Information security standards

These standards cover security concepts and technologies, recommended policies and best practices to deal with an adverse event, and training and guidelines to implement the published standards. They may also include assessment criteria, a body to audit the implementation of these criteria, and certification for organizations implementing the recommended changes.

The principal objectives of these standards are to prevent or mitigate cyber-attacks, ensure consistency among developers, and establish a minimum standard in industries susceptible to an attack. They are published by various national and international bodies to help users and organizations enhance their cybersecurity posture and present a coordinated and structured response.

History

Cybersecurity standards have existed over several decades as users and providers have collaborated in many domestic and international forums to effect the necessary capabilities, policies, and practices – generally emerging from work at the Stanford Consortium for Research on Information Security and Policy in the 1990s.

A 2016 US security framework adoption study reported that 70% of the surveyed organizations use the NIST Cybersecurity Framework as the most popular best practice for Information Technology (IT) computer security, but many note that it requires significant investment. Cross-border, cyber-exfiltration operations by law enforcement agencies to counter international criminal activities on the dark web raise complex jurisdictional questions that remain, to some extent, unanswered. Tensions between domestic law enforcement efforts to conduct cross-border cyber-exfiltration operations and international jurisdiction will likely continue to provide improved cybersecurity norms.

4 more chapters are free with a Lably account.

International Standards

The subsections below detail international standards related to cybersecurity.

ISO/IEC 27000 Family of Standards

The ISO/IEC 27000 series is a family of international standards jointly published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). These standards provide a globally recognized framework for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The series is designed to help organizations of all sizes and industries protect their information assets systematically and cost-effectively.

At the center of the ISO/IEC 27000 series is ISO/IEC 27001, which specifies the requirements for establishing and maintaining an ISMS. The standard emphasizes a risk-based approach to managing information security, encouraging organizations to identify, assess, and mitigate risks specific to their operational environment. The ISO/IEC 27000 series is built upon the Plan-Do-Check-Act (PDCA) cycle, a methodology aimed at continuous improvement.

While ISO/IEC 27001 sets the baseline for ISMS requirements, other standards in the series provide complementary guidelines and sector-specific recommendations. Together, they form a comprehensive ecosystem that addresses everything from risk assessment and incident management to privacy controls and cloud security.

Supporting ISO/IEC 27001 is ISO/IEC 27002, which serves as a practical guide for implementing the controls outlined in ISO/IEC 27001. It provides detailed recommendations and best practices for managing information security risks across different domains, including human resource security, physical security, and network security.

For organizations focused on risk management, ISO/IEC 27005 offers a dedicated framework for identifying, assessing, and treating information security risks. It complements ISO/IEC 27001 by providing a methodology specifically tailored to managing information security vulnerabilities.

In recent years, cloud computing has introduced unique security challenges, and ISO/IEC 27017 was developed to address these concerns. This standard provides guidelines for implementing cloud-specific information security controls, ensuring secure use of cloud services by both cloud providers and customers. Alongside it, ISO/IEC 27018 focuses on protecting personally identifiable information (PII) in public cloud environments, helping organizations meet privacy regulations and maintain customer trust.

Additionally, ISO/IEC 27035 addresses incident management, offering guidance on how to effectively prepare for, detect, and respond to security incidents. It emphasizes structured incident response processes to minimize potential damage and ensure timely recovery.

With the rise of data privacy regulations such as the General Data Protection Regulation (GDPR), ISO/IEC 27701 was introduced as an extension of ISO/IEC 27001 and ISO/IEC 27002. This standard provides guidelines for establishing and operating a Privacy Information Management System (PIMS), aligning information security management with privacy and data protection requirements.

ISO/IEC 15408

The Common Criteria for Information Technology Security Evaluation (Common Criteria or CC) is an international standard (ISO/IEC 15408) used to assess and certify the security properties of IT products and systems. It provides a globally recognized framework for defining security requirements, implementing protective measures, and evaluating whether these measures meet specified criteria.

ISO/IEC 15408 is divided into five parts:

Part 1: Introduction and General Model – Defines key concepts, principles, and the general evaluation framework.
Part 2: Security Functional Components – Provides a catalog of security functional requirements (e.g., access control, encryption, and audit functions).
Part 3: Security Assurance Components – Specifies assurance levels (EAL1–EAL7), representing the depth and rigor of security evaluations.
Part 4: Framework for the specification of evaluation methods and activities – Details the methodology and framework for conducting security evaluations, including evaluator responsibilities and reporting requirements.
Part 5: Pre-defined Packages of Security Requirements – Offers reusable packages of security requirements, streamlining the evaluation process for common product types.

Certification under Common Criteria is facilitated by the Common Criteria Recognition Arrangement (CCRA), ensuring mutual recognition of certifications among participating countries. This reduces duplication of effort and cost for vendors seeking global market access.

The EU has adopted the European Cybersecurity Certification Scheme (EUCC), which is based on ISO/IEC 15408, to align with international standards while addressing regional requirements.

IEC 62443

The IEC 62443 cybersecurity standard defines processes, techniques and requirements for Industrial Automation and Control Systems (IACS). Its documents are the result of the IEC standards creation process where all national committees involved agree upon a common standard. All IEC 62443 standards and technical reports are organized into six general categories: General, Policies and Procedures, System, Component, Profiles, and Evaluation.

The first category includes foundational information such as concepts, models, and terminology.
The second category of work products targets the Asset Owner. These address various aspects of creating and maintaining an effective IACS security program.
The third category includes work products that describe system design guidelines and requirements for the secure integration of control systems. The core of this is the zone, conduit, and design model.
The fourth category includes work products that describe the specific product development and technical requirements of control system products.
The fifth category provides profiles for industry-specific cybersecurity requirements according to IEC 62443-1-5.
The sixth category defines assessment methodologies that ensure that assessment results are consistent and reproducible.

ISO/SAE 21434

ISO/SAE 21434 "Road vehicles - Cybersecurity engineering" is a cybersecurity standard jointly developed by ISO and SAE working groups. It proposes cybersecurity measures for the development lifecycle of road vehicles. The standard was published in August 2021.

The standard is related to the European Union (EU) regulation on cyber security that is currently being developed. In coordination with the EU, the UNECE has created a Cyber Security Management System (CSMS) certification mandatory for vehicle-type approval. This is defined in the overarching UN Regulation 155; ISO/SAE 21434 is a technical standard for automotive development which can demonstrate compliance with those regulations.

A derivative of this is in the work of UNECE WP29, which provides regulations for vehicle cybersecurity and software updates.

ETSI EN 303 645

The ETSI EN 303 645 standard provides a set of baseline requirements for security in consumer Internet of Things (IoT) devices. It contains technical controls and organizational policies for developers and manufacturers of Internet-connected consumer devices. The standard was released in June 2020 and is intended to complement other, more specific standards. As many consumer IoT devices handle personally identifiable information (PII), implementing the standard helps comply with the EU's General Data Protection Regulation (GDPR) in the EU.

The Cybersecurity provisions in this European standard are:

No universal default passwords
Implement a means to manage reports of vulnerabilities
Keep software updated
Securely store sensitive security parameters
Communicate securely
Minimize exposed attack surfaces
Ensure software integrity
Ensure that personal data is secure
Make systems resilient to outages
Examine system telemetry data
Make it easy for users to delete user data
Make installation and maintenance of devices easy
Validate input data

Conformance assessment of these baseline requirements is via the standard TS 103 701, which allows self-certification or certification by another group.

EN 18031

The EN 18031 series of standards, published by the European Committee for Standardization (CEN) in cooperation with the European Committee for Electrotechnical Standardization (CENELEC), outlines essential information security requirements for radio-based devices and systems. By aligning with the Radio Equipment Directive (2014/53/EU) and its accompanying Delegated Act, these standards support manufacturers and stakeholders in maintaining compliance and consistency across European markets. They also establish common testing protocols, performance criteria, and security guidelines, thereby aiding cross-border interoperability and addressing evolving industry needs.

National Standards

The subsections below detail national standards and frameworks related to cybersecurity.

NERC CIP

The North American Electric Reliability Corporation (NERC) is responsible for developing and enforcing cybersecurity standards to protect the reliability and security of the North American bulk power system, which spans the United States, Canada, and northern Baja California, Mexico.

Its standards focus on cybersecurity measures for critical assets, including asset identification, electronic security perimeters, personnel training, incident response, and recovery planning. The key cybersecurity standards are defined in the Critical Infrastructure Protection (CIP) series, specifically CIP-002 to CIP-014.

Compliance with these standards is mandatory for power system operators and owners under NERC’s jurisdiction, with enforcement overseen by the Federal Energy Regulatory Commission (FERC) in the United States. Non-compliance can result in significant financial penalties.

NIST Cybersecurity Standards

The National Institute of Standards and Technology (NIST), a U.S. federal agency under the Department of Commerce, plays a central role in developing and maintaining cybersecurity standards, guidelines, and best practices. Initially created to ensure the security of federal information systems, NIST's standards have become globally influential, serving as foundational references for cybersecurity programs across industries and countries.

NIST's approach emphasizes a risk-based methodology, focusing on five core functions: Identify, Protect, Detect, Respond, and Recover. These principles form the backbone of many of its guidelines and frameworks, enabling organizations to assess and manage cybersecurity risks effectively. While federal agencies are mandated to comply with NIST standards, private organizations across finance, healthcare, manufacturing, and other sectors often adopt them voluntarily due to their clarity, flexibility, and comprehensiveness.

The NIST Cybersecurity Framework (CSF)

One of NIST's most influential contributions is the Cybersecurity Framework (CSF), first published in 2014 and updated in 2024 (CSF 2.0). Developed in response to growing cyber threats and the need for standardized practices, the CSF provides a risk-based approach to managing cybersecurity risks. It is structured around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover, each representing a critical phase in cybersecurity risk management.

The CSF serves as a universal guide, designed to be adaptable across organizations of all sizes and sectors. Its adoption extends far beyond U.S. federal agencies, with companies worldwide leveraging the framework to improve their cybersecurity resilience.

Special Publications (SP)

NIST publishes a series of Special Publications (SP), which provide technical guidelines for specific aspects of cybersecurity. Among the most significant is SP 800-53, titled "Security and Privacy Controls for Federal Information Systems and Organizations." This publication outlines a comprehensive set of controls addressing areas such as access control, incident response, system integrity, and encryption. It serves as the cornerstone for securing federal information systems and is often referenced in audits and compliance assessments.

Another critical standard is SP 800-171, which focuses on protecting Controlled Unclassified Information (CUI) in non-federal systems. It provides detailed requirements for organizations handling sensitive federal information, such as defense contractors and private sector partners. Compliance with SP 800-171 is often a prerequisite for participating in federal contracts.

For the secure development of software, NIST introduced SP 800-218, known as the "Secure Software Development Framework (SSDF)." This document emphasizes integrating security throughout all stages of the software development lifecycle, from design to deployment and maintenance.

Recognizing the unique challenges posed by Industrial Control Systems (ICS), NIST published SP 800-82, titled "Guide to Industrial Control Systems (ICS) Security." This guideline addresses the security of critical infrastructure systems, including SCADA systems, programmable logic controllers (PLCs), and other operational technology (OT) components.

Federal Information Processing Standards (FIPS)

In addition to Special Publications, NIST develops Federal Information Processing Standards (FIPS). These standards are legally binding for U.S. federal agencies and cover critical areas such as cryptography and secure data handling. For example, FIPS 140-3, "Security Requirements for Cryptographic Modules," specifies security requirements for cryptographic systems and is widely adopted by both government and private sector organizations requiring robust encryption capabilities.

FIPS standards are not limited to federal use; they are frequently referenced in international compliance frameworks and form the basis for many commercial security products.

NCSC Cyber Essentials

Cyber Essentials is a United Kingdom government information assurance scheme operated by the National Cyber Security Centre (NCSC). It encourages organizations to adopt good practices in information security. Cyber Essentials also includes an assurance framework and a simple set of security controls to protect information from threats coming from the internet.

Essential Eight

The Australian Cyber Security Centre has developed prioritised mitigation strategies, in the form of the Strategies to Mitigate Cyber Security Incidents, to help organisations protect themselves against various cyber threats. The most effective of these mitigation strategies is called the Essential Eight.

BSI IT-Grundschutz

The Federal Office for Information Security (German: Bundesamt für Sicherheit in der Informationstechnik, abbreviated as BSI) standards are an elementary component of the IT baseline protection (German: IT-Grundschutz) methodology. They contain recommendations on methods, processes, and procedures, approaches, and measures for various aspects of information security. Users from public authorities, companies, manufacturers, or service providers can use the BSI standards to make their business processes and data more secure.

BSI Standard 100-4 covers Business Continuity Management (BCM).
BSI Standard 200-1 defines general requirements for an information security management system (ISMS). It is compatible with ISO 27001 and considers recommendations of other ISO standards, such as ISO 27002.
BSI Standard 200-2 forms the basis of BSI's methodology for establishing a sound information security management system (ISMS). It establishes three procedures for implementing IT baseline protection.
BSI Standard 200-3 bundles all risk-related steps in implementing IT baseline protection.

Industry-specific Standards

The subsections below detail cybersecurity standards and frameworks related to specific industries.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands but administered by the Payment Card Industry Security Standards Council. The standard was created to increase controls around cardholder data to reduce credit card fraud.

The 2025 update to PCI DSS (version 4.0) introduces revised requirements and enhanced guidance for organizations handling payment card data, including more granular controls and updated security testing procedures.

UL 2900

UL 2900 is a series of standards published by UL. The standards include general cybersecurity requirements (UL 2900-1) as well as specific requirements for medical products (UL 2900-2-1), industrial systems (UL 2900-2-2), and security and life safety signalling systems (UL 2900-2-3).

UL 2900 requires manufacturers to describe and document the attack surface of the technologies used in their products. It requires threat modeling based on the intended use and deployment environment. The standard requires effective security measures that protect sensitive (personal) data and other assets, such as command and control data. It also requires that security vulnerabilities in the software have been eliminated, security principles, such as defense-in-depth have been followed, and the security of the software has been verified through penetration testing.

Organisations producing Standards

The International Organization for Standardization (ISO) is an international standards organization organized as a consortium of national standards institutions from 167 countries, coordinated through a secretariat in Geneva, Switzerland. ISO is the world's largest developer of international standards. The International Electrotechnical Commission (IEC) is an international standards organization that deals with electrotechnology and cooperates closely with ISO. ISO/IEC 15443: "Information technology – Security techniques – A framework for IT security assurance", ISO/IEC 27002: "Information technology – Security techniques – Code of practice for information security management", ISO/IEC 20000: "Information technology – Service management", and ISO/IEC 27001: "Information technology – Security techniques – Information security management systems – Requirements" are of particular interest to information security professionals.

The US National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce. The NIST Computer Security Division develops standards, metrics, tests, and validation programs, and it publishes standards and guidelines to increase secure IT planning, implementation, management, and operation. NIST is also the custodian of the U.S. Federal Information Processing Standard publications (FIPS).

The Internet Society is a professional membership society with over 100 organizations and over 20,000 individual members in over 180 countries. It provides leadership in addressing issues that confront the future of the Internet, and it is the organizational home for the groups responsible for Internet infrastructure standards, including the Internet Engineering Task Force (IETF) and the Internet Architecture Board (IAB). The ISOC hosts the Requests for Comments (RFCs), including the Official Internet Protocol Standards and the RFC-2196 Site Security Handbook.

The German Federal Office for Information Security (in German Bundesamt für Sicherheit in der Informationstechnik (BSI)) BSI-Standards 100–1 to 100-4 are a set of recommendations including "methods, processes, procedures, approaches, and measures relating to information security". The BSI-Standard 100-2 IT-Grundschutz Methodology describes how information security management can be implemented and operated. The standard includes a specific guide, the IT Baseline Protection Catalogs (IT-Grundschutz Catalogs). Before 2005, the catalogs were formerly known as "IT Baseline Protection Manual". The Catalogs are documents useful for detecting and combating security-relevant weak points in the IT environment (IT cluster). As of September 2013, the collection encompasses over 4,400 pages with the introduction and catalogs. The IT-Grundschutz approach is aligned with the ISO/IEC 2700x family.

The European Telecommunications Standards Institute standardized a catalog of information security indicators headed by the Industrial Specification Group (ISG) ISI.