BS ISO/IEC Standards Single-File Series Overview · Batch 2 — A Compilation of 69 Joint ISO/IEC Standards and Their Technical Points

BS ISO/IEC is the British national standard formed when the UK adopts the International Standard developed by the joint ISO and IEC technical committee (JTC 1), published by BSI. This batch compiles 69 single-file BS ISO/IEC standards, most of which belong to the information security and IT security field, particularly the ISO/IEC 27000 series (information security management systems), while also covering cloud security, protection of personally identifiable information, cybersecurity, digital evidence, business continuity, RFID, IoT identification, process assessment and software quality.

These standards form an important technical foundation for information security and digital governance of modern organisations, and are the direct basis for ISMS certification, cloud service security assessment and cybersecurity protection. This article is organised into six parts: series overview, standard list, key technical requirements, representative standard interpretation, engineering practice and application, and frequently asked questions.

1. Series Overview 📌

This batch of BS ISO/IEC standards concentrates on information security and IT security, with the ISO/IEC 27000 series (Information Security Management Systems, ISMS) at its core. These standards are developed by ISO/IEC JTC 1/SC 27 (Subcommittee on information security, cybersecurity and privacy protection), and constitute the most widely adopted standards family for information security management and cybersecurity in the world.

By topic distribution, this batch can be broadly divided into: ISMS governance and guideline types (background of ISO/IEC 27001 implementation, 27002 control implementation, 27004 performance measurement, 27005 risk management, 27007 audit guidelines, 27008 control auditing, 27013 integration with IT service management, 27014 security governance), cloud security types (27017 code of practice for cloud security controls, 27018 protection of PII in public clouds), cybersecurity and business continuity types (27031 ICT readiness guidance, 27032 cybersecurity guidance, 27033 network security design, 27034 application security), investigation and forensics types (27037 digital evidence identification collection acquisition preservation, 27038 document redaction, 27039 IDPS selection deployment, 27042 digital evidence analysis and interpretation), product and technology types (27034 application security, 27040 storage security, 29143 RFID air interface, 29161 IoT unique identification, 29167 RFID security, 28360 chemical emission rates of electronic equipment) and process and quality types (33001/33002 process assessment, 90003 application of software quality management).

This topic concentration reflects the wide applicability and importance of the ISO/IEC 27000 series as the global information security management standard.

2. Standard List and Technical Points 📋

3. Key Technical Requirements 🔧

In ISMS governance and guidelines, ISO/IEC 27002 provides refinement of the code of practice for information security controls, ISO/IEC 27005 provides guidance on information security risk management, ISO/IEC 27004 specifies security performance measurement, ISO/IEC 27007 specifies ISMS audit guidelines, and ISO/IEC 27014 specifies the framework of information security governance.

In cloud security, ISO/IEC 27017 provides a code of practice for information security controls for cloud services based on ISO/IEC 27002, and ISO/IEC 27018 provides a code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors; both are important bases for cloud service security assessment and PII protection compliance.

In cybersecurity, ISO/IEC 27032 provides guidelines for cybersecurity, ISO/IEC 27031 provides guidance on ICT readiness for business continuity, the ISO/IEC 27033 series specifies cybersecurity architecture and design requirements, and the ISO/IEC 27034 series specifies an application security framework.

In investigation and forensics, ISO/IEC 27037 specifies guidance on identification, collection, acquisition and preservation of digital evidence, and ISO/IEC 27042 specifies guidance on analysis and interpretation of digital evidence, providing methodological support for information security incident investigation and electronic forensics.

In IoT and RFID, ISO/IEC 29161 specifies the unique identification (UID) structure for the Internet of Things, ISO/IEC 29143 specifies middleware for wireless RFID readers on the air interface, and the ISO/IEC 29167 series specifies RFID security communication protocols.

4. Representative Standard Interpretations 🔍

BS ISO/IEC 27032:2012 Information technology — Security techniques — Guidelines for cybersecurity

Scope: This standard provides guidelines for cybersecurity, describing stakeholders, roles and their interactions in cybersecurity, and providing a collaborative approach to addressing cyber threats.

Key points: The standard defines the distinctions and relationships between cybersecurity and information security, application security and network security, clarifies the roles and responsibilities of participants in cyberspace (individuals, organisations, governments), and provides guidance for identifying and responding to cyber attacks (such as botnets, phishing, social engineering and malware). Revised by ISO/IEC 27032:2023, it remains an important basis for collaborative governance of cybersecurity.

BS ISO/IEC 27017:2015 Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for cloud services

Scope: This standard provides a code of practice for information security controls applicable to cloud services, as a cloud security supplement to ISO/IEC 27002.

Key points: Based on the controls of ISO/IEC 27002, the standard adds cloud-service-specific controls and implementation guidance, covering responsibility allocation between cloud customers and cloud service providers, virtualisation security, access control in cloud environments, data deletion and backup, tenant isolation, and provides recommendations for control implementation and verification. It is an important reference for cloud service procurement and security assessment.

BS ISO/IEC 27018:2014 Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

Scope: This standard specifies a code of practice for protection of personally identifiable information (PII) when public cloud service providers act as PII processors.

Key points: Based on ISO/IEC 27002, the standard specifies control requirements for PII processors addressing the particularities of PII processing in public clouds, including disclosure of PII processing, data processing agreement clauses, data return and deletion, data location restrictions, and mechanisms for responding to customers. Aligned with data protection legislation such as the GDPR, it is an important basis for PII protection compliance of cloud services.

BS ISO/IEC 27037:2012 Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence

Scope: This standard provides guidelines for identification, collection, acquisition and preservation of digital evidence, used to support information security incident investigation and electronic forensics.

Key points: The standard specifies procedures for identifying, collecting, acquiring and preserving digital evidence, covering evidence classification, use of forensic tools, chain of custody, handling and storage of storage media, and documentation. It emphasises the integrity and admissibility of evidence in legal and disciplinary proceedings, providing methodological support for incident investigation and digital forensics.

BS ISO/IEC 29161:2016 Information technology — Internet of Things — Unique identification for the Internet of Things

Scope: This standard specifies the structure and allocation rules of unique identification (UID) in the Internet of Things, used to support identification and interoperability of IoT objects.

Key points: The standard defines the structure of IoT UID (composed of a vendor identification code, object class code and serial number) and its coding and allocation requirements, and specifies the application path of UID in automatic identification and data capture (AIDC) technologies (such as RFID and barcodes). The unified UID structure ensures uniqueness of IoT object identification and interoperability between heterogeneous systems, and is an important component of IoT infrastructure standards.

5. Engineering Practice and Application 🛠️

In building information security management systems, standards such as ISO/IEC 27032 and 27005 are used to establish cybersecurity and risk management frameworks, and ISO/IEC 27004 for security performance measurement, supporting continual improvement of the ISMS.

In cloud service procurement and security assessment, ISO/IEC 27017 and 27018 are used to assess the control measures and PII protection capabilities of cloud service providers, allocating responsibility through service agreements.

In incident response and forensics, ISO/IEC 27037 and 27042 are used for collection, preservation, analysis and interpretation of digital evidence, ensuring the evidential value of investigation results.

In IoT product design, ISO/IEC 29161 is used to implement unique object identification and ISO/IEC 29167 for RFID secure communication, supporting secure interoperability of IoT systems.

In security governance, ISO/IEC 27014 is used to establish an information security governance framework, embedding security decisions into organisational governance and improving board-level security oversight.

6. Frequently Asked Questions ❓