Back Up Next ISO/IEC TS 27103 ISO/IEC TS 27103:2026 — Cybersecurity — Guidance on using ISO and IEC standards in a cybersecurity framework (first edition*) Up Abstract ISO/IEC TS 27103 "provides guidance on how to leverage existing ISO and IEC standards in a cybersecurity framework.” [Source: ISO/IEC TS 27103:20 26] Introduction "The concepts behind information security can be used to assess and manage cybersecurity risks. The key question is how to manage cybersecurity risk in a comprehensive and structured manner, and ensure that processes, governance and controls are addressed. This can be done through a management systems approach. An Information Security Management system (ISMS) as described in ISO/IEC 27001 is a well proven way for any organization to implement a risk-based approach to cybersecurity. [ISO/IEC TS 27103] demonstrates how a cybersecurity framework can utilize current information security standards to achieve a well-controlled approach to cybersecurity management." [Source: ISO/IEC TS 27103:2026] Scope The standard offers guidance on using existing ISO and IEC standards (not just ISO27k ) in a "risk-based, prioritized, flexible, outcome-focused, and communications-enabling framework for cybersecurity". The 'cybersecurity framework and programme' is described as a set of five 'activities' relating to the 'target state for cybersecurity' (in other word, objectives), applying the conventional systematic ISO27k approach to the management of 'cybersecurity risk': Describe the organization’s current cybersecurity status; Describe the organization’s target state for cybersecurity; Identify and prioritize opportunities for improvement; Assess progress toward the target state; and Communicate among internal and external stakeholders about cybersecurity risk Somewhat confusingly, the 'framework and programme' also revolves around five 'functions' relating to the incident timescale - basically NIST's C yber S ecurity F ramework : Identify - business context, resources and risks relating to critical [business] functions; Protect - safeguard delivery of critical infrastructure services; Detect - activities to identify cybersecurity events, promptly; Respond - react to and contain identified events; Recover - resilience and restoration of impaired capabilities or services. The 'functions' are further divided into 'categories' and 'subcategories' which are cross-referenced to relevant clauses in ISO27k and other standards. Structure Main clauses: 5: Background - risk-based approach, stakeholders, framework and programme 6: Concepts - overview, framework functions Annex A: Sub-categories - identify, protect, detect, respond, recover Annex B: Three principles of the cybersecurity [plus ten essentials] for top management - an alternative to NIST's CSF, cross-referenced to ISO27k standards Status * This standard was initially published as a T echnical R eport in 2018 and confirmed unchanged in 2022 . It was updated, becoming the current first edition T echnical S pecification in 2026 . Commentary See also ISO/IEC TS 27110 . In ISO-land, a T echnical S pecification is a standard for an immature or developing technical subject. In theory, that means it should be formally reviewed within three years, becoming an I nternational S tandard if there is consensus ... otherwise continuing unchanged or being withdrawn. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27050-2 ISO/IEC 27050-2:2018 — Information technology — Security techniques — Electronic discovery — Part 2: Guidance for governance and management of electronic discovery (first edition) Up Abstract ISO/IEC 27050 part 2 “provides guidance for technical and non-technical personnel at senior management levels within an organisation, including those with responsibility for compliance with statuary and regulatory requirements, and industry standards. [Part 2] describes how such personnel can identify and take ownership of risks related to electronic discovery, set policy and achieve compliance with corresponding external and internal requirements. It also suggests how to produce such policies in a form which can inform process control. Furthermore, it provides guidance on how to implement and control electronic discovery in accordance with the policies.” [ Source: ISO/IEC 27050-2:2018 ] Introduction Part 2 guides management on identifying and treating the information risks related to eDiscovery e.g. by setting and implementing eDiscovery-related policies and complying with relevant (mostly legal) obligations and expectations. It also offers guidance on good governance for forensics work i.e. the overarching framework or structure within which digital forensic activities take place and are managed through a controlled, repeatable and trustworthy suite of activities. Scope Governance and management of eDiscovery. Structure Main clauses: 5: Electronic discovery background 6: Governance of electronic discovery 7: Management of electronic discovery 8: Risks and environmental factors 9: Compliance and review Status The current first edition of part 2 was published in 2018 . Commentary Part 2 suggests a few possible metrics, although organisations are well advised to determine their own based on their objectives relating to eDiscovery, eForensics, incident management, information risks and so forth. Of all the things going on in this area, which parts and aspects are important for the business and why? [Hint: what are the key risks and key controls?] What kinds of information would help management manage them? What questions arising are likely to need answering? Those are strong clues to the metrics that would actually be worthwhile for a given organisation, as opposed to those suggested by others - including ISO. Thankfully, part 2 outlines information risks that various information security controls are intended to mitigate. However, the list of risks is incomplete, for example it fails to mention that damage, theft, loss or some other incident affecting ESI can compromise its value and admissibility in court, potentially decimating an otherwise valid case. It's a starting point though, something worth elaborating on. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC TR 27563 ISO/IEC TR 27563:2023 — Security and privacy in artificial intelligence use cases — Best practices (first edition) Up Abstract ISO/IEC TR 27563 "outlines best practices on assessing security and privacy in artificial intelligence use cases, covering in particular those published in ISO/IEC TR 24030. The following aspects are addressed: an overall assessment of security and privacy on the AI system of interest; security and privacy concerns; security and privacy risks; security and privacy controls; security and privacy assurance; and security and privacy plans. Security and privacy are treated separately as the analysis of security and the analysis of privacy can differ.” [Source: ISO/IEC TR 27563:2023 ] Introduction This T echnical R eport analyses and elaborates on the information security and privacy aspects of the 132 use cases for A rtificial I ntelligence/M achine L earning systems published in ISO/IEC TR 24030:2021 “Information technology - Artificial Intelligence (AI) - use cases”, and provides four additional use cases developed specifically for this TR. Scope The standard offers information security and privacy best practice guidance following analysis of ISO/IEC 24030 ’s use cases. Structure Main clauses: 5: Analysis of security and privacy 6: Templates for analysis 7: Supporting information Annex A: Additional use cases The information security and privacy implications for related groups of AI/ML use cases have been systematically analysed. The results are summarised in bar charts, followed by tables elaborating on the analyses in a standard format. Status The current first edition was published in 2023 . Commentary Cue tumbleweed ... Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27050-4 ISO/IEC 27050-4:2021 — Information technology — Electronic discovery — Part 4: Technical readiness (first edition) Up Abstract ISO/IEC 27050 part 4 “provides guidance on the ways an organization can plan and prepare for, and implement, electronic discovery from the perspective of both technology and processes. [Part 4] provides guidance on proactive measures that can help enable effective and appropriate electronic discovery and processes. [Part 4] is relevant to both non-technical and technical personnel involved in some or all of the electronic discovery activities.” [Source: ISO/IEC 27050-4:2021 ] Introduction In 35 pages, part 4 describes "technical readiness" (defined as "having the knowledge, skills, processes and technologies needed to address a particular issue or challenge") in the context of eDiscovery and eForensics. It covers the selection, preparation and use of tools supporting each step of the electronic discovery process, including the retention/storage, production and eventual destruction of E lectronically S tored I nformation. Scope Guidance on preparing the technology (i.e. the forensic tools and systems supporting the collection, storage, collation, searching, analysis and production of ESI, plus the related processes) and the associated processes required for eDiscovery. Note: 'technical' and 'technological' are, technically, different words with different meanings. Structure Main clauses: 6: Technical readiness 7: Readiness for electronic discovery 8: Additional considerations 9: Electronic discovery cross-cutting aspects Annex A: ESI storage questionnaire Status The current first edition was published in 2021 . Commentary As usual for ISO standards, part 4 offers generic advice and does not specify or recommend specific tools for eDiscovery. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27706 ISO/IEC 27706:2025 — Information security, cybersecurity and privacy protection — Requirements for bodies providing audit and certification of privacy information management systems (first edition) Up Abstract ISO/IEC 27706 "specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701, in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in [ISO/IEC 27706] are demonstrated in terms of competence and reliability by bodies providing PIMS certification. The guidance contained in [ISO/IEC 27706] provides additional interpretation of these requirements for bodies providing PIMS certification. NOTE [ISO/IEC 27706] can be used as a criteria document for accreditation, peer assessment or other audit processes.” [Source: ISO/IEC 27706:2025 ] Introduction This accreditation standard guides certification bodies on the formal processes they must follow when auditing clients’ P rivacy I nformation M anagement S ystems against ISO/IEC 27701 in order to certify or register them. The accreditation processes laid out in the standard give assurance that ISO/IEC 27701 certificates issued by accredited organisations are valid, comparable, meaningful and hence commercially valuable. Scope This standard is primarily aimed at PIMS certification auditors ("conformity assessors"). It may also be used for peer assessment or other PIMS audit processes such as internal or supplier privacy audits. For consistency across the globe, any properly-accredited body providing ISO/IEC 27701 certificates must fulfill the requirements in this standard plus ISO/IEC 17021-1 . Their auditors’ competence, suitability and reliability to perform their work properly is necessary to ensure that issued ISO/IEC 27701 certificates are meaningful and valuable: if literally anyone issues PIMS certificates without necessarily following the certification processes specified by this standard, even substantially non-conformant organisations could conceivably buy their certificates or simply ‘self-certify’ (assert rather than demonstrate conformity). Accreditation of the certification bodies is an important assurance control for those who depend or rely upon the certificates - including, by the way, the certified organisations themselves. Structure The standard formally specifies requirements and offers guidance for conformity auditing specifically in the context of PIMSs, in addition to the general accreditation requirements laid down by ISO/IEC 17021-1 plus ISO/IEC 17000 and ISO/IEC 27701 . ISO/IEC 27706 is firmly based on ISO/IEC 17021-1 , with the same structure. Main clauses: 4: Principles 5: General requirements 6: Structural requirements 7: Resource requirements 8: Information requirements 9: Process requirement 10: Management system requirements for certification bodies Annex A: audit time Annex B: methods for audit time calculations Annex C: required knowledge and skills Most sections repetitively and tediously state "The requirements of ISO/IEC 17021-1, [section number] apply”. Status The current first edition was published in 2025 to coincide with the 2025 update to ISO/IEC 27701. This standard updated and replaced ISO/IEC TS 27006-2:2021 , replacing references in the first edition to ISO/IEC 27001 with references to ISO/IEC 17021-1. ISO/IEC 27006-2 was officially withdrawn at this time. Commentary Just as ISO/IEC 27006-1 specifies requirements for certification of an ISMS against ISO/IEC 27001 , the PIMS certification process involves auditing the management system (specifically) for conformity to the mandatory requirements in ISO/IEC 27701 . Conformity assessors have only a passing interest in the actual privacy arrangements that are being managed by the management system, doing sufficient checks to confirm that the PIMS is operational. It is presumed that any organisation with a PIMS that conforms to the standard probably does in fact have suitable privacy controls in place, and will ensure they remain appropriate and functional due to the operation of said PIMS. More subtly, the standard does not demand particular, detailed privacy arrangements or controls that may be inappropriate or insufficient if implemented in some situations, and hopefully reduces the possibility of assertive certification auditors seeking to second-guess or override informed management decisions about how the organisation is addressing its privacy risks. The auditors’ job is simply to provide assurance by assessing conformity of the management system with the mandatory requirements of ISO/IEC 27701 . Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27099 ISO/IEC 27099:2022 — Information technology — Public key infrastructure — Practices and policy framework (first edition) Up Abstract ISO/IEC 27099 "sets out a framework of requirements to manage information security for Public key infrastructure (PKI) trust service providers through certificate policies, certificate practice statements, and, where applicable, their internal underpinning by an information security management system (ISMS). The framework of requirements includes the assessment and treatment of information security risks, tailored to meet the agreed service requirements of its users as specified through the certificate policy. [ISO/IEC 27099] is also intended to help trust service providers to support multiple certificate policies ...” [Source: ISO/IEC 27099:2022] Introduction Since trustworthiness is an essential characteristic of any P ublic K ey I nfrastructure, strenuous efforts are required to minimise all risks that might lead to loss of trust in PKI. The standard describes the use of an ISO/IEC 27001 I nformation S ecurity M anagement S ystem as a PKI management framework. Scope ISO/IEC 27099: Identifies information risk and security management requirements for PKI T rust S ervice P roviders and C ertification A uthorities through C ertificate P olicies and C ertification P ractice S tatements. Facilitates the implementation of operational, baseline controls and practices through an ISMS, building on and generalising the financial services PKI standard ISO 21188:2018 plus ISO/IEC 9594-8 , ISO/IEC 19790 and RFC 3647 . Supports the lifecycle of public key certificates used for digital signatures, authentication, or encryption key establishment and exchange; Primarily concerns PKI systems used in contractual relationships between organisations but also covers open (public) and closed (corporate/internal) PKIs; Is applicable to root and intermediate CAs, not just those issuing certificates directly to users. It does not address: Attribute certificates; Authentication methods; Non-repudiation requirements; Key management protocols based on the use of public key certificates; Blockchain - at least, not explicitly. Structure The ~100-page standard has 3 main clauses and 6 informative annexes: 5: introduces PKI concepts . 6: CP, CPS and their relation to ISMS. 7: CA objectives and controls , plus other requirements concerning the operation of a CA, based on the ISO/IEC 27002:2013 structure. Annex A: Management by CP. Annex B: Elements of a CPS (mapping to RFC 3647 ). Annex C: CA key generation ceremony. Annex D: Content and use of the CA audit journal . Annex E: Certificate and PKI roles . Annex F: Changes from ISO 21188. Status The current first edition was published in 2022. Commentary As with PKIs in general, this standard defines and uses 60 obscure terms of art plus 24 abbreviations, making it tough for non-specialists to comprehend - even tougher than PKI itself and cryptography in general. It is a detailed standard on an advanced, technical topic. It would take a lot of work to adopt ISO’s version of plain English . Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC TS 27115-3 ISO/IEC TS 27115-3 — Information security, cybersecurity and privacy protection — Cybersecurity of system of systems — Part 3: Security profiles [DRAFT] Up Abstract ?? Introduction Using concepts and terms in the style of the C ommon C riteria such as T arget O f E valuation and security profile, part 3 intends to explain how to evaluate a complex system against the security architecture. Scope ISO/IEC TS 27115-3 will provide a framework to describe security profiles based on ISO/IEC TS 27115-1 and ISO/IEC TS 27115-2 . The framework uses basic architecture concepts to enable the definition of architecture-based security profiles and composition of profiles. Structure ?? Status Part 3 is due out in 2029. It is currently at A pproved W ork I tem stage. Commentary TBA Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27041 ISO/IEC 27041:2015 — Information technology — Security techniques — Guidance on assuring suitability and adequacy of incident investigative method (first edition) Up Abstract “ISO/IEC 27041:2015 provides guidance on mechanisms for ensuring that methods and processes used in the investigation of information security incidents are "fit for purpose". ...” [Source: ISO/IEC 27041:2015] Introduction The fundamental purpose of the ISO27k digital forensics standards is to promote good practice methods and processes for forensic capture and investigation of digital evidence. While individual investigators, organisations and jurisdictions may well retain certain methods, processes and controls, it is hoped that standardization will (eventually) lead to the adoption of similar if not identical approaches internationally, making it easier to compare, combine and contrast the results of such investigations even when performed by different people or organisations and potentially across different jurisdictions. Scope The primary focus of this standard is on assurance for the forensics processes and tools used in the investigation of digital evidence. Credibility, trustworthiness and integrity are fundamental requirements for all forensics methods: this standard promotes the assurance aspects of investigating digital evidence. The standard offers guidance on assuring the suitability and adequacy of the forensic methods used to investigate digital evidence, describing methods through which all stages of the investigation process can be shown to be appropriate (proper and suitable in themselves, and correctly performed). Structure Main clauses: 5: Method development and assurance 6: Assurance models 7: Production of evidence for assurance Annex A: Examples Status The current first edition was published in 2015 and confirmed unchanged in 2021. Commentary I am puzzled why SC 27 publishes and maintains several distinct forensics standards covering different aspects of forensics, when they are in reality complementary parts of the same process. ISO/IEC 27037 concerns the initial capturing of digital evidence. This standard offers guidance on the assurance aspects of digital forensics e.g. ensuring that the appropriate methods and tools are used properly. ISO/IEC 27042 covers what happens after digital evidence has been collected i.e. its analysis and interpretation. ISO/IEC 27043 covers the broader incident investigation activities, within which forensics usually occur. ISO/IEC 27050 (in 4 parts) concerns electronic discovery ... which is pretty much what the other standards cover. British Standard BS 10008 “Evidential weight and legal admissibility of electronically stored information (ESI), Specification.” may also be of interest. A multi-part standard would make more sense to me, with a part 1 overview explaining how the jigsaw pieces fit together. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27033-1 ISO/IEC 27033-1:2015 — Information technology — Security techniques — Network security — Part 1: Overview and concepts (second edition) Up Abstract ISO/IEC 27033 part 1 “provides an overview of network security and related definitions. It defines and describes the concepts associated with, and provides management guidance on, network security. (Network security applies to the security of devices, security of management activities related to the devices, applications/services, and end-users, in addition to security of the information being transferred across the communication links.) ... Overall it provides an overview of this International Standard and a 'road map' to all other parts.” [Source: ISO/IEC 27033-1:2015] Introduction Part 1 revised and replaced ISO/IEC 18028 part 1. It provides: A roadmap and overview of the concepts and principles underpinning the remaining parts of ISO/IEC 27033. A glossary of information security terms specific to networking. Guidance on a structured process to identify and analyse network security risks and hence define network security control requirements, including those mandated by relevant information security policies. An overview of the controls supporting network technical security architectures and related technical controls, as well as non-technical controls plus other technical controls that are not solely related to network security (thus linking to ISO/IEC 27001 , ISO/IEC 27002 and ISO/IEC 27005 plus other ISO27k standards as they are released). Scope Extends the security management guidelines provided in ISO/IEC TR 13335 and ISO/IEC 27002 etc . by detailing the specific operations and mechanisms needed to implement network security controls in a wider range of network environments, providing a bridge between general information security management issues and the specifics of implementing largely technical network security controls (e.g . firewalls, IDS/IPS, message integrity controls etc .) Structure Main clauses: 6: Overview 7: Identifying risks and preparing to identify security controls 8: Supporting controls 9: Guidelines for the definition and implementation of network security 10: Reference network scenarios - risks, design techniques and control issues 11: 'Technology ' topics - risks, design techniques and control issues 12: Develop and test security solution 13: Operate security solution 14: Monitor and review solution implementation Annex A: Cross-reference between ISO/IEC 27001 Annex A and ISO/IEC 27002 network security-related controls and ISO/IEC 27033-1 Annex B: Example template for a SecOPs document Status ISO/IEC 27033-1 revised and replaced ISO/IEC 18028-1, which in turn superceded ISO/IEC TR 13335-5. The first edition was published in 2009 . The current second edition was published in 2015 and confirmed unchanged in 2021. An extended scope for the ISO/IEC 27033 network security standards is under consideration to catch up with recent and emerging technologies such as cloud computing, zero trust, IoT and AI. Consequently the initial routine standards revision project was stopped and restarted at P reliminary W ork I nstruction stage in 2025. Commentary Part 1 mentions requirements such as non-repudiation and reliability in addition to the classical CIA triad (confidentiality, integrity and availability). It provides a reasonably technical overview of network security despite barely any reference to the OSI or TCP/IP network stacks! At present, the ISO/IEC 27033 standards are largely (entirely?) concerned with digital data networks, but there are other kinds of networks - such as business networks, social networks, professional networks, criminal networks and socio-political/cultural networks - all with differing risks and security concerns. So, should the ISO/IEC 27033 set be extended to cover those too? If so, how? It is not exactly obvious what kinds of guidance might usefully be offered in these other areas - in fact, formally speaking, it is not even entirely clear what ‘networks’ are. Anyway, that’s something to bear in mind. SC 27, meanwhile, tends to stick to the knitting i.e. IT/cyber security, in accordance with its defined scope. Furthermore, I feel the information risk and security aspects of industrial shop-floor O perational T echnology networks are inadequately covered by current ISO/IEC 27033 standards, a significant omission. The networking protocols, risks and controls vary, while the gradual convergence of IT and OT is bound to affect network security in both domains. Up Up Up This page last updated: 19 August 2026

Back Up Next ISO/IEC 27039 ISO/IEC 27039:2015 — Information technology — Security techniques — Selection, deployment and operations of intrusion detection and prevention systems (IDPS) (first edition) Up Abstract “ISO/IEC 27039:2015 provides guidelines to assist organisations in preparing to deploy intrusion detection and prevention systems (IDPS). In particular, it addresses the selection, deployment, and operations of IDPS. It also provides background information from which these guidelines are derived.” [Source: ISO/IEC 27039:2015] Introduction I ntrusion D etection S ystems are largely automated systems for identifying attacks on and intrusions into a network or system by hackers and raising the alarm. I ntrusion P revention S ystems take the automation a step further by automatically responding to certain types of identified attack, for example by closing off specific network ports through a firewall to block identified hacker traffic. IDPS refers to either type. Scope The scope states “This International Standard provides guidelines to assist organisations in preparing to deploy Intrusion Detection Prevention System (IDPS). In particular, it addresses the selection, deployment and operations of IDPS. It also provides background information from which these guidelines are derived.” Well designed, deployed, configured, managed and operated IDPS are valuable in several respects, for example: Automation leverages scarce security engineers who would otherwise have to monitor, analyse and respond to network security incidents as best they could; Automation tends to speed-up identification and response to attacks, particularly common types of attack that can be identified unambiguously through unique attack signatures; They give additional assurance to management that security issues on the networks and networked systems are being identified and mitigated. The standard is, in effect, an ISPS implementation guide and advisory. Structure Main clauses: 5: Selection - of various types of IDPS, complementary tools etc . to consider (in some detail, expanded still further in the annex) 6: Deployment - of IDPS 7: Operations - of IDPS Annex A: Intrusion Detection and Prevention System (IDPS): framework and issues to be considered Status The current first edition was published in 2015 , “revising and canceling” (i.e. replacing) ISO/IEC 18043:2006. A technical corrigendum in 2016 corrected the title of the published standard, introducing “and prevention” that somehow got lost. The first edition was confirmed unchanged in 2020. It was due for periodic review in 2025 ... Commentary I had hoped the standard would mention, in addition to the network security risks that they are meant to address, various information risks and issues associated with or introduced by the IDPS themselves, such as: They are technologically advanced and complex controls, making them difficult to configure, deploy and use effectively. Hence there is a risk that they may be incorrectly configured, deployed or used in practice, with various consequences on the organisation and other systems. Furthermore, they probably introduce additional technical security vulnerabilities into the very networks and/or systems they are supposed to protect; They may adversely affect network traffic, restricting legitimate traffic and hence normal use of the network and systems, as well as hacking traffic; They are not 100% capable, meaning that certain types or modes of attack (particularly novel ones) may not be reliably identified and hence blocked, potentially creating a false sense of security (inappropriate assurance); They can only detect and react to available information, making them blind and deaf to attacks that bypass the networks and systems being monitored (including, for examples, social engineering and physical intrusion attacks); They usually require network bandwidth, processing and storage capacity for their own operations and record-keeping, and require hooks into the networks and systems being monitored and/or controlled, impinging upon normal use; They are complicated to configure, manage, monitor and maintain for best effect, requiring the ongoing involvement of competent security engineers who, potentially, may be hackers; They require privileged access to network traffic, network devices and/or systems, and could potentially be misused as a vector or mechanism to compromise them. However, it does not ... Up Up Up This page last updated: 19 August 2026