hopefully reduces the possibility of assertive certification auditors seeking to second-guess or override informed management decisions about how the organisation is addressing its privacy risks. The auditors’ job is simply to provide assurance by assessing conformity of the management system with the mandatory requirements of ISO/IEC 27701 . Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27006-1 ISO/IEC 27006-1:2024 — Information technology, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of information security management systems — Part 1: General (fourth edition) Up Abstract ISO/IEC 27006 part 1 "specifies requirements and provides guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in [ISO/IEC 27006-1] are demonstrated in terms of competence and reliability by bodies providing ISMS certification. The guidance contained in [ISO/IEC 27006-1] provides additional interpretation of these requirements for bodies providing ISMS certification. NOTE [ISO/IEC 27006-1] can be used as a criteria document for accreditation, peer assessment or other audit processes.” [Source: ISO/IEC 27006-1:2024] Introduction ISO/IEC 27006-1 is the accreditation standard that guides C ertification B odies on the formal processes they must follow when auditing their clients’ I nformation S ecurity M anagement S ystems against ISO/IEC 27001 in order to certify or register them. The accreditation processes laid out in the standard give assurance that ISO/IEC 27001 certificates issued by accredited CBs are valid, consistent and meaningful. ISO/IEC 27006-1 specifies requirements and provides guidance for conformity auditing specifically in the context of ISMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 and ISO 19011 . The conformity assessment/certification process involves auditing the information security management system for conformity with ISO/IEC 27001 . The standard provides guidance specific to ISMS certifications where applicable - for example, in order to remain independent and objective, the CB cannot also provide information security reviews or internal audits of the client’s ISMS. [Since no exclusion period is specified in the standard, this could be interpreted as a permanent or indefinite exclusion, or it may mean contemporaneously or within a few months or ... whatever.] Scope The scope is to “specify requirements and provide guidance for bodies providing audit and certification of an information security management system (ISMS), in addition to the requirements contained within ISO/IEC 17021 and ISO/IEC 27001 . It is primarily intended to support the accreditation of certification bodies providing ISMS certification.” Any duly-accredited CB providing ISO/IEC 27001 conformity certificates must fulfill the requirements in ISO/IEC 27006-1 plus ISO/IEC 17021-1 and ISO 19011 in terms of their competence, suitability and reliability to perform their work properly. This is necessary to ensure that issued ISO/IEC 27001 certificates are meaningful, and truly indicate that the organisation has fully satisfied the stated requirements. Since literally anyone can issue certificates without necessarily following the certification processes specified in this standard, even substantially non-conformant organisations could conceivably purchase their ISMS certificates or simply ‘self-certify’ (assert rather than demonstrate conformity), potentially discrediting the whole certification structure. In other words, accreditation is an important control for certification. Structure The standard follows the structure of ISO/IEC 17021-1 clause-by-clause: 4: Principles 5: General requirements 6: Structural requirements 7: Resource requirements 8: Information requirements 9: Process requirements 10: Management system requirements Annex A: Knowledge and skills for ISMS auditing and certification Annex B: Further competence considerations Annex C: Audit time - putting sufficient effort into the conformity assessment Annex D: Methods for audit time calculations - determining how much effort is 'sufficient' Annex E: Guidance for review of implemented ISO/IEC 27001:2022, Annex A controls Status The first edition of ISO/IEC 27006 was published in 2007 . The second edition was published in 2011 . The third edition was substantially revised and published in 2015 , with minor wording changes as an amendment in 2020. The fourth edition was published as ISO/IEC 27006-1 in 2024 . It builds upon two normative references - ISO/IEC 17021-1:2015 and ISO/IEC 27001:2022 . Meanwhile, SC 27 is working on the structure of ISO/IEC 27006-1 and other issues, including concerns raised but not entirely resolved in exchanges with CASCO . See also ISO/IEC 27007 for further guidance on auditing an ISMS plus ISO/IEC TS 27008 for guidance on auditing information security controls. [Note: ISO/IEC 27006-2 was published in 2021 covering PIMS certification against ISO/IEC 27701 but was renumbered in 2025, becoming ISO/IEC 27706 .] Commentary Certification auditors have limited interest in the organisation’s information risks and information security controls that are supposedly being managed through the ISMS, needing to confirm "whether controls are implemented and effective and meet their stated information security objectives". It is largely assumed that any organisation with an operational ISMS in conformity with the standard is, in fact, determining its objectives and managing its information risks diligently. ISO/IEC 27001 gives organisations latitude on how they design and document their ISMS, and hence certification auditors cannot simply follow a straightforward conformity checklist: they need to understand both management systems and information risk and security concepts. As far as I’m concerned, that’s a good thing! The requirement to specify the S tatement o f A pplicability on ISO/IEC 27001 conformity certificates has the unfortunate side-effect of impeding maintenance updates to an ISMS if that would affect the SoA e.g. responding to newly-identified information risks or to incorporate additional controls. Since that hampers a fundamental principle or purpose of having a management system, it may constitute a substantive defect in ISO/IEC 27006-1 ... and perhaps other ISO management system standards too. In practice, however, it appears nobody (except me?) has noticed and is bothered by this. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27034-3 ISO/IEC 27034-3:2018 — Information technology — Security techniques — Application security — Part 3: Application security management process (first edition) Up Abstract ISO/IEC 27034 part 3 "provides a detailed description and implementation guidance for the Application Security Management Process.” [Source: ISO/IEC 27034-3:2018] Introduction Part 3 defines the processes of managing the security of an application processing critical information. Scope Part 3 "provides a detailed description and implementation guidance for the Application Security Management Process." Structure Main clauses: 5: A pplication S ecurity M anagement P rocess 6: ASMP steps 7: ANF elements Annex A: Guidance text related to the ASMP step: (6.4) Realizing and operating the application Status The current first edition of part 3 was published in 2018 . Commentary Part 3 describes “the overall process for managing security on each specific application used by an organisation”, malking this a broadly-applicable and particularly useful part of this multi-part standard. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27554 ISO/IEC 27554:2024 — Information security, cybersecurity and privacy protection — Application of ISO 31000 for assessment of identity-related risk [first edition] Up Abstract ISO/IEC 27554 "provides guidelines for identity-related risk, as an extension of ISO 31000:2018. More specifically, it uses the process outlined in ISO 31000 to guide users in establishing context and assessing risk, including providing risk scenarios for processes and implementations that are exposed to identity-related risk. [ISO/IEC 27554] is applicable to the risk assessment of processes and services that rely on or are related to identity. [ISO/IEC 27554] does not include aspects of risk related to general issues of delivery, technology or security.” [Source: ISO/IEC 27554:2024] Introduction This standard facilitates the application of the ISO 31000 risk management guidelines to identity management , supporting or supplementing various identity management standards. It applies the ISO 31000 risk management process to establish the context and assess risk, suggesting some risk scenarios for the processes and implementations specifically involving identity-related risk. Scope The standard applies to the assessment, specifically, of risks associated with ‘services and transactions’ that rely on or are related to identity management, excluding risks arising generally from delivery, technology or security. It can be used in conjunction with other standards concerning controls to protect identity information. The standard succinctly explains identity-related risk definition, context and impacts. It covers the central part of the classical ISO 31000-style risk management process, excluding risk monitoring and review, and risk communication and consultation. Structure Main sections: 4: Principles - simply refers to the ISO 31000 principles 5: Framework - refers to the ISO 31000 approach 6: Process - refers to the ISO 31000 risk management process 7: Identity-related risk assessment 8: Identity-related context establishment 9: Identity-related risk identification 10: Identity-related risk analysis 11: Identity-related risk evaluation 12: Identity-related risk treatment - refers to ISO 31000 ... with appendices on related standards on risk and identity management, and “risk impact assessment”. Status The current first edition was published in 2024 . Commentary ISO 31000 remains useful, along with ISO/IEC 27005 ... begging questions about the value of another standard in this area, especially one so naively and narrowly focused. In my jaundiced opinion, the standard misrepresents the probability element of risk, equating it to the amount of control applied rather than the predicted rate of occurrence. Conflating risk and control could be seen as a fundamental problem with the approach, confusing inherent (pre-treatment) and residual (post-treatment) risk. Language/terminological issues (e.g. “B.1 Assessing the degree of impact of a consequence”) beg further questions. Rewriting this standard in plain English might help bring such issues into the disinfecting glare of sunlight. The use of ‘degrees’, ‘levels’, ‘scales’ and ‘categories’ of risk, and ‘strength’ of identity-related processes (presumably controls?) indicates a subjective and qualitative approach ... and yet the standard suggests “collapsing the distinct indicators into a single combined value” at one point and for unexplained reasons presents numeric values in a ‘Plot matrix’ ... at which point I’m afraid I completely lost the plot. Repeat after me: Ordinary arithmetic is inappropriate for ordinal numbers. Ordinary arithmetic is inappropriate for ordinal numbers. Ordinary arithmetic is inappropriate for ordinal numbers. ... Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27003 ISO/IEC 27003:2017 — Information technology — Security techniques — Information security management systems — Guidance (second edition) Up Abstract “ISO/IEC 27003:2017 provides explanation and guidance on ISO/IEC 27001:2013.” [Source: ISO/IEC 27003:2017] Introduction ISO/IEC 27003 provides guidance for those implementing the ISO27k standards , covering the management system aspects in particular, as opposed to the information security controls which are summarised in ISO/IEC 27001 Annex A and explained more fully in ISO/IEC 27002. The standard supplements and builds upon other ISO27k standards (particularly ISO/IEC 27000 and ISO/IEC 27001 plus ISO/IEC 27004 , ISO/IEC 27005 and ISO/IEC 27014 ) and ISO 31000 . Scope The current edition of this standard primarily interprets or explains the requirements stated formally in ISO/IEC 27001:2013 . As a result of ISO’s intent to make all the M anagement S ystems S tandards consistent in structure, form and style, and in order for it to be usable for conformity assessment (ISMS certification) purposes, the language of ISO/IEC 27001 is inevitably formal, curt and stilted, leaving little room for interpretation. In contrast, ISO/IEC 27003 offers more pragmatic explanations of the requirements. Structure For convenience, ISO/IEC 27003 mirrors the structure of ISO/IEC 27001 , expanding clause-by-clause on ISO/IEC 27001 . The main clauses are therefore: 4: Context of the organisation 5: Leadership 6: Planning 7: Support 8: Operation 9: Performance evaluation 10: Improvement Annex: Policy framework [NOTE: this annex does not reflect or expand on the information security controls listed in ISO/IEC 27001 Annex A, since ISO/IEC 27002 already does that]. For each ISO/IEC 27001 clause and subclause, ISO/IEC 27003: Re-states the requirement/s; Explains the implications; and Offers a little practical guidance and supporting information including examples, to help implementers implement. For example, this is what ISO/IEC 27001 says in section 4.1, ‘Understanding the organisation and its context’: “The organisation shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system. NOTE Determining these issues refers to establishing the external and internal context of the organisation considered in Clause 5.3 of ISO 31000:2009.” Section 4.1 of ISO/IEC 27003 first succinctly re-states the ‘required activity’: “The organisation determines external and internal issues relevant to its purpose and affecting its ability to achieve the intended outcome(s) of the information security management system (ISMS).” Then it expands on the reasons why it is appropriate and necessary to ‘determine external and internal issues’, providing a page of explanation to supplement the succinct and somewhat hard to understand text from ISO/IEC 27001 . It explains, for instance, that the ‘internal issues’ include the organisation’s culture; its policies, objectives, and the strategies to achieve them; its governance, organisational structure, roles and responsibilities; and lists a further seven ‘internal issues’ to consider. It also identifies/cross-references other clauses that use this information. That alone would be a valuable expansion on ISO/IEC 27001 section 4.1 but ISO/IEC 27003 doesn’t stop there: it goes on to provide a further page of explanation, practical guidance and real-world examples in this area - 3 pages in total concerning that one short subclause. The end result is that the reader gains a better understanding of the formal requirements from the main body clauses of ISO/IEC 27001 and a clearer idea of how to go about satisfying them. Status The first edition was published in 2010 . It included implementation guidance. A substantially revised second edition, with more explanation but less implementation guidance, was issued in 2017. Work is under way now on a third edition. The third edition was due to be published in 2027 but has been delayed to 2028. The revision project has completed third C ommittee D raft stage with nearly 50 pages of comments. A new title is likely: “Information security, cybersecurity and privacy protection — Information security management systems — Guidance for the application of ISO/IEC 27001:2022”. An amended scope is also likely, appending “and the ISO/IEC 27001:2022/AMD 1:2024” , to acknowledge that climate change is to be considered. Work started in 2025 on another standard (either a second part to '27003 or a completely separate standard), with the development of a P reliminary W ork I nstruction. Whereas the second and third editions of ISO/IEC 27003 focus on explaining the formal ISMS requirements from ISO/IEC 27001 , ISO/IEC 27003-2 (or whatever number it is given) is intended to offer practical guidance on implementing an ISMS , for example ”setting up an implementation project, suitable top management involvement in the steering committee, setting a clear ambition level, appointment of a suitable project manager, etc.” It will hopefully rejuvenate and update the implementation advice from the 2010 first edition that has been eroded and largely lost. Commentary It takes years to prepare and release each new edition. Meanwhile , the ISO27k ISMS implementation guideline is a plain-English explanation of the requirements from ISO/IEC 27001 (based on the ISO Directives Part 1 Annex SL Appendix 2 concerning the wording and intent of the boilerplate text for all ISO’s management systems) plus pragmatic guidance for implementers (based on actual experience). The guideline is not an official ISO/IEC standard but, hey, it’s free of charge ... and available now ! To my eyes, the proposed ISO/IEC 27003-2 resembles phase 3 of the current revision project ... so it is possible that the revision might stop and release the third edition after completing phase 2’s plain English rewording (which I suspect will involve a lot more work than was planned), deferring phase 3 to the new 'part 2;' project. Maybe. We shall see. Although excluded from the current revision project, the scope and purpose of ISO/IEC 27003 could - at some distant future point perhaps - usefully extend beyond the ISMS design, implementation and certification phase to offer pragmatic advice on the operation, management, monitoring and systematic improvement of the ISMS. Certification of an ISMS is, after all, merely a milestone on the never-ending journey towards security maturity. As information security becomes an integral and valuable part of the organisation’s routine business/operational activities and management, changes are bound to occur. Potentially ’27003 might distinguish, encourage and support beneficial ISMS changes while discouraging counterproductive or detrimental ones. Alternatively, developing a separate ISO27k standard in parallel with the ongoing revision of ISO/IEC 27003 might be a quicker (less glacial) option, hinting at the possibility of a part 3 to this standard. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27099 ISO/IEC 27099:2022 — Information technology — Public key infrastructure — Practices and policy framework (first edition) Up Abstract ISO/IEC 27099 "sets out a framework of requirements to manage information security for Public key infrastructure (PKI) trust service providers through certificate policies, certificate practice statements, and, where applicable, their internal underpinning by an information security management system (ISMS). The framework of requirements includes the assessment and treatment of information security risks, tailored to meet the agreed service requirements of its users as specified through the certificate policy. [ISO/IEC 27099] is also intended to help trust service providers to support multiple certificate policies ...” [Source: ISO/IEC 27099:2022] Introduction Since trustworthiness is an essential characteristic of any P ublic K ey I nfrastructure, strenuous efforts are required to minimise all risks that might lead to loss of trust in PKI. The standard describes the use of an ISO/IEC 27001 I nformation S ecurity M anagement S ystem as a PKI management framework. Scope ISO/IEC 27099: Identifies information risk and security management requirements for PKI T rust S ervice P roviders and C ertification A uthorities through C ertificate P olicies and C ertification P ractice S tatements. Facilitates the implementation of operational, baseline controls and practices through an ISMS, building on and generalising the financial services PKI standard ISO 21188:2018 plus ISO/IEC 9594-8 , ISO/IEC 19790 and RFC 3647 . Supports the lifecycle of public key certificates used for digital signatures, authentication, or encryption key establishment and exchange; Primarily concerns PKI systems used in contractual relationships between organisations but also covers open (public) and closed (corporate/internal) PKIs; Is applicable to root and intermediate CAs, not just those issuing certificates directly to users. It does not address: Attribute certificates; Authentication methods; Non-repudiation requirements; Key management protocols based on the use of public key certificates; Blockchain - at least, not explicitly. Structure The ~100-page standard has 3 main clauses and 6 informative annexes: 5: introduces PKI concepts . 6: CP, CPS and their relation to ISMS. 7: CA objectives and controls , plus other requirements concerning the operation of a CA, based on the ISO/IEC 27002:2013 structure. Annex A: Management by CP. Annex B: Elements of a CPS (mapping to RFC 3647 ). Annex C: CA key generation ceremony. Annex D: Content and use of the CA audit journal . Annex E: Certificate and PKI roles . Annex F: Changes from ISO 21188. Status The current first edition was published in 2022. Commentary As with PKIs in general, this standard defines and uses 60 obscure terms of art plus 24 abbreviations, making it tough for non-specialists to comprehend - even tougher than PKI itself and cryptography in general. It is a detailed standard on an advanced, technical topic. It would take a lot of work to adopt ISO’s version of plain English . Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27010 ISO/IEC 27010:2015 — Information technology — Security techniques — Information security management for inter-sector and inter-organisational communications (second edition) Up Abstract "ISO/IEC 27010:2015 provides guidelines in addition to the guidance given in the ISO/IEC 27000 family of standards for implementing information security management within information sharing communities. This International Standard provides controls and guidance specifically relating to initiating, implementing, maintaining, and improving information security in inter-organizational and inter-sector communications. It provides guidelines and general principles on how the specified requirements can be met using established messaging and other technical methods. This International Standard is applicable to all forms of exchange and sharing of sensitive information, both public and private, nationally and internationally, within the same industry or market sector or between sectors. In particular, it may be applicable to information exchanges and sharing relating to the provision, maintenance and protection of an organization's or nation state's critical infrastructure. It is designed to support the creation of trust when exchanging and sharing sensitive information, thereby encouraging the international growth of information sharing communities." [Source: ISO.com page about ISO/IEC 27010] Introduction ISO/IEC 27010 provides guidance on sharing information about information risks, security controls, issues and/or incidents between industry sectors and/or nations, particularly those affecting critical infrastructure . Sometimes it is necessary to share confidential information regarding information-related threats, vulnerabilities and/or incidents between or within a community of organisations. For example, when private companies, governments, law enforcement and CERTs collaborate on the investigation, assessment and resolution of serious pan-organisational and often international cyberattacks. Since such information is often highly sensitive, it typically needs to be restricted to certain individuals within specified recipient organisations. Information sources may need to be kept anonymous. Such information exchanges typically happen in a highly charged and stressful atmosphere under intense time pressures - hardly the most conducive environment for establishing trusted working relationships and agreeing on suitable information security controls. The standard lays out common ground-rules for information security within communities of interest. The standard provides guidance on methods, models, processes, policies, controls, protocols and other mechanisms for the sharing of information securely with trusted counterparties on the understanding that important information security principles will be respected. Scope ISO/IEC 27010 provides guidance on information security interworking and communications between industries in the same sectors, in different industry sectors and with governments. It applies both in times of crisis affecting critical infrastructure and under normal business circumstances to meet legal, regulatory and contractual obligations. The standard has the style of a 'sector-specific' elaboration on or augmenting ISO/IEC 27002, recommending a few additional/modified information security controls to protect information risk and security information shared within communities of interest. Structure Main clauses: 4: Concepts and justification 5: Information security policies 6: Organization of information security (no additional guidance beyond ISO/IEC 27002:2013) 7: Human resources security 8: Asset management 9: Access control (no additional guidance) 10: Cryptography 11: Physical and environmental security (no additional guidance) 12: Operations security 13: Communications security 14: Systems acquisition, development and maintenance (no additional guidance) 15: Supplier relationships 16: Information security incident management 17: Information security aspects of business continuity management 18: Compliance Annex A: Sharing sensitive information Annex B: Establishing trust in information exchanges Annex C: The traffic light protocol - based on ENISA's red, amber, green and white levels Annex D: Models for organizing an information sharing community - TICE and WARP The standard reflects the structure of ISO/IEC 27002:2013, pre-dating the restructuring of controls into 4 'themes' for the 2022 edition. Status The first edition was published in 2012 . The current second edition was published in 2015 and confirmed unchanged in 2021. Commentary While the actual information risks arising from the sharing of information concerning information security incidents etc . between disparate organisations will of course depend on the specifics of the particular situation at hand (e.g. the nature of the incidents, the protagonists, the victims and the organisations involved), the following generic list of potential information risks and security issues in this area exemplifies the broad range of matters that may need to be taken into account in practice: Addressing information security aspects of the process (e.g . writing and implementing policies and procedures along with training and awareness activities for those involved in the process, and conceivably independent assessment or audits to confirm that the arrangements conform to ISO/IEC 27010 and/or other applicable ISO27k standards such as ISO/IEC 27001 , ISO/IEC 27002 and ISO/IEC 27005 ); Disclosing initial information and knowledge about the situation at hand prior to formalizing the arrangements, in order to prompt the recipient/s to consider their role and for disclosing parties to consider the risks involved in disclosing further information; Building trusted relationships between the organisations directly concerned, communicating and collaborating; Trust relationships with other organisations that may also be involved (e.g . if communications are routed through some sort of agency) or are somehow drawn-in to the situation, including business partners and those that may have to be informed or engaged in the process as a statutory or other duty; Determining and declaring or defining specific information security requirements (implies some form of information risk analysis by the disclosing parties for sure, and perhaps by the receiving parties); Communicating information risks and security control requirements, obligations, expectations or liabilities unambiguously (e.g . using a mutually-understood lexicon of terms based on ISO27k, and comparable information classifications); Assessing and accepting security risks and obligations (e.g . in some form of contract or agreement, whose existence and contents may also be confidential); Communicating information securely (e.g. using suitable cryptographic controls), preventing it from being sent to the wrong counterparties, intercepted, deleted, spoofed, duplicated, repudiated, damaged, modified or otherwise called into doubt deliberately by some third party or through inadequate controls and errors; Version controls and appropriate authorization for both disclosure and acceptance of valuable information; Risks and controls relating to the collection, analysis, ownership, protection and onward disclosure of information regarding the situation at hand by the recipient parties engaged in an investigation (e.g. limitations on using the information for purposes not directly associated with the incident at hand); Adequately protecting the information and perhaps others assets entrusted to the recipient organisations and individuals; Compliance and where appropriate enforcement activities such as imposition of penalties etc . if promises are broken, trust is misplaced or accidents happen; Unacceptable delays or other constraints on the communication of important information due to the risk assessment, security and related activities; The possible effects on collection, handling, storage, analysis and presentation of forensic evidence; Any limitations on post-incident disclosures such as incident management reporting, public press-releases, legal action etc .; Systematic process improvement, leading to greater mutual trust and stronger security arrangements for future situations. The published standard doesn’t cover these aspects explicitly, unfortunately. I feel it would have been more comprehensive and valuable if it had. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27043 ISO/IEC 27043:2015 — Information technology — Security techniques — Incident investigation principles and processes (first edition) Up Abstract “ISO/IEC 27043:2015 provides guidelines based on idealized models for common incident investigation processes across various incident investigation scenarios involving digital evidence. ...” [Source: ISO/IEC 27043:2015] Introduction The fundamental purpose of the digital forensics standards ISO/IEC 27037 , ISO/IEC 27041 , ISO/IEC 27042 , ISO/IEC 27043 and ISO/IEC 27050 is to promote good practice methods and processes for forensic capture and investigation of digital evidence. While individual investigators, organisations and jurisdictions may well retain certain methods, processes and controls, it is hoped that standardisation will (eventually) lead to the adoption of similar if not identical approaches internationally, making it easier to compare, combine and contrast the results of such investigations even when performed by different people or organisations, even across multiple jurisdictions. Scope The standard concerns the principles behind, and the forensic processes involved in, investigating digital incidents. Structure Main clauses: 5: Digital investigations 6: Digital investigation processes 7: Readiness processes 8: Initialization processes 9: Acquisitive processes 10: Investigative processes 11: Concurrent processes 12: Digital investigation process model schema Annex A: Digital investigation processes: motivation for harmonization Status The current first edition was published in 2015 and confirmed unchanged in 2020. It was due for periodic review again in 2025 ... and looks likely to be confirmed as-is. Commentary I am puzzled why SC 27 publishes and maintains several distinct forensics standards covering different aspects of forensics, when they are in reality complementary parts of the same process: ISO/IEC 27037 concerns the initial capturing of digital evidence. ISO/IEC 27041 offers guidance on the assurance aspects of digital forensics e.g. ensuring that the appropriate methods and tools are used properly. ISO/IEC 27042 covers what happens after digital evidence has been collected i.e. its analysis and interpretation. This standard covers the broader incident investigation activities, within which forensics usually occur. ISO/IEC 27050 (in 4 parts) concerns electronic discovery ... which is pretty much what the other standards cover. British Standard BS 10008 “Evidential weight and legal admissibility of electronically stored information (ESI), Specification.” may also be of interest. A multi-part standard would make more sense to me, with a “part 1” overview explaining how the jigsaw pieces fit together. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27050-2 ISO/IEC 27050-2:2018 — Information technology — Security techniques — Electronic discovery — Part 2: Guidance for governance and management of electronic discovery (first edition) Up Abstract ISO/IEC 27050 part 2 “provides guidance for technical and non-technical personnel at senior management levels within an organisation, including those with responsibility for compliance with statuary and regulatory requirements, and industry standards. [Part 2] describes how such personnel can identify and take ownership of risks related to electronic discovery, set policy and achieve compliance with corresponding external and internal requirements. It also suggests how to produce such policies in a form which can inform process control. Furthermore, it provides guidance on how to implement and control electronic discovery in accordance with the policies.” [ Source: ISO/IEC 27050-2:2018 ] Introduction Part 2 guides management on identifying and treating the information risks related to eDiscovery e.g. by setting and implementing eDiscovery-related policies and complying with relevant (mostly legal) obligations and expectations. It also offers guidance on good governance for forensics work i.e. the overarching framework or structure within which digital forensic activities take place and are managed through a controlled, repeatable and trustworthy suite of activities. Scope Governance and management of eDiscovery. Structure Main clauses: 5: Electronic discovery background 6: Governance of electronic discovery 7: Management of electronic discovery 8: Risks and environmental factors 9: Compliance and review Status The current first edition of part 2 was published in 2018 . Commentary Part 2 suggests a few possible metrics, although organisations are well advised to determine their own based on their objectives relating to eDiscovery, eForensics, incident management, information risks and so forth. Of all the things going on in this area, which parts and aspects are important for the business and why? [Hint: what are the key risks and key controls?] What kinds of information would help management manage them? What questions arising are likely to need answering? Those are strong clues to the metrics that would actually be worthwhile for a given organisation, as opposed to those suggested by others - including ISO. Thankfully, part 2 outlines information risks that various information security controls are intended to mitigate. However, the list of risks is incomplete, for example it fails to mention that damage, theft, loss or some other incident affecting ESI can compromise its value and admissibility in court, potentially decimating an otherwise valid case. It's a starting point though, something worth elaborating on. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27033-7 ISO/IEC 27033-7:2023 Information technology — Network security — Part 7: Guidelines for network virtualization security (first edition) Up Abstract ISO/IEC 27033 part 7 "aims to identify security risks of network virtualization and proposes guidelines for the implementation of network virtualization security. Overall, [ISO/IEC 27033-7] intends to considerably aid the comprehensive definition and implementation of security for any organization’s virtualization environments. It is aimed at users and implementers who are responsible for the implementation and maintenance of the technical controls required to provide secure virtualization environments.” [Source: ISO/IEC 27033-7:2023] Introduction Network virtualization was defined in ISO/IEC TR 29181-1:2012 as "technology that enables the creation of logically isolated network partitions over shared physical network infrastructures so that multiple heterogeneous virtual networks can simultaneously coexist over the shared infrastructures. Note 1 to entry: Network virtualization allows the aggregation of multiple resources and makes the aggregated resources appear as a single resource." For context, the same 2012 standard concerned "Future Network", defined as "network of the future which is made on clean-slate design approach as well as incremental design approach; it should provide futuristic capabilities and services beyond the limitations of the current network, including the Internet". Scope Within the multipart network security standard ISO/IEC 27033, part 7 addresses information risks and security controls applicable to network virtualisation. Structure Main clauses: 5: Overview 6: Security threats 7: Security recommendations 8: Security controls 9: Design techniques and considerations Annex A: Use cases of network virtualization Annex B: Detailed security threat description of network virtualization Status The current first edition of part 7 was published in 2023 . Commentary Whereas the standard outlines some “security threats” or “security issues” - generic examples of types of incident (such as “Insider attacks: an administrator tampers image or changes security configurations”) - it does not explain which information security controls address the identified “security threats/issues”, nor conversely which information risks the suggested information security controls are intended to mitigate: there is no cross-referencing between the two, hence it is unclear how users are meant to identify, select or prioritise whichever controls are most appropriate for their situations. So much for the “implementation guidelines”! Up Up Up This page last updated: 10 July 2026