voodoo Aron Lange
@aron-lange
ISO 27000
Family of Standards
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Security techniques — Information security
ISO/IEC 27000 2018 Published
management systems — Overview and vocabulary
Information technology — Security techniques — Information security
ISO/IEC 27001 2013 Published
management systems — Overview and vocabulary
Information security, cybersecurity and privacy protection — Information
ISO/IEC DIS 27001 2022 Under development
security management systems — Requirements
Information security, cybersecurity and privacy protection — Information
ISO/IEC 27002 2022 Published
security controls
Information technology — Security techniques — Information security
ISO/IEC 27003 2017 Published
management systems — Guidance
Information technology — Security techniques — Information security
ISO/IEC 27004 2016 Published
management — Monitoring, measurement, analysis and evaluation
Information technology — Security techniques — Information security risk
ISO/IEC 27005 2018 Published
management
2 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information security, cybersecurity and privacy protection — Guidance on
ISO/IEC FDIS 27005 2022 Under development
managing information security risks
Requirements for bodies providing audit and certification of information
ISO/IEC DIS 27006-1 ? Under development
security management systems — Part 1: General
Requirements for bodies providing audit and certification of information
ISO/IEC CD 27006-2 ? Under development security management systems — Part 2: Privacy information management
systems
Requirements for bodies providing audit and certification of information
ISO/IEC TS 27006-2 2021 Published security management systems — Part 2: Privacy information management
systems
Information technology — Security techniques — Requirements for bodies
ISO/IEC 27006 2015 Published providing audit and certification of information security management
systems
Information security, cybersecurity and privacy protection — Guidelines for
ISO/IEC 27007 2020 Published
information security management systems auditing
Information technology — Security techniques — Guidelines for the
ISO/IEC TS 27008 2019 Published
assessment of information security controls
3 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information security, cybersecurity and privacy protection — Sector-specific
ISO/IEC 27009 2020 Published
application of ISO/IEC 27001 — Requirements
Information technology — Security techniques — Information security
ISO/IEC 27010 2015 Published
management for inter-sector and interorganizational communications
Information technology — Security techniques — Code of practice for
ISO/IEC 27011 2016 Published Information security controls based on ISO/IEC 27002 for
telecommunications organizations
Information security, cybersecurity and privacy protection — Information
ISO/IEC CD 27011.2 ? Under development security controls based on ISO/IEC 27002 for telecommunications
organizations
Information security, cybersecurity and privacy protection — Guidance on
ISO/IEC 27013 2021 Published
the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1
Information security, cybersecurity and privacy protection — Governance of
ISO/IEC 27014 2020 Published
information security
Information technology — Security techniques — Information security
ISO/IEC TR 27016 2014 Published
management — Organizational economics
4 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Security techniques — Code of practice for
ISO/IEC 27017 2015 Published
information security controls based on ISO/IEC 27002 for cloud services
Information technology — Security techniques — Code of practice for
ISO/IEC 27018 2019 Published protection of personally identifiable information (PII) in public clouds acting
as PII processors
Information technology — Security techniques — Information security
ISO/IEC 27019 2017 Published
controls for the energy utility industry
Information technology — Security techniques — Competence
ISO/IEC 27021 2017 Published
requirements for information security management systems professionals
Information technology — Guidance on information security management
ISO/IEC TS 27022 2021 Published
system processes
Information technology — Security techniques — Mapping the revised
ISO/IEC TR 27023 2015 Published
editions of ISO/IEC 27001 and ISO/IEC 27002
ISO/IEC 27001 family of standards references list — Use of ISO/IEC 27001
ISO/IEC AWI TR 27024 ? Under development
family of standards in Governmental / Regulatory requirements
5 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Security techniques — Guidelines for information
ISO/IEC 27031 2011 Published
and communication technology readiness for business continuity
Information technology — Cybersecurity — Information and communication
ISO/IEC WD 27031 ? Under development
technology readiness for business continuity
Information technology — Security techniques — Guidelines for
ISO/IEC 27032 2012 Published
cybersecurity
ISO/IEC DIS 27032 ? Under development Cybersecurity — Guidelines for Internet security
Information technology — Security techniques — Network security — Part
ISO/IEC 27033-1 2015 Published
1: Overview and concepts
Information technology — Security techniques — Network security — Part
ISO/IEC 27033-2 2012 Published
2: Guidelines for the design and implementation of network security
Information technology — Security techniques — Network security — Part
ISO/IEC 27033-3 2010 Published 3: Reference networking scenarios — Threats, design techniques and
control issues
6 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Security techniques — Network security — Part
ISO/IEC 27033-4 2014 Published
4: Securing communications between networks using security gateways
Information technology — Security techniques — Network security — Part
ISO/IEC 27033-5 2013 Published 5: Securing communications across networks using Virtual Private Networks
(VPNs)
Information technology — Security techniques — Network security — Part
ISO/IEC 27033-6 2016 Published
6: Securing wireless IP network access
Information technology – Network security — Part 7: Guidelines for network
ISO/IEC CD 27033-7 ? Under development
virtualization security
Information technology — Security techniques — Application security —
ISO/IEC 27034-1 2011 Published
Part 1: Overview and concepts
Information technology — Security techniques — Application security —
ISO/IEC 27034-2 2015 Published
Part 2: Organization normative framework
Information technology — Application security — Part 3: Application
ISO/IEC 27034-3 2018 Published
security management process
7 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Security techniques — Application security —
ISO/IEC 27034-5 2017 Published
Part 5: Protocols and application security controls data structure
Information technology — Security techniques — Application security —
ISO/IEC 27034-6 2016 Published
Part 6: Case studies
Information technology — Application security — Part 7: Assurance
ISO/IEC 27034-7 2018 Published
prediction framework
Information technology — Application security — Part 5-1: Protocols and
ISO/IEC TS 27034-5-1 2018 Published
application security controls data structure, XML schemas
Information technology — Security techniques — Information security
ISO/IEC 27035-1 2016 Published
incident management — Part 1: Principles of incident management
Information technology – Information security incident management — Part
ISO/IEC DIS 27035-1 ? Under development
1: Principles and process
Information technology — Security techniques — Information security
ISO/IEC 27035-2 2016 Published incident management — Part 2: Guidelines to plan and prepare for incident
response
8 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Information security incident management —
ISO/IEC DIS 27035-2 ? Under development
Part 2: Guidelines to plan and prepare for incident response
Information technology — Information security incident management —
ISO/IEC 27035-3 2020 Published
Part 3: Guidelines for ICT incident response operations
Information technology — Information security incident management —
ISO/IEC CD 27035-4 ? Under development
Part 4: Coordination
ISO/IEC 27036-1 2021 Published Cybersecurity — Supplier relationships — Part 1: Overview and concepts
Information technology — Security techniques — Information security for
ISO/IEC 27036-2 2014 Published
supplier relationships — Part 2: Requirements
ISO/IEC 27036-2 2022 Under development Cybersecurity — Supplier relationships — Part 2: Requirements
Information technology — Security techniques — Information security for
ISO/IEC 27036-3 2013 Published supplier relationships — Part 3: Guidelines for information and
communication technology supply chain security
9 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Cybersecurity — Supplier relationships — Part 3: Guidelines for hardware,
ISO/IEC DIS 27036-3 ? Under development
software, and services supply chain security
Information technology — Security techniques — Information security for
ISO/IEC 27036-4 2016 Published
supplier relationships — Part 4: Guidelines for security of cloud services
Information technology — Security techniques — Guidelines for
ISO/IEC 27037 2012 Published
identification, collection, acquisition and preservation of digital evidence
Information technology — Security techniques — Specification for digital
ISO/IEC 27038 2014 Published
redaction
Information technology — Security techniques — Selection, deployment and
ISO/IEC 27039 2015 Published
operations of intrusion detection and prevention systems (IDPS)
ISO/IEC 27040 2015 Published Information technology — Security techniques — Storage security
ISO/IEC DIS 27040 ? Under development Information technology — Security techniques — Storage security
10 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Security techniques — Guidance on assuring
ISO/IEC 27041 2015 Published
suitability and adequacy of incident investigative method
Information technology — Security techniques — Guidelines for the analysis
ISO/IEC 27042 2015 Published
and interpretation of digital evidence
Information technology — Security techniques — Incident investigation
ISO/IEC 27043 2015 Published
principles and processes
Information technology — Big data security and privacy — Implementation
ISO/IEC WD 27046.4 ? Under development
guidelines
Information technology — Electronic discovery — Part 1: Overview and
ISO/IEC 27050-1 2019 Published
concepts
Information technology — Electronic discovery — Part 2: Guidance for
ISO/IEC 27050-2 2018 Published
governance and management of electronic discovery
Information technology — Electronic discovery — Part 3: Code of practice
ISO/IEC 27050-3 2020 Published
for electronic discovery
11 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information technology — Electronic discovery — Part 4: Technical
ISO/IEC 27050-4 2021 Published
readiness
Information technology — Security techniques — Requirements for
ISO/IEC 27070 2021 Published
establishing virtualized roots of trust
Cybersecurity — Security recommendations for establishing trusted
ISO/IEC DIS 27071 ? Under development
connections between devices and services
Information Technology — Public key infrastructure — Practices and policy
ISO/IEC FDIS 27099 ? Under development
framework
ISO/IEC TS 27100 2020 Published Information technology — Cybersecurity — Overview and concepts
ISO/IEC 27102 2019 Published Information security management — Guidelines for cyber-insurance
Information technology — Security techniques — Cybersecurity and ISO and
ISO/IEC TR 27103 2018 Published
IEC Standards
12 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
ISO/IEC AWI TR 27109 ? Under development Cybersecurity education and training
Information technology, cybersecurity and privacy protection —
ISO/IEC TS 27110 2021 Published
Cybersecurity framework development guidelines
ISO/IEC 27400 2022 Published Cybersecurity — IoT security and privacy — Guidelines
ISO/IEC 27402.2 ? Under development Cybersecurity — IoT security and privacy — Device baseline requirements
ISO/IEC CD 27403 ? Under development Cybersecurity – IoT security and privacy – Guidelines for IoT-domotics
Information technology — Security techniques — Privacy engineering for
ISO/IEC TR 27550 2019 Published
system life cycle processes
Information security, cybersecurity and privacy protection — Requirements
ISO/IEC 27551 2021 Published
for attribute-based unlinkable entity authentication
13 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
Information security, cybersecurity and privacy protection — Security and
ISO/IEC FDIS 27553-1 ? Under development Privacy requirements for authentication using biometrics on mobile devices
— Part 1: Local modes
ISO/IEC CD 27554 ? Under development Application of ISO 31000 for assessment of identity-related risk
Information security, cybersecurity and privacy protection — Guidelines on
ISO/IEC 27555 2021 Published
personally identifiable information deletion
Information technology — Information security, cybersecurity and privacy
ISO/IEC DIS 27557 ? Under development
protection — Organizational privacy risk management
ISO/IEC DIS 27559 ? Under development Privacy enhancing data de-identification framework
ISO/IEC AWI TS 27560 ? Under development Privacy technologies — Consent record information structure
Information technology — Security techniques — Privacy operationalisation
ISO/IEC CD 27561 ? Under development
model and method for engineering (POMME
14 Copyright © 2022 Aron Lange
#learnGRC
ISO 27000 Family of Standards
Name Revision Status Title
ISO/IEC WD 27562 ? Under development Privacy guidelines for fintech services
ISO/IEC DTR 27563 ? Under development Security and privacy in artificial intelligence use cases
ISO/IEC WD 27565 ? Under development Guidelines on privacy preservation based on zero knowledge proofs
ISO/IEC TS 27570 2021 Published Privacy protection — Privacy guidelines for smart cities
Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for
ISO/IEC 27701 2019 Published
privacy information management — Requirements and guidelines
15 Copyright © 2022 Aron Lange
