Search Results

Back Up Next ISO/IEC 27035-1 ISO/IEC 27035-1:2023 — Information technology — Information security incident management — Part 1: Principles and process (second edition) Up Abstract ISO/IEC 27035 part 1 “is the foundation of the ISO/IEC 27035 series. It presents basic concepts, principles and process with key activities of information security incident management, which provide a structured approach to preparing for, detecting, reporting, assessing, and responding to incidents, and applying lessons learned. The guidance on the information security incident management process and its key activities given in [ISO/IEC 27035-1] are generic and intended to be applicable to all organizations, regardless of type, size or nature. Organizations can adjust the guidance according to their type, size and nature of business in relation to the information security risk situation. [ISO/IEC 27035-1] is also applicable to external organizations providing information security incident management services.” [Source: ISO/IEC 27035-1:2023 ] Introduction Information security controls are imperfect in various ways: controls can be overwhelmed or undermined (e.g. by competent hackers, fraudsters or malware), fail in service (e.g. authentication failures), work partially or poorly (e.g. slow anomaly detection), or be more or less completely missing (e.g . not [yet] fully implemented, not [yet] fully operational, or never even conceived due to failures upstream in risk identification and analysis). Consequently, information security incidents are bound to occur to some extent, even in organisations that take their information security extremely seriously. Managing incidents effectively involves detective and corrective controls designed to recognize and respond to events and incidents, minimize adverse impacts, gather forensic evidence (where applicable) and in due course ‘learn the lessons’ in terms of prompting improvements to the ISMS, typically by improving the preventive controls or other risk treatments. Information security incidents commonly involve the exploitation of previously unrecognised and/or uncontrolled vulnerabilities, hence vulnerability management (e.g. applying relevant security patches to IT systems and addressing various control weaknesses in operational and management procedures) is part preventive and part corrective action. The ISO/IEC 27035 standards concern managing information security events, incidents and vulnerabilities, expanding on the information security incident management section of ISO/IEC 27002 . The standards describe a 5-phase process: Prepare to deal with incidents e.g. prepare an incident management policy, and establish a competent team to deal with incidents; Identify and report information security incidents; Assess incidents and make decisions about how they are to be addressed e.g. patch things up and get back to business quickly, or collect forensic evidence even if it delays resolving the issues; Respond to incidents i.e. contain them, investigate them and resolve them; Learn the lessons - more than simply identifying the things that might have been done better, this stage involves actually making changes that improve the processes. Scope Part 1 outlines the concepts and principles underpinning information security incident management and introduces the remaining part/s of the standard. It describes an information security incident management process consisting of five phases, and says how to improve incident management. Structure Main clauses: 4: Overview 5: Process Annex A: Relationship to investigative standards Annex B: Examples of information security incidents and their causes Annex C: Cross-reference table of ISO/IEC 27001 to the ISO/IEC 27035 series Annex D: Considerations of situations discovered during the investigation of an incident Status The first edition of ISO/IEC 27035 was published as a single standard in 2011 , replacing ISO TR 18044. It was subsequently split into four parts ... The first edition of part 1 was published in 2016 . Having been revised for ISO/IEC 27002:2022 the current second edition was published in 2023 . Commentary Information security incident management is described overall, and then as a process with five phases: Plan and prepare: establish an information security incident management policy, form an I ncident R esponse T eam etc. Detect and report: someone has to spot and report “events” that might be or turn into incidents; Assess and decide: someone must assess the situation to determine whether it is in fact an incident; Respond: contain, eradicate, recover from and forensically analyse the incident, where appropriate; Learn lessons: make systematic improvements to the organisation’s management of information risks as a consequence of incidents experienced. Annexes give examples of information security incidents and cross-references to eForensics and ISO/IEC 27001 standards. In addition to actual events and incidents, we should be systematically exploring and learning from near-misses i.e. situations that thankfully caused little if any impact on the business, such as: An alert worker noticing and reporting a phishing or B usiness E mail C ompromise attack; An infection by defective/nonfunctional malware or scareware; A colleague spotting confidential papers left on someone’s office desk after they have gone home, and tidying them away; A manager casually disclosing a commercially-sensitive detail in conversation with a supplier or competitor who appears not to have noticed it; A neighbouring office being ram-raided, burgled, vandalised, burnt or flooded; A competitor, business partner, customer or supplier suffering a noteworthy incident; Any incident from which the organisation successfully recovered e.g. by restoring backups; Incidents that, by sheer good fortune, were trivial (incidental!), and could easily have been much worse e.g. if they had occurred at a different time or day or point in the business cycle, in other circumstances, or if they had not been spotted so soon. Although, in the absence of significant impacts and with finite resources already stretched by other priorities, it is tempting for management simply to ignore close-shaves and minor incidents, they present opportunities to: Identify and study information risks (threats, vulnerabilities, exposures, impacts ...) that might otherwise have remained unrecognised or ignored; Evaluate the risk management approach, particularly the associated decisions and controls; Tease out and address specific or indeed general weaknesses with the approach, making improvements; Gain assurance on the aspects that worked well, or at least went to plan; Generate case study materials for awareness and training purposes, and information to feed into future risk assessments, including statistics/metrics. We might not be quite so lucky next time! The aviation industry is a shining example of this approach, with a comprehensive no-blame strategy to identify, report, address and improve as a result of [literal and figurative] near-misses. Notwithstanding the title, the ISO/IEC 27035 standards specifically concern incidents affecting IT systems and networks although the fundamental principles apply also to incidents affecting other forms of information such as paperwork, knowledge, intellectual property, trade secrets and personal information. Unfortunately (as far as I’m concerned), the language is almost entirely IT-related. That, to me, represents an opportunity squandered: ISO27k covers more than IT/cybersecurity. How are organisations meant to handle incidents such as fraud and piracy where the IT elements are incidental to the business? Explicitly describing the information risks that the incident management process addresses would enhance this standard, I feel. Since it is literally impossible to detect and respond to every single incident, a proportion of the risk has to be accepted (e.g. ‘low and slow’ attacks fly under the radar, while many hacks and malware attacks involve deliberately evading or neutralising both detective and preventive controls), while some might be shared with third parties (e.g. business partners and insurers) or avoided (e.g. by putting even more emphasis on preventive controls). Also, the response to a major incident may well involve invoking business continuity arrangements, hence this standard should in my opinion integrate with or properly cite ISO 22301 etc. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27033-5 ISO/IEC 27033-5:2013 Information technology — Security techniques — Network security — Part 5: Securing communications across networks using Virtual Private Networks (VPNs) (first edition) Up Abstract ISO/IEC 27033 part 5 “gives guidelines for the selection, implementation, and monitoring of the technical controls necessary to provide network security using Virtual Private Network (VPN) connections to interconnect networks and connect remote users to networks.” [Source: ISO/IEC 27033-5:2013] Introduction ISO/IEC 27033-5 revised ISO/IEC 18028 part 5. It extends the IT security management guidelines of ISO/IEC TR 13335 by detailing the specific operations and mechanisms needed to implement network security safeguards and controls in a wider range of network environments, providing a bridge between general IT security management issues and network security technical implementations. It provides guidance for securing remote access over public networks. Scope The standard guides network administrators and technicians who plan to make use of this kind of connection, or who already have it in use and need advice on how to set it up securely and operate it securely. Structure Main clauses: 6: Overview 7: Security threats 8: Security requirements 9: Security controls 10: Design techniques 11: Guidelines for product selection Status ISO/IEC 27033-5 revised and replaced ISO/IEC 18028-5 . The current first edition of part 5 was published in 2013 and confirmed unchanged in 2019 and again in 2025. Commentary Gives a high-level, incomplete assessment of the threats to VPNs i.e. it mentions the threats of intrusion and denial of service ... but not unauthorized monitoring/interception, traffic analysis, data corruption, insertion of bogus traffic, various attacks on VPN end points, malware, masquerading/identity theft, insider threats etc ., although these are mentioned or at least hinted-at later under security requirements. Introduces different types of remote access including protocols, authentication issues and support when setting up remote access securely. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27404 ISO/IEC 27404:2025 — Cybersecurity — IoT security and privacy — Cybersecurity labelling framework for consumer IoT [first edition] Up Abstract ISO/IEC 27404 "defines a cybersecurity labelling framework for the development and implementation of cybersecurity labelling programmes for consumer IoT products. It provides requirements and includes guidance on the following topics: Risks and threats associated with consumer IoT products; Stakeholders, roles and responsibilities; Relevant standards and guidance documents; Conformity assessment; Labelling issuance and maintenance; Mutual recognition. [ISO/IEC 27404] is limited to consumer IoT products, such as: IoT gateways, base stations and hubs to which multiple devices connect; smart cameras, televisions, and speakers; wearable devices; connected smoke detectors, door locks and window sensors; connected home automation and alarm systems; connected appliances, such as washing machines and fridges; smart home assistants; and connected children’s toys and baby monitors. Products that are not intended for consumer use are excluded from this standard. Examples of excluded devices are those that are primarily intended for manufacturing, healthcare and other industrial purposes. [ISO/IEC 27404] is applicable to consumers, developers, issuing bodies of cybersecurity labels and conformity assessment bodies.” [Source: ISO/IEC 27404:2025 ] Introduction Although cybersecurity is seldom promoted as a feature of consumer-oriented IoT devices (things ), it can be important. Inconsistent and unclear cybersecurity labelling does not help consumers appreciate their security and privacy objectives, nor evaluate and select things accordingly. Standardising the cybersecurity labelling of things is intended to improve consistency across the global market, increase consumer awareness and promote better cybersecurity designs. Scope The standard concerns consumer-grade (retail) things - as opposed to business, industrial, engineering, medical, scientific or mil-spec things (since their cybersecurity requirements and features/capabilities are more likely to be specified in detail). It covers cybersecurity and privacy but excludes safety aspects. Structure Main clauses: 5: Overview of cybersecurity labelling for consumer IoT 6: International alignment through a cybersecurity labelling framework 7: Requirements and guidance for the components of the cybersecurity labelling framework for consumer IoT 8: Requirements and guidance for labelling issuance and maintenance for consumer IoT Annex A: types and features of cybersecurity labels Annex B: illustrative examples of multi-level labelling schemes Annex C: illustrative examples of binary labelling schemes Annex D: determination of equivalency among labelling schemes Annex E: examples of cybersecurity baseline provisions Annex F: examples of secure-by-design provisions Annex G: examples of privacy assessment requirements Status The current first edition was published in 2025 . Commentary Singapore standard TR 91:2021 Cybersecurity labelling for consumer IoT formed the original basis or donor content for this standard, with editorial changes to suit the more formal ISO/IEC style. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27045 ISO/IEC 27045 — Information technology — Big data security and privacy — Guidelines for managing big data risks [DRAFT] Up Abstract ISO/IEC 27045 "provides guidance on how to navigate the threats that can arise during the big data life cycle from the various big data characteristics that are unique to big data: volume, velocity, variety, variability, volatility, veracity and value, including when using big data for the design and implementation of AI systems. [ISO/IEC 27045] can help organizations build or enhance their big data security and privacy capabilities, including when using big data in the development and use of AI systems.” [Source: ISO/IEC JTC 1/SC 27 Committee Doc 11 May 2025] Introduction ‘Big data’ systems present numerous information security, privacy and technological challenges due to complexity plus the sheer quantity and volatility of the data. Scope The standard is intended to help organisations build or enhance their information security and privacy capabilities relating to big data systems, perhaps as part of AI systems design and implementation. Structure Main clauses: 4: Overview - a brief summary. 5: Big data - explores the information risk and security implications of big data in addition to the 'traditional' concerns for conventional IT systems. Describes the seven v's. 6: Security and privacy threats and controls to big data - stepping through the seven 'v ' characteristics of big data (v olume, v elocity, v ariety, v ariability, v olatility, v eracity and v alue), identifying pertinent threats and controls. 7: Big data risk management process - builds on the guidance in ISO/IEC 27005 . Annex A: maps the organisational and technological controls from clause 6 against the threats relating to the seven v's. Annex B: use cases . Status This standard was initially proposed in 2017. Having run off-the-rails in 2021, the drafting project re-started in 2024. It is currently at F inal D raft I nternational S tandard stage and (if approved) may be published towards the end of 2026 or early 2027. Commentary The definition of ‘big data’ quoted from ISO/IEC 20456:2019 does not (in my personal, rather jaundiced/cynical opinion) reflect its widespread use in the IT industry at present. “Extensive datasets primarily in the characteristics of volume, variety, velocity, and/or variability that require a scalable architecture for efficient storage, manipulation, and analysis ”. I prefer Wikipedia ’s description: “Current usage of the term big data tends to refer to the use of predictive analytics, user behavior analytics, or certain other advanced data analytics methods that extract value from data, and seldom to a particular size of data set. "There is little doubt that the quantities of data now available are indeed large, but that's not the most relevant characteristic of this new data ecosystem." Analysis of data sets can find new correlations to "spot business trends, prevent diseases, combat crime and so on." Scientists, business executives, practitioners of medicine, advertising and governments alike regularly meet difficulties with large data-sets in areas including Internet searches, fintech, urban informatics, and business informatics. Scientists encounter limitations in e-Science work, including meteorology, genomics, connectomics, complex physics simulations, biology and environmental research.” It seems to me a defining characteristic is that big data is (are!) so big that conventional database management systems are unable to cope with the complexity and dynamics/volatility, struggling to maintain integrity given so many coincident changes. Beyond the limits of their scalability, conventional architectures start to experience constraints and failures (including security control and privacy issues), no matter how much raw CPU power, network bandwidth and storage capacity is thrown at the challenge. That implies the need for fundamentally different approaches with novel information risks most likely requiring novel controls. It remains to be seen what this standard will actually recommend: this is cutting-edge stuff. Hopefully this standard will refer to others for the low-level and relatively conventional data security and privacy controls that apply to small and medium data, focusing instead on the high-level and novel aspects and processes that are unique to big data e.g. : Strategic management of big data sets, big data systems etc. , including governance arrangements to monitor and control the management and operational activities as a whole (e.g. overall programme as well as individual project management) and the business/strategy aspects and requirements (e.g. enormous financial investment in huge systems implies enormous expected returns); Architecture and design of big data systems - specifically the data security and privacy aspects including information risk assessment, compliance, ethics, data aggregation, inference, interconnectivity (both within and without the organisation), access controls, metadata management and security, resilience etc. ; Operation and use of big data systems e.g . how to classify and segregate data and functions, how to determine/define and assign access rights/permissions, what privacy and security roles and responsibilities might be appropriate; Maintenance and support of big data systems, including their security and privacy aspects; Capacity and performance management including the dynamics and challenges arising; Incident management, change management and so on (adapting conventional processes for the big data environment). Potentially, the standard could get into advanced/novel data/system security controls and privacy approaches involving artificial intelligence, instrumentation, anomaly and fraud detection, automated responses etc. ... but it looks as if the standard’s initial release will be a more modest starting point, and fair enough. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27503 ISO/IEC 27503 — Privacy and security guidelines on intelligent travel services [ P reliminary W ork I tem] Up Abstract ?? Introduction ?? Scope ?? Structure ?? Status A P reliminary W ork I tem was made available to ISO/IEC JTC 1/SC 27 in 2026. There is no information yet about this standard on ISO.org Commentary ISO/IEC JTC 1/SC 27/WG 5 is studying the information security and privacy aspects of 'intelligent travel services'. The PWI seems to be referring to Uber, Lyft and the like i.e. commercial ride-sharing schemes for road travel but I'm definitely not sure and may well be completely wrong about that. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27562 ISO/IEC 27562:2024 — Information technology — Security techniques — Privacy guidelines for fintech services (first edition) Up Abstract ISO/IEC 27562 "provides guidelines on privacy for fintech services. It identifies all relevant business models and roles in consumer-to-business relations and business-to-business relations, as well as privacy risks and privacy requirements, which are related to fintech services. It provides specific privacy controls for fintech services to address privacy risks. [ISO/IEC 27562] is based on the principles from ISO/IEC 29100, ISO/IEC 27701, and ISO/IEC 29184, the privacy impact assessment framework described in ISO/IEC 29134, and the risk management guideline described in ISO 31000. It also provides guidelines focusing on a set of privacy requirements for each stakeholder. [ISO/IEC 27562] can be applicable to all kinds of organizations such as regulators, institutions, service providers and product providers in the fintech service environment.” [Source: ISO/IEC 27562:2024 ] Introduction ”Fintech” (a contraction of fin ancial tech nology, formally defined by the standard as “digital innovations and technology-enabled business model innovations in the financial sector” ) refers to the use of information and communications technology within the financial services industry - banking, insurance, investment etc . - in particular, for financial services delivered digitally. A significant amount of personal information is processed by fintech. Personal information is subject to an array of privacy laws and regulations as well as corporate privacy policies and ethical considerations, all of which help ensure the trustworthiness necessary to earn the trust of data subjects (customers). Modern fintech architectures increasingly involve novel technologies such as cloud-based microservices with A pplication P rogramming I nterfaces, blockchain and A rtificial I ntelligence/M achine L earning. In addition to the usual data/IT/cyber security risks and controls, privacy concerns must also be identified, evaluated and addressed Scope The standard addresses the privacy aspects of fintech. Structure Main clauses: 5: Stakeholders and general considerations for fintech services 6: General principles applicable to fintech services 7: Actors in fintech services 8: Privacy risks to actors 9: Privacy controls for actors 10: Privacy guidelines for actors Annex A: Purpose of collecting and processing PII Annex B: Examples of international and regional regulations Annex C: Example of open platform architecture for fintech service providers Annex D: Use cases for fintech services Annex E: List of common vulnerabilities and privacy risks Annex F: Characteristics of AI-related PII processing for fintech services Status The current first edition was published in 2024 . Commentary I am unclear whether/why the financial services technology industry requires specific guidance on privacy that is not already available in other standards, laws and regulations. What makes fintech privacy special, I wonder? Should we anticipate similar privacy standards for healthtech, govtech, agritech and othertech? Even within fintech, what about safety, information security, security generally and governance, aside from privacy? Where does it all end? A particular concern for the already heavily-regulated financial services industry is the potential additional compliance burden if regulators start using this standard as a mandatory set of privacy control requirements. There are lots of controls in this standard, some quite complex and costly to design, implement, operate, manage and maintain. The details are devilish. On the upside, guidance on the application of AI/ML technologies within financial services is timely. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27701 ISO/IEC 27701:2025 — Information security, cybersecurity and privacy protection — Privacy information management systems — Requirements and guidance (second edition) Up Abstract “ISO/IEC 27701 is an international standard that sets out requirements for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It also provides guidance to support organisations in putting these requirements into practice. The standard is designed for personally identifiable information (PII) controllers and processors, who hold responsibility and accountability for processing PII.” [Source: ISO/IEC 27701:2025 ] Introduction ISO/IEC 27701 applies the conventional ISO ‘management system’ structure and terminology (as laid out in the ISO Directives ) to privacy, or more precisely the protection of P ersonally I dentifiable I nformation. Whereas the first edition of this standard described a P rivacy I nformation M anagement S ystem as an extension to an I nformation S ecurity M anagement S ystem, the current second edition formally severed that dependency. A PIMS can now be an independent, standalone governance and management structure ... that just happens to resemble ISO’s other management systems. However it can still be aligned or integrated (to some extent) with an ISMS or indeed others, with pros (such as reducing unnecessary duplication) and cons (such as increasing complexity). Conformity to ISO/IEC 27701 can be assessed and certified using ISO/IEC 27706 . Scope The standard specifies a P rivacy I nformation M anagement S ystem applicable to both controllers and processors of P ersonally I dentifiable I nformation. Although the standard ostensibly concerns ‘privacy’, in practice it focuses primarily on protecting PII against risks, more precisely still it concerns cybersecurity risks and controls for personal data in the IT context. Other/peripheral aspects of privacy (such as ‘personal space’ and ‘freedom of expression’) are not covered. Structure Main clauses: 4: Context of the organization - understanding internal (corporate) and external stakeholder requirements 5: Leadership - governing, driving and controlling the organisation's privacy arrangements 6: Planning - PIMS objectives, privacy policy 7: Support - privacy administration and documentation 8: Operation - systematically managing privacy risks 9: Performance evaluation - metrics and assurance 10: Improvement - feedback driving maturity 11: Further information on annexes Annex A: PIMS reference control objectives and controls for PII controllers and PII processors - a generic privacy control catalogue similar to Annex A of ISO/IEC 27001 Annex B: Implementation guidance for PII controllers and PII processors - advice on building the PIMS Annex C: Mapping to ISO/IEC 29100 Annex D: Mapping to the General Data Protection Regulation Annex E: Mapping to ISO/IEC 27018 and ISO/IEC 29151 Annex F: Correspondence with ISO/IEC 27701:2019 Bibliography - further reading Status The first edition, published in 2019 , specified PIMS as an extension to an ISMS. The current second edition, published in 2025 , specifies PIMS as a standalone management system. Commentary ISO27k practitioners will surely recognise the cyclical, risk-based approach: Identify privacy-related risks; Assess and evaluate them; Decide how to treat them (what, if anything, to do about them); Treat them (implement the risk-treatment decisions); Lather, rinse, repeat. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27553-2 ISO/IEC 27553-2:2025 — Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 2: remote modes (first edition) Up Abstract ISO/IEC 27553 part 2 "provides high-level security and privacy requirements for authentication using biometrics on mobile devices, in particular, for functional components, communication, storage and remote processing. [The standard] is applicable to remote modes, i.e. the cases where: the biometric sample is captured through mobile devices, and the biometric data or derived biometric data are transmitted between the mobile devices and the remote services in either or both directions. The following are out of scope of this document: the cases where the biometric data or derived biometric data never leave the mobile devices (i.e. local modes), the preliminary steps for biometric enrolment before authentication procedure, and the use of biometric identification as part of the authentication.” [Source: ISO/IEC 27553-2:2025 ] Introduction Part 2 provides high-level requirements for situations where biometric authentication on mobile devices involves communicating biometric data over the network to a remote authentication server. Scope Biometric authentication on mobile devices where biometric information is communicated between the devices and remote services via network connections, as opposed to local modes where the authentication process and data are limited to the devices. The standard is restricted to authentication, excluding enrolment and identification. Structure Main clauses: 5: Security and privacy considerations 6: System description 7: Information assets 8: Threat analysis 9: Security requirements and recommendations 10: Privacy considerations, requirements and recommendations Annex A: Implementation example Annex B: Authentication assurance and assurance level Status The current first edition was published in 2025 . Commentary Involvement of remote services in the authentication process implies network data communication with associated confidentiality, integrity and availability implications, as well as risks relating to the remote storage and processing (such as aggregating, correlating and comparing biometric and other data between various remote and networked systems to glean additional information). Not being a S ubject M atter E xpert in authentication, specifically, I am intrigued by obscure terms such as “synthesized wolf biometric samples” and “hill climbing attack”. Presumably these are covered by the numerous cited standards and familiar to authentication SMEs. It would be challenging to adopt ISO’s version of plain English for such a technical standard. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC TS 27008 ISO/IEC TS 27008:2019 — Information technology — Security techniques — Guidelines for the assessment of information security controls (second edition) Up Abstract ISO/IEC TS 27008 "provides guidance on reviewing and assessing the implementation and operation of information security controls, including the technical assessment of information system controls, in compliance with an organisation's established information security requirements including technical compliance against assessment criteria based on the information security requirements established by the organisation. [ISO/IEC TS 27008] offers guidance on how to review and assess information security controls being managed through an Information Security Management System specified by ISO/IEC 27001. It is applicable to all types and sizes of organisations, including public and private companies, government entities, and not-for-profit organisations conducting information security reviews and technical compliance checks.” [Source: ISO/IEC TS 27008:2019] Introduction This standard (a T echnical S pecification) on “technical auditing” complements ISO/IEC 27007 . It is focused on auditing the information security controls (or rather the “technical controls”, which although undefined evidently means IT security or cybersecurity controls). In contrast, ISO/IEC 27007 is more concerned with the management system . Scope ISO/IEC TS 27008 provides guidance for all auditors/assessors regarding “information security management systems controls” [sic ] selected through a risk-based approach (e.g . as presented in a S tatement o f A pplicability) for information security management. It supports the information risk management process and internal, external and third-party audits of an ISMS by explaining the relationship between the ISMS and its supporting controls. It provides guidance on how to verify the extent to which the organisation’s "necessary ISMS controls” satisfy its control objectives. Furthermore, it supports any organisation using ISO/IEC 27001 and ISO/IEC 27002 to satisfy assurance requirements, and as a strategic platform for the governance and management of information risk and security. Structure Main clauses: 5: Background 6: Overview of information security control assessments 7: Review methods 8: Control assessment process Annex A: Initial information gathering (other than IT) Annex B: Practice guide for technical security assessments Annex C:Technical assessment guide for cloud services (Infrastructure as a Service) With over 100 pages, this is a substantial standard. Status The first edition was published in 2011 as ISO/IEC TR 27008:2011, a Type 2 T echnical R eport. It set out to provide “Guidelines for auditors on information security controls”. The current second edition was published in 2019 as ISO/IEC TS 27008:2019, a T echnical S pecification reflecting the 2013 versions of ISO/IEC 27001 and ISO/IEC 27002 . The title morphed into “Guidelines for the assessment of information security controls”, dropping the explicit reference to auditing. The third edition is in preparation, being revised to reflect ISO/IEC 27002:2022 . It will revert to a T echnical R eport. It is at D raft T echnical R eport stage, likely to emerge during 2026. Commentary ISO/IEC TS 27008 gives technology auditors background knowledge to help them review and evaluate the information security controls being managed through an I nformation S ecurity M anagement S ystem - or indeed any other structured governance approach (e.g. NIST's C yber S ecurity F ramework, or GDPR and NIS2 from Europe). The current second edition: Is applicable to organisations of all types and sizes; Supports planning and execution of ISMS audits and the information risk management process; Further adds value and enhances the quality and benefit of the ISO27k standards by closing the gap between reviewing the ISMS in theory and, when needed, verifying evidence of implemented ISMS controls (e.g . in the ISO27k user organisations, assessing security elements of business processes, IT systems and IT operating environments); Provides guidance for auditing information security controls based on the controls guidance in ISO/IEC 27002:2013 ; Improves ISMS audits by optimizing the relationships between the ISMS processes and required controls (e.g. mechanisms to limit the harm caused by failures in the protection of information - erroneous financial statements, incorrect documents issued by an organisation and intangibles such as reputation and image of the organisation and privacy, skills and experience of people); Supports an ISMS-based assurance and information security governance approach and audit thereof [?? That strays from the standard’s scope into the area of management systems auditing]; Supports effective and efficient use of audit resources, including the enhancement of technology auditors' skills, competence and knowledge. Whereas ISO/IEC 27007 focuses on auditing the management system elements of an ISMS as described in ISO/IEC 27001 , ISO/IEC TS 27008 focuses on checking the information security controls themselves, such as (for example) those as in Annex A of ISO/IEC 27001 . ISO/IEC TS 27008 “focuses on reviews of information security controls, including checking of technical compliance, against an information security implementation standard, which is established by the organisation. It does not intend to provide any specific guidance on compliance checking regarding measurement, risk assessment or audit of an ISMS as specified in ISO/IEC 27004 , ISO/IEC 27005 or ISO/IEC 27007 respectively.” 'Technical compliance checking/auditing' is explained as a process of examining ‘technical’ security controls, interviewing those associated with the controls (managers, technicians, users etc. ) and testing the controls. The methods should be familiar to experienced technology auditors. ‘Technical’ controls, while not explicitly defined in the standard, appear to be what are commonly known as IT security, cybersecurity or technological controls, in other words a subset of the information security controls listed in ISO/IEC 27001 Annex A and described in ISO/IEC 27002 . Furthermore, the correct term here is conformity, not compliance, since it is discretionary. But I digress. Liberal use of “technical” in phrases such as “technical compliance checking of information system controls”, “technical assessment” and “technical security controls”, indicates that this standard is concerned with technology , implying IT or data or cyber security, specifically, rather than information risk and security in general. While this standard is not intended to be used for certification, it remains inconsistent and ambiguous (frankly, unclear and confusing) in the use of key terms such as: review, assessment, test, validation, check and audit. For example, are “information security auditors” the same as “certification auditors”, “IT auditors”, “internal auditors”, “ISMS internal auditors”, “compliance auditors”, “conformity auditors”, or something else? There are no (zero) definitions in the second edition since all terms are supposedly defined in ISO/IEC 27000 : concerning that little list of terms, only “audit”, “information security” and “conformity” are defined, separately. “Risk assessment” is specifically defined but not “assessment” in general. So, conventional dictionary definitions presumably apply ... but don’t really help. For an international standard, it could hardly be more muddled. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27014 ISO/IEC 27014:2020 / ITU-T X.1054 — Information security, cybersecurity and privacy protection — Governance of information security (second edition) Up Abstract ISO/IEC 27014 "provides guidance on concepts, objectives and processes for the governance of information security, by which organisations can evaluate, direct, monitor and communicate the information security-related processes within the organisation. The intended audience for [ISO/IEC 27014] is: governing body and top management; those who are responsible for evaluating, directing and monitoring an information security management system (ISMS) based on ISO/IEC 27001; those responsible for information security management that takes place outside the scope of an ISMS based on ISO/IEC 27001, but within the scope of governance. [ISO/IEC 27014] is applicable to all types and sizes of organisations. All references to an ISMS in [ISO/IEC 27014] apply to an ISMS based on ISO/IEC 27001. [ISO/IEC 27014] focuses on the three types of ISMS organisations given in Annex B. However, [ISO/IEC 27014] can also be used by other types of organisations.” [Source: ISO/IEC 27014:2020/ITU-T X.1054] Introduction This standard, produced by ISO/IEC JTC 1/SC 27 in collaboration with the I nternational T elecommunications U nion’s T elecommunication Standardization Sector (ITU-T), is specifically aimed at helping organisations govern their information security arrangements . Scope ISO/IEC 27014 “provides guidance on concepts, objectives and processes for the governance of information security, by which organisations can evaluate, direct, monitor and communicate the information security-related processes within the organisation.” In a nutshell, through sound governance arrangements, information security management achieves business objectives - a very important and powerful concept. As with other ISO27k standards , it is “applicable to all types and sizes of organisations”, particularly those with one or more ISO 27001 -style ISMSs encompassing either the entirety or certain parts of the organisation, or where a single ISMS applies across several businesses or business units (e.g . within a group structure). Structure Main clauses: 6: Governance and management standards e.g. ISO/IEC 27001 and 38500. 7: Entity governance and information security governance - 6 objectives and 4 processes 8: The governing body’s requirements on the ISMS Annex A: Governance relationship Annex B: Types of ISMS organization - e.g. multiple or shared ISMSs in group structures Annex C: Examples of communication - a couple of situations where information security governance may need to be disclosed The standard explains four “processes” (key aspects of governance): Evaluation: senior management considers proposals and plans for information security management (e.g. "We will adopt an ISO27001 ISMS"); Direction: preparing strategies, policies and objectives for information security that align with and support the achievement of the organisation’s business objectives (e.g. “It is imperative that we both protect and exploit valuable information”); Monitoring the performance of information security through management information flows and internal reporting arrangements (e.g. “We track the following security metrics: ...”); Communication: ensures that all those within the organisation who are actively involved in directing, overseeing, driving, guiding and monitoring information security are 'singing from the same hymn sheet', while external stakeholders (such as its owners and regulatory authorities) are assured that information risk is being competently managed. It also lays out six information security objectives that the governance and management arrangements should satisfy: Establish integrated comprehensive entity-wide information security since the information at risk exists and is legitimately exploited, and hence deserves protection, throughout the organisation; Make decisions using a risk-based approach - fundamental to all the ISO27k standards and at all levels of the ISMS from governance and strategy through management to routine operations (e.g . risk-assessing identified incidents to determine the priority and nature of the responses required); Set the direction of acquisition - as in corporate mergers and acquisitions, as opposed to procuring goods and services; Ensure conformance with internal and external requirements through assurance such as auditing of information security activities; Foster a security-positive culture - an excellent suggestion, albeit easier said than done; Ensure the security performance meets current and future requirements of the entity - there is a need for suitable management oversight, monitoring and measurement (metrics) in relation to current requirements, of course, but what about the future ? Food for thought here. Status The first edition was published jointly by ISO/IEC and ITU-T in 2013 , dual-numbered as ISO/IEC 27014 and ITU-T recommendation X.1054 with identical text. The second edition was published by ISO/IEC in 2020 and then separately by ITU-T, released as X.1054 (04/2-21) - a free PDF download in 2021. In conjunction with ITU-T, it seems work is under way in 2026 on a third edition - a minor editorial revision, updating references to cited standards and swapping the order of appendices A and B. Commentary ISO/IEC 27014 refers to ‘information risk management ’ - a minor but important distinction from the usual terms ‘information security risk’ and ‘information security management’. Security (as in controls to reduce/mitigate risk) is not the only way to treat risks to information: they can also be avoided, shared and accepted. Personally, I wish the remaining ISO27k standards would adopt ‘information risk’ (defined along the lines of “risk pertaining to information”) in place of ‘information security risk’ (a term that is not actually defined as such) but, so far, SC 27 management has blocked the move and we have not had the opportunity to debate it. I am merely a lone, weak and tiring kayaker gently nudging ISO’s supertanker. In the course of drafting the second edition, SC 27 discussed the application of principles from ISO 38500 (“Corporate governance of IT”) to information security, and considered the relationship between information security governance and other governance and management disciplines. ISO/IEC 27014 refers to governance for information security as an integral part of the organisation’s corporate governance with strong links to IT governance, but is arguably a bit vague on the details. The definition of ‘governing body’ obliquely notes that, along with ‘executive management’, both are parts of ‘top management’ which ISO/IEC 27000 defines as “the person or group of people who directs and controls an organisation at the highest level”. In essence, the standard hints that senior managers can have distinct or separable governance (strategic direction-setting) and hands-on executive management roles. The summary points out that the standard “provides the mandate essential for driving information security initiatives throughout the organisation.” At present, this is typically achieved in part by senior management mandating an overarching organisation-wide information security policy that is supported and amplified by lower level security policies, standards, procedures, guidelines and other security awareness materials. The standard does not go into depth on other related aspects such as the information security, risk and compliance management structures, reporting lines, divisions of responsibility, delegated authorities and so forth, largely I guess because of the differences between organisations. As an information security professional with a keen interest in security awareness , I am gratified to note that, in order to “establish a positive information security culture, the governing body should require, promote and support coordination of stakeholder activities to achieve a coherent direction for information security. This will support the delivery of security education, training and awareness programs.” ‘A coherent direction’ indeed. Nice idea. I approve. ISO 37000:2021 “Guidance for the governance of organisations” could be the basis for updating ISO/IEC 27014 to utilise common concepts and terms. Maybe. At some point. Up Up Up This page last updated: 10 July 2026