Difference between revisions of "ISO"
| Line 1,033: | Line 1,033: | ||
Based on PWI | Based on PWI | ||
} | } | ||
=== <span style="font-size: larger;">27006-2 IS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems</span> === | === <span style="font-size: larger;">27006-2 IS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems</span> === | ||
Revision as of 14:37, 26 December 2022
Introduction
The objective of this page is to provide a high-level view of activities related to privacy standards in ISO
Most projects are developed within ISO/IEC JTC1/SC27. More info can be found on in the SC27 portal:
- http://www.jtc1sc27.din.de/cmd?level=tpl-home&languageid=en
- http://www.jtc1sc27.din.de/cmd?level=tpl-bereich&menuid=220707&languageid=en&cmsareaid=220707 (set of slides)
Note that the portal will in general contain more information than this wiki, which focuses mainly on work carried out in ISO/IEC JTC1/SC27/WG5.The convenor is Kai Rannenberg, and the vice convenor is Jan Schallaböck. WG5 regularly publishes a document a standing document (SG1) on WG5 roadmap. It can be found in [1]
Some of the projects are also carried out in ISO/IEC JTC1/SC27/WG4.The convenor is Johann Amsenga, and the vice convenor is François Lorek
One project is carried out within ISO PC317. The convenor is Jan Schallaböck. ISO PC317 focuses on the development of ISO 31700 (Consumer protection: privacy by design for consumer goods and services)
Some conventions on ISO standards
The important things to know concerning ISO standards steps:
| Standard |
|
| Technical report |
|
| Technical specification |
|
Meetings
Progress is finalised in plenary meetings (taking place every 6 months).
Here is a list of meetings that took place or that will take place in SC27.
| 2014 |
|
| 2015 |
|
| 2016 |
|
| 2017 |
|
| 2018 |
|
| 2019 |
|
| 2020 |
|
| 2021 |
|
| 2022 |
|
| 2023 |
|
ISO 31700 is dealt with in another committee (PC317). Here is a list of meetings that took place or that will take place in PC317.
| 2018 |
|
| 2019 |
|
| 2020 |
|
| 2021 |
|
| 2022 |
|
Privacy references lists
| Scope |
The WG5 Standing Document 2 contains references with relevant descriptions to privacy-related:
The WG5 Standing Document 2 shall not be considered as:
|
| Documentation | https://www.din.de/resource/blob/78924/5ced65e40dcbe6e503c2392c75f3dd1e/sc27wg5-sd2-data.pdf |
| Calendar |
This document is regularly updated |
Published standards
19608:2018 TS Guidance for developing security and privacy functional requirements based on 15408
| Editor |
Naruki Kai |
| Scope |
This Technical Report provides guidance for:
|
| Documentation | https://www.iso.org/standard/65459.html |
| Calendar |
has been moved from TR to TS Published in October 2018 |
| Comments |
20547-4:2020 IS Big data reference architecture - Part 4 - Security and privacy
| Editor | Jinhua Min, Xuebin Zhou |
| ScopeS | Specifies security and privacy aspects of the big data reference architecture including governance, collection, processing, exchange, storage and identification |
| Documentation |
Is the follow-up of the NIST initiative for a big data interoperability framework. Reports are available there: [1], [2], [3], [4], [5], [6], [7] |
| Calendar |
1st WD provided in June 2016 2nd WD provided in May 2017 3rd WD provided in November 2017 4th WD provided in April 2018 1st CD provided in November 2018 2nd CD provided in October 2019 DIS published in October 2019 Further to virtual meeting in April 2020, will go for FDIS |
| Comments |
WG9 is working on the following
Part 4 is transferred to SC27 for development, with close liaison with WG 9 [Antonio Kung] The 20547 reference architecture should be instantiated into domain specific real architectures (e.g. health, transport, energy...). 20547-4 should therefore
Further to Berlin meeting, decision to change title (term fabric is removed) |
20889:2018 IS Privacy enhancing de-identification terminology and classification of techniques
| Editor |
Chris Mitchell and Lionel Vodzislawsky |
| Scope | This international standard provides a description of privacy enhancing data de-identification techniques, to be used for describing and designing de-identification measures in accordance with the privacy principles in ISO/IEC 29100. In particular, this International Standard specifies terminology, a classification of de-identification techniques according to their characteristics, and their applicability for minimizing the risk of re-identification |
| Documentation |
Slides presented by Chris Mitchel during IPEN workshop (June 5th 2015): http://ipen.trialog.com/wiki/File:CM_slide_for_150605.pdf |
| Calendar |
1st WD December 2015 2nd WD June 2016 1st CD Devember 2016 2nd CD May 2017 1st DIS January 2018 FDIS August 2018 Published in November 2018 |
| Comments |
27006-2 2021 TS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems
| Editor | Helge Kreutzmann, Fuki Azetsu, Hans Hedbom, Alan Shipman |
| Scope |
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. Conformance to the requirements contained in this document needs to be demonstrated in terms of competence and reliability by certification body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for certification body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes. |
| Documentation | https://www.iso.org/standard/71676.html |
| Calendar |
Started in Paris October 2019 1st DTS published in July 2020, 2nd DTS published in October 2020 Publication in February 2021 Further to the March 2022 meeting, a revision is underway, at CD level |
| Comments |
27018:2014 IS Code of practice for protection of PII in public clouds acting as PII processors
| Editor |
|
| Scope |
This International Standard establishes control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information (PII) in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. It specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which might be applicable within the context of the information security risk environment(s) of a provider of public cloud services. The standard concerns public cloud only and cloud service providers acting as PII processors. |
| Documentation | |
| Comments |
1st published in 2014 ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques |
27400 2022 IS Security and Privacy for the Internet of Things
| Editor |
Faud Khan, Koji Nakao, Luc Poulin |
| Scope |
This document provides guidelines on risks, principles and controls for security and privacy of Internet of Things (IoT). |
| Documentation | https://www.iso.org/standard/44373.html |
| Calendar |
Started in Wuhan April 2018 1st WD provided in June 2018 2nd WD provided in November 2018 3rd WD provided in June 2019 1st CD provided in December 2019 2nd CD provided in May 2020 3rd CD provided in March 2021 DIS provided in April 2021 FDIS provided in January 2022 Published in June 2022 |
| Comments |
Follow up of
Aprll 2020: Renamed from 27030 to 27400 |
27550:2019 TR Privacy engineering for system lifecycle processes
| Editor |
Antonio Kung, Mathias Reinis |
| Scope |
This technical report provides privacy engineering guidelines that are intended to help organisations integrate recent advances in privacy engineering into their engineering practices:
The intended audience includes engineers and practitioners who are involved in the development, implementation or operation of systems that need privacy consideration, as well as managers in organisations responsible for privacy, development, product management, marketing, and operations |
| Documentation |
A youtube presentation on privacy engineering: https://www.youtube.com/watch?v=BymNvbmSr2E |
| Calendar |
1st WD provided in January 2017 2nd WD provided in June 2017 1st PDTR provided in January 2018 2nd PDTR provided in June 2018 3rd PDTR provided in October 2018 Version for publication provided in April 2019 Publication in September 2019 |
| Comments |
[Antonio Kung]
|
27551:2021 IS Requirements for attribute-based unlinkable entity authentication
| Editor |
Nat Sakimura, Jaehoon Na, Pascal Pailler |
| Scope |
This International Standard
This International Standard is applicable to any information system that performs attribute-based unlinkable entity authentication |
| Documentation | https://www.iso.org/standard/44373.html |
| Calendar |
1st WD provided in April 2017 2nd WD provided in Dec 2017 3rd WD provided in July 2018 4th WD provided in February 2019 1st CD provided in October 2019 DIS provided in November 2019 FDIS provided in September 2020 Published in September 2021 |
| Comments |
27555:2021 IS Guidelines on Personally Identifiable Information Deletion
| Editor |
Dorotea Alessandra de Marco, Yan Sun, Volker Hammer |
| Scope |
This document specifies the conceptual framework for deletion of PII. It gives guidelines for establishing organizational policies that embrace concepts presented by specifying:
This document is intended to be used by organizations where PII and other personal data is being stored or processed. This document does not address:
|
| Documentation | https://www.iso.org/fr/standard/71673.html |
| Calendar |
1st WD provided in March 2019 2nd WD provided in June 2019 1st CD provided in December 2019. Title changed (former title: establishing a PII deletion concept in organisations) 2nd CD was published in June 2020 DIS was provided in January 2021 FDIS was provided in April 2021 Publication in October 2021 |
| Comments | It is based on a German standard |
27556 2022 IS User-centric privacy preferences management framework
| Editor |
Shinsaku Kiyomoto, Antonio Kung, Heung Youl Youm |
| Scope |
This document provides a user-centric framework for handling personally identifiable information (PII), based on privacy preferences. |
| Calendar |
Established in Gjovik (October 2018) 1st WD provided In June 2019 2nd WD provided in December 2019 1st CD provided in May 2020 2nd CD provided in October 2020 3rd CD provided in April 2021 DIS provided in October 2021 FDIS provided in May 2022 Publication in October 2022 |
| Documentation | https://www.iso.org/standard/71674.html |
| Comments | Project named changed from "User-centric framework for the handling of personally identifiable information (PII) based on privacy preferences" to "User-centric privacy preferences management framework" |
27557 2022 IS Organizational privacy risk management
| Editor |
Kimberly Lucy, Markus Gierschmann, Kelvin Magtalas, Carlo Harpes |
| Scope |
Provides guidelines for organizational privacy risk management. Designed to provide guidance to organizations processing personally identifiable information (PII) for integrating risks to the organization related to the processing of PII, including the privacy impact to individuals, as part of an organizational privacy risk management program. Assists in the implementation of a risk-based privacy program which can be integrated in the overall risk management of the organization, and supports the requirement for risk management as specified in management systems (such as ISO/IEC 27701:2019). |
| Documentation | https://www.iso.org/standard/71674.html |
| Calendar |
1 st WD was published in May 2020 2nd WD was published in October 2020 1st CD was published in April 2021 DIS was provided in October 2021 FDIS was provided in June 2022 Published in November 2022 |
27559 2022 IS Privacy-enhancing data de-identification framework
| Editor | Malcolm Townsend, Santa Borel |
| Scope |
This document provides a framework for identifying and mitigating re-identification risks and risks associated with the lifecycle of de-identified data. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations implementing data de-identification processes for privacy enhancing purposes. |
| Documentation | https://www.iso.org/standard/71677.html |
| Calendar |
1st WD was provided in July 2020 2nd WD was provided in February 2021 1st CD was prrovided in April 2021 DIS was provided in October 2021 FDIS was provided in June 2022 Published in November 2022 |
27570:2021 TS Privacy Guidelines for Smart Cities
| Editor | Antonio Kung, Heung Youl Youm, Clotilde Cochinaire |
| Scope |
The document takes into account a multiple agency as well as a citizen centric viewpoint, and provides guidance on how privacy standards can be used at a global level and at an organisational level for the benefit of citizens This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that provides service in the smart city environments |
| Documentation | https://www.iso.org/standard/71678.html |
| Calendar |
1st WD was provided in June 2018 further the Wuhan meeting. 2nd WD was provided in October 2018 further to the Gjovik meeting. A 1st PDTS was provided in May 2019 further to the Tel Aviv meeting. A 2nd PDTS was provided in November 2019 further to the Paris meeting A 3rd PDTS was provided in May 2020 further to the April 2020 virtual meeting The document will go to publication further to the September 2020 virtual meeting. The standard was published in January 2021 see following press release: https://www.iso.org/news/ref2631.html |
| Comments |
First ecosystem oriented standard for privacy Follow up of SP Privacy in Smart cities Liaison will take place with WG11 (smart cities), SC40 (IT Service Management and IT Governance), TC268/SC1/WG4 (sustainable cities and communities), EIP-SCC (European Innovation Platform - Smart Cities and Communities) |
27701:2019 IS Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines
| Editor |
Alan Shipman, Oliver Weissmann, Srinivas Poosarla, Heung Youl Youm |
| Scope |
This document specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization. In particular, this document specifies PIMS-related requirements and provides guidance for PII controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are PII controllers and/or PII processors processing PII within an ISMS. Excluding any of the requirements specified in clause 5 of this document is not acceptable when an organization claims conformity to this document. |
| Documentation | https://www.iso.org/standard/71670.html |
| Calendar |
1st WD provided in April 2017 2nd WD provided in June 2017 1st CD provided in April 2018 2nd CD provided in June 2018 DIS provided in March 2019 Publication in August 2019 |
| Comments |
Was initially ISO/IEC 27552. Was renamed to ISO/IEC 27701 in August 2019 |
29100:2011 IS Privacy framework
| Editor |
Stefan Weiss Revision : Nat Sakimura |
| Scope | This International Standard provides a framework for defining privacy control requirements related to personally identifiable information within an information and communication technology environment.This International Standard is designed for those individuals who are involved in specifying, procuring, architecting, designing, developing, testing, administering and operating ICT systems. |
| Documentation | Is a free standard : see http://standards.iso.org/ittf/PubliclyAvailableStandards/index.html |
| Comments |
In the Tampa meeting, a recommendation was made to go for a review (see below study period) A number of limited modifications have been identified in the Abu Dhabi that will lead to an amendment work The amended version will be available further to the Berlin meeting |
29101:2018 IS Privacy architecture framework
| Editor |
Stefan Weiss and Dan Bogdanov, For revision: Nat Sakimura, Shinsaku Kiyomoto |
| Scope |
This International Standard describes a privacy architecture framework that
This International Standard is applicable to entities involved in specifying, procuring, architecting, designing, testing, maintaining, administering and operating ICT systems that process PII. It focuses primarily on ICT systems that are designed to interact with PII principals. |
| Documentation | https://www.iso.org/standard/75293.html |
| Comments | Revision initiated in Berlin (November 2017) |
29134:2017 IS Guidelines for Privacy impact assessment
| Editor | Mathias Reinis |
| Scope |
This Standard establishes guidelines for the conduct of privacy impact assessments that are used for the protection of personally identifiable information (PII). It should be used by organizations that are establishing or operating programs or systems that involve the processing of PII, or that are making significant changes to existing programs or systems. This International Standard also provides guidance on privacy risk treatment options. Privacy Impact Assessments can be conducted at various stages in the life cycle of a programme or systems ranging from the prelaunch phase and decommissioning. In particular, it will provide a framework for privacy safeguarding and specific method for privacy impact assessment. It will be applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations and will be relevant to any staff involved in designing or implementing projects which will have an impact on privacy within an organization, including operating data processing systems and services and, where appropriate, external parties supporting such activities. This Standard describes privacy risk assessment as introduced by ISO/IEC 29100:2011. For the basic elements of the privacy framework and the privacy principles, reference is made to ISO/IEC 29100:2011. For principles and guidelines on risk management, reference is made to ISO 31000:2009. |
| Documentation | https://www.iso.org/standard/62289.html |
| Calendar | Published in June 2017 |
| Comments |
29151:2017 IS Code of Practice for PII Protection (also a ITU document - ITU-T X.1058)
| Editor | Heung Youl Youm, Alan Shipman |
| Scope |
This International Standard establishes commonly accepted control objectives, controls and guidelines for implementing controls, to meet the requirements identified by a risk and impact assessment related to the protection of Personally Identifiable Information (PII). In particular, this International Standard specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for processing PII which may be applicable within the context of an organization's information security risk environment(s). This International Standard is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which process PII, as part of their information processing. |
| Documentation |
March 3rd presentation made by editor during an informal confcall with Dawn Jutla (OASIS) and Antonio Kung (PRIPARE): http://ipen.trialog.com/wiki/File:X.gpim-29151_oasis.pdf |
| Calendar | Published in August 2017 |
| Comments | Also an ITU reference (ITU-T X.gpim) |
29184:2020 IS Online privacy notices and consent
| Editor |
Nat Sakimura, Srinivas Poorsala, Jan Schallaboeck |
| Scope |
This document is a specification for the content and the structure of online privacy notices as well as the process of requesting consent to collect and process PII from a PII principal. This document is applicable to all situations, where a PII controller or any other entity processing PII interacts with PII principals in any online context. |
| Documentation | https://www.iso.org/standard/71678.html |
| Calendar |
1st WD provided in June 2016 2nd WD provided in April 2017 3rd WD provided in June 2017 1nd CD provided in December 2017 2nd CD provided in July 2018 3rd CD provided in January 2019 DIS provided in April 2019 FDIS provided in May 2020 Published in June 2020 |
| Comments |
initiated in Jaipur (Oct 2015) Follows Study Period initiated in Kuching (May 2015) User friendly online privacy notice and consent |
29190:2015 IS Privacy capability assessment model
| Editor | Alan Shipman |
| Scope |
This International Standard provides organizations with high-level guidance about how to assess their capability to manage privacy-related processes. In particular, it:
|
| Documentation | https://www.iso.org/standard/45269.html |
| Calendar | |
| Comments |
29191:2012 IS Requirements for partially anonymous, partially unlinkable authentication
| Editor |
Kazue Sako (NEC) |
| Scope |
This International Standard defines requirements on relative anonymity with identity escrow based on the model of authentication and authorization using group signature techniques. This document provides guidance to the use of group signatures for data minimization and user convenience. This guideline is applicable in use cases where authentication or authorization is needed. It allows the users to control their anonymity within a group of registered users by choosing designated escrow agents. |
| Documentation | https://www.iso.org/standard/45270.html |
| Comments |
Published in December 2012 Under pre-revie |
Standards in development
5181 Information technology - Security and privacy - Data provenance
| Leaders |
Ryan Ko, Jan de Meer, Yi Zhang | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Proposed Scope |
This document provides guidelines, methodology and techniques for deriving securely information called meta-data, from sources, intermediaries and users creating, manipulating, and transforming data. The meta-data derived from data creations and transformations serves for earning trust in entities and stakeholders during the whole lifecycle of data use and data manipulations. By referring to provenance meta-data an information respectively a decision base is provided to processes or, to individuals. Provenance meta-data of data records can also be applied from both, processes, or individuals when they have to decide which one of their data, they want to make voluntarily available to the public as a common good and which one not. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Documentation |
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Calendar |
Ballot early 2023 |
Comments |
Based on PWI } 27006-2 IS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems
27046 IS Big data security and privacy - Implementation guidelines
27402 IS IoT security and privacy - Device baseline requirements
27403 IS Security techniques - ioT security and privacy - Guidelines for IoT domotics
27560 TS Privacy technologies – Consent record information structure
27561 IS POMME Privacy operationalization model and method for engineering
27562 IS Privacy guidelines for Fintech services
27563 TR Impact of security and privacy in artificial intelligence use cases
27565 IS Guidance on privacy preservation based on zero-knowledge proofs
31700-1 IS Consumer Protection - Privacy-by-design for consumer goods and services - High level requirements
31700-2 TR Consumer Protection - Privacy-by-design for consumer goods and services - Use cases
Preliminary Work ItemsPWI 5181 Information technology - Security and privacy - Data provenance (Started in September 2020, Completed in October 2022)
PWI 6089 Impact of Artificial Intelligence on Security and Privacy (Started in September 2020, Completed in October 2022)
PWI 6102 Guidance on illustrative processes of a privacy information management system (Started in September 2020, Completed in October 2022)
PWI 7709 Security and privacy reference architecture for multi-party data fusion and mining (Started in April 2021)
PWI 7732 Age verification (Started in April 2021)
PWI 7748 Guidance and practices for privacy preservation based on zero-knowledge proofs (Started in April 2021)
PWI 27045 Big data security and privacy - guidelines for data security management framework (Started in April 2021)
PWI 27564 Privacy models (Started in October 2021)
PWI 27564 Privacy models (Started in October 2021)
Completed Preliminary Work Item or Study Periods |