International Standards

ISO/IEC 27001

Management system standard

Authority:

ISO / IEC

Status:

Current edition: ISO/IEC 27001:2022

Applies to:

Any organisation seeking to manage information security through a certifiable management system.

ISO/IEC 42001

Management system standard

Authority:

ISO / IEC

Status:

Current edition: ISO/IEC 42001:2023

Applies to:

Organisations that develop, provide or use AI systems and want a certifiable AI management system.

ISO/IEC 27701

Management system standard

Authority:

ISO / IEC

Status:

Current edition: ISO/IEC 27701:2019 (extension to 27001)

Applies to:

Organisations operating an ISMS that want to extend it to a privacy information management system (PIMS).

Management system standard

Authority:

ISO

Status:

Current edition: ISO 22301:2019

Applies to:

Organisations that need a business continuity management system (BCMS).

Voluntary standard

Authority:

ISO

Status:

Current edition: ISO 31000:2018 (guidance, not certifiable)

Applies to:

Any organisation seeking principles and guidelines for risk management.

NIST Cybersecurity Framework

Control framework

Authority:

US National Institute of Standards and Technology (NIST)

Status:

Current edition: CSF 2.0

Applies to:

Voluntary framework used worldwide to manage cybersecurity risk (adds the 'Govern' function in 2.0).

NIST AI Risk Management Framework

Control framework

Authority:

US National Institute of Standards and Technology (NIST)

Status:

AI RMF 1.0 (with Generative AI Profile companion)

Applies to:

Voluntary framework for organisations designing, developing, deploying or using AI systems.

NIST SP 800-53

Control framework

Authority:

US National Institute of Standards and Technology (NIST)

Status:

Revision 5 (with ongoing release updates)

Applies to:

US federal information systems; widely adopted as a control catalogue by others.

CIS Critical Security Controls

Control framework

Authority:

Center for Internet Security (CIS)

Status:

CIS Controls v8.1

Applies to:

Any organisation seeking a prioritised set of defensive actions (Implementation Groups 1-3).

Governance framework

Authority:

ISACA

Status:

COBIT 2019

Applies to:

Enterprises governing and managing information and technology; often used in ITGC/SOX contexts.

COSO Internal Control – Integrated Framework

Control framework

Authority:

Committee of Sponsoring Organizations of the Treadway Commission (COSO)

Status:

2013 Framework

Applies to:

Organisations designing internal control; the standard reference for SOX/ICFR.

Industry security standard

Authority:

PCI Security Standards Council

Status:

Current version: 4.0.1

Applies to:

Entities that store, process or transmit cardholder data; enforced contractually by payment brands.

Assurance / attestation criteria

Authority:

AICPA (Trust Services Criteria; SSAE 18 attestation standards)

Status:

Trust Services Criteria (2017, revised 2022)

Applies to:

Service organisations whose customers require assurance over security and related criteria. A SOC 2 report is issued only by a licensed CPA firm.

Assurance / attestation criteria

Authority:

AICPA (SSAE 18, AT-C 320)

Status:

SSAE 18 attestation standards

Applies to:

Service organisations whose controls are relevant to their clients' financial reporting (ICFR). Issued only by a licensed CPA firm.