ISO/IEC cybersecurity and data privacy standards give organizations a globally recognized framework for managing information security, cyber risk, compliance, cloud security, incident response, third-party risk, and privacy. Standards such as ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005, and ISO/IEC 27701 help business and security leaders establish stronger governance, reduce risk, demonstrate compliance, and build greater trust with customers and stakeholders. By understanding how these standards work together, organizations can create a more mature, risk-based cybersecurity and privacy program while avoiding unnecessary complexity and duplicated compliance efforts.
Below is a list of the major ISO/IEC standards and related ISO/IEC technical publications covering information security, cybersecurity, privacy, cloud security, incident response, digital forensics, supplier security, vulnerability management, and cryptography that I would prioritize. I’ve used the current editions available as of August 2026 where possible. ISO/IEC JTC 1/SC 27 is the primary ISO/IEC committee responsible for information security, cybersecurity, and privacy protection standards.
| Name | Description | How organization can use/apply this standard |
| ISO/IEC 27001:2022 – Information Security Management System (ISMS) (ISO) | Defines requirements for establishing, implementing, maintaining, and continually improving an ISMS. | Use as the foundation of an enterprise information security program. Perform risk assessments, establish controls, define policies, track remediation, conduct internal audits, and pursue ISO 27001 certification. |
| ISO/IEC 27002:2022 – Information Security Controls (ISO) | Provides detailed guidance for implementing information security controls. The current edition contains the control structure used by ISO 27001. | Use as the organization’s security control catalog for areas such as access control, asset management, HR security, vulnerability management, logging, cloud security, incident management, and supplier security. |
| ISO/IEC 27005:2022 – Information Security Risk Management (ISO) | Provides guidance for identifying, analyzing, evaluating, treating, and monitoring information security risks. | Build the organization’s cyber risk methodology, risk register, likelihood/impact model, risk treatment plans, risk acceptance processes, and ongoing risk reviews. |
| ISO/IEC 27014:2020 – Governance of Information Security (ISO) | Provides principles and processes for executive and board-level governance of information security. | Establish board/CISO oversight, accountability, risk reporting, security objectives, decision authorities, management reviews, and executive-level cybersecurity governance. |
| ISO/IEC 27017:2026 – Cloud Security Controls (ISO) | Extends ISO 27002 with security controls and guidance specifically for cloud services and cloud customers/providers. | Use to evaluate AWS, Azure, GCP, SaaS providers, and internal cloud environments; define shared-responsibility controls and cloud-specific security requirements. |
| ISO/IEC 27018:2025 – Protection of PII in Public Clouds (ISO) | Provides privacy controls for personally identifiable information processed by public cloud service providers acting as PII processors. | Include privacy requirements in cloud vendor assessments, contracts, DPAs, data-handling requirements, audit programs, and cloud governance. |
| ISO/IEC 27031:2025 – ICT Readiness for Business Continuity (ISO) | Provides guidance for preparing ICT systems to support business continuity. | Develop disaster recovery capabilities, technology recovery requirements, RTO/RPO objectives, resilience testing, backup strategies, and ICT continuity plans. |
| ISO/IEC 27035 Series – Information Security Incident Management (ISO) | Covers incident management principles, preparation, response operations, and coordination. | Establish the organization’s incident response program, IR plan, severity classification, escalation procedures, communications, tabletop exercises, lessons learned, and incident metrics. |
| ISO/IEC 27036 Series – Supplier & Supply Chain Security (ISO) | Addresses cybersecurity risks arising from suppliers, vendors, hardware, software, services, cloud providers, and ICT supply chains. | Build a Third-Party Risk Management (TPRM) program, define supplier security requirements, perform vendor risk assessments, establish contractual controls, and continuously monitor supplier risk. |
| ISO/IEC 27400:2022 – IoT Security and Privacy (ISO) | Provides cybersecurity and privacy principles, risks, and controls for Internet of Things solutions. | Assess IoT devices, establish IoT security requirements, evaluate manufacturers, secure device deployments, manage device lifecycle risks, and address IoT privacy concerns. |
| ISO/IEC 27701:2025 – Privacy Information Management System (PIMS) (ISO) | Defines requirements and guidance for establishing and operating a Privacy Information Management System. The 2025 edition can operate as a standalone management system or integrate with ISO 27001. | Build a formal enterprise privacy program, identify controller/processor responsibilities, manage privacy risks, demonstrate accountability, and support requirements stemming from GDPR and other privacy regulations. |
| ISO/IEC 29134:2023 – Privacy Impact Assessments (ISO) | Provides a methodology and reporting structure for Privacy Impact Assessments (PIAs). | Create a formal PIA/DPIA process for new systems, applications, AI projects, vendors, or business processes that collect or process personal information. |
| ISO/IEC 29147:2018 – Vulnerability Disclosure (ISO) | Provides requirements and recommendations for receiving, managing, and disclosing vulnerability reports. | Establish a coordinated vulnerability disclosure program, security.txt process, vulnerability reporting channel, researcher communication process, and disclosure policy. |
| ISO/IEC 30111:2019 – Vulnerability Handling Processes (ISO) | Provides requirements and recommendations for investigating, remediating, and managing vulnerabilities in products and services. | Software and SaaS vendors can establish vulnerability triage, remediation, patch development, testing, tracking, and release processes. Works closely with ISO 29147. |
Need help with ISO 27001 Certificate Readiness? Learn more.
Abu Sadeq is currently the Founder and CEO at Zartech where his mission is to empower organizations to obtain greater cybersecurity maturity. Abu is a certified Chief Information Security Officer (C|CISO) and has a Master of Science degree in Management Information Systems from the University of Texas at Dallas. He has diverse industry experience in Aerospace & Defense, Chemical, Telecom, Healthcare, Oil & Gas, and Consumer Goods. Abu has extensive experience in creating strategies and plans that define IT/Security operational excellence. Abu is also the creator of Cyberator® a sophisticated cybersecurity, governance, risk, and compliance solution.