ISO/IEC TS 27100 — IT Security — Cybersecurity Overview

ISO/IEC TS 27100 provides a comprehensive overview and foundational framework for cybersecurity concepts, principles, and terminology. This Technical Specification serves as an entry point to the ISO/IEC 27000 family of cybersecurity standards, establishing a common language and conceptual model that enables consistent communication about cybersecurity across technical, business, and regulatory communities. The standard addresses the increasing need for a unified understanding of cybersecurity as organizations face growing threats and regulatory complexity.

Cybersecurity Concepts and Principles

The standard establishes a conceptual model of cybersecurity built upon the core information security principles of confidentiality, integrity, and availability, extended with additional cybersecurity-specific dimensions. These include accountability, auditability, authenticity, and non-repudiation. The model recognizes that cybersecurity extends beyond traditional information security boundaries to encompass the protection of physical systems, operational technology, and cyber-physical systems in addition to conventional IT environments.

ISO/IEC TS 27100 defines cybersecurity as the preservation of confidentiality, integrity, and availability of information in cyberspace, while also addressing the protection of assets including people, applications, systems, and networks from cyber threats. The concept of cyberspace is defined broadly to include all interconnected digital environments, including the internet, telecommunications networks, computer systems, and embedded processors and controllers. This expansive definition reflects the modern reality where cybersecurity concerns extend across all digital domains.

An important contribution of the standard is the clarification of the relationship between cybersecurity, information security, and privacy. While these domains share common foundations, the standard articulates their distinct focus areas and overlapping boundaries. Cybersecurity is presented as the broadest domain, encompassing information security and extending to the protection of all assets in cyberspace. Privacy is positioned as a distinct but closely related discipline that addresses the protection of personal information and individual rights in the context of digital processing.

Cybersecurity Risk Management Framework

The standard presents a high-level cybersecurity risk management framework that aligns with the ISO 31000 risk management principles and ISO/IEC 27005 information security risk management guidance. The framework consists of five interconnected processes: context establishment, risk assessment, risk treatment, risk acceptance, and risk communication and consultation. Each process is described in terms of its cybersecurity-specific considerations, providing organizations with a structured approach to identifying, analyzing, and responding to cyber threats.

A distinguishing feature of the cybersecurity risk framework is the emphasis on threat intelligence and situational awareness. The standard recognizes that the cyber threat landscape evolves rapidly, requiring organizations to maintain continuous awareness of emerging threats and vulnerabilities. The framework incorporates threat intelligence feeds, vulnerability databases, and information sharing mechanisms as integral components of the risk management process. This dynamic approach contrasts with traditional risk management, which often assumes a relatively stable risk environment.

Engineering Implications of the Cybersecurity Framework

From an engineering perspective, the cybersecurity framework defined in ISO/IEC TS 27100 has significant implications for system architecture and design. Engineers should adopt a security-by-design approach that embeds cybersecurity principles into the foundational architecture of systems, rather than adding security as an afterthought. The framework supports the implementation of defense-in-depth strategies, where multiple layers of security controls provide redundant protection so that failure of one control does not lead to complete compromise.

The standard’s emphasis on threat intelligence integration has practical engineering implications for security monitoring and response systems. Engineers should design security architectures that support automated consumption of threat intelligence feeds, enabling proactive defense measures such as dynamic access control adjustments, automated firewall rule updates, and threat-informed security testing. The integration of cybersecurity monitoring across IT, operational technology, and cyber-physical system domains presents particular engineering challenges that require unified data models and correlation engines capable of analyzing diverse telemetry sources.