ISO
Introduction
The objective of this page is to provide a high-level view of activities related to privacy standards in ISO. It does not cover security standards (but it does cover standards that cover both security and privacy).
Most projects are developed within ISO/IEC JTC1/SC27. More info can be found on in the SC27 portal:
- http://www.jtc1sc27.din.de/cmd?level=tpl-home&languageid=en
- http://www.jtc1sc27.din.de/cmd?level=tpl-bereich&menuid=220707&languageid=en&cmsareaid=220707 (set of slides)
Note that the portal will in general contain more information than this wiki, which focuses mainly on work carried out in ISO/IEC JTC1/SC27/WG5.The convenor is Kai Rannenberg, and the vice convenor is Jan Schallaböck. WG5 regularly publishes a document a standing document (SG1) on WG5 roadmap. It can be found in [1]
Some of the projects are also carried out in ISO/IEC JTC1/SC27/WG4.The convenor is Johann Amsenga, and the vice convenor is François Lorek
One project is carried out within ISO PC317. The convenor is Jan Schallaböck. ISO PC317 focuses on the development of ISO 31700 (Consumer protection: privacy by design for consumer goods and services)
Some conventions on ISO standards
The important things to know concerning ISO standards steps:
| Standard |
|
| Technical report |
|
| Technical specification |
|
Meetings
Progress is finalised in plenary meetings (taking place every 6 months).
Here is a list of meetings that took place or that will take place in SC27.
| 2014 |
|
| 2015 |
|
| 2016 |
|
| 2017 |
|
| 2018 |
|
| 2019 |
|
| 2020 |
|
| 2021 |
|
| 2022 |
|
| 2023 |
|
ISO 31700 is dealt with in another committee (PC317). Here is a list of meetings that took place or that will take place in PC317.
| 2018 |
|
| 2019 |
|
| 2020 |
|
| 2021 |
|
| 2022 |
|
Privacy references lists
| Scope |
The WG5 Standing Document 2 contains references with relevant descriptions to privacy-related:
The WG5 Standing Document 2 shall not be considered as:
|
| Documentation | https://www.din.de/resource/blob/78924/5ced65e40dcbe6e503c2392c75f3dd1e/sc27wg5-sd2-data.pdf |
| Calendar |
This document is regularly updated |
Published standards
19608:2018 TS Guidance for developing security and privacy functional requirements based on 15408
| Editor |
Naruki Kai |
| Scope |
This Technical Report provides guidance for:
|
| Documentation | https://www.iso.org/standard/65459.html |
| Calendar |
has been moved from TR to TS Published in October 2018 |
| Comments |
20547-4:2020 IS Big data reference architecture - Part 4 - Security and privacy
| Editor | Jinhua Min, Xuebin Zhou |
| ScopeS | Specifies security and privacy aspects of the big data reference architecture including governance, collection, processing, exchange, storage and identification |
| Documentation |
Is the follow-up of the NIST initiative for a big data interoperability framework. Reports are available there: [1], [2], [3], [4], [5], [6], [7] |
| Calendar |
1st WD provided in June 2016 2nd WD provided in May 2017 3rd WD provided in November 2017 4th WD provided in April 2018 1st CD provided in November 2018 2nd CD provided in October 2019 DIS published in October 2019 Further to virtual meeting in April 2020, will go for FDIS |
| Comments |
WG9 is working on the following
Part 4 is transferred to SC27 for development, with close liaison with WG 9 [Antonio Kung] The 20547 reference architecture should be instantiated into domain specific real architectures (e.g. health, transport, energy...). 20547-4 should therefore
Further to Berlin meeting, decision to change title (term fabric is removed) |
20889:2018 IS Privacy enhancing de-identification terminology and classification of techniques
| Editor |
Chris Mitchell and Lionel Vodzislawsky |
| Scope | This international standard provides a description of privacy enhancing data de-identification techniques, to be used for describing and designing de-identification measures in accordance with the privacy principles in ISO/IEC 29100. In particular, this International Standard specifies terminology, a classification of de-identification techniques according to their characteristics, and their applicability for minimizing the risk of re-identification |
| Documentation |
Slides presented by Chris Mitchel during IPEN workshop (June 5th 2015): http://ipen.trialog.com/wiki/File:CM_slide_for_150605.pdf |
| Calendar |
1st WD December 2015 2nd WD June 2016 1st CD Devember 2016 2nd CD May 2017 1st DIS January 2018 FDIS August 2018 Published in November 2018 |
| Comments |
27006-2:2021 TS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems
| Editor | Helge Kreutzmann, Fuki Azetsu, Hans Hedbom, Alan Shipman |
| Scope |
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006 and ISO/IEC 27701. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. Conformance to the requirements contained in this document needs to be demonstrated in terms of competence and reliability by certification body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for certification body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes. |
| Documentation | https://www.iso.org/standard/71676.html |
| Calendar |
Started in Paris October 2019 1st DTS published in July 2020, 2nd DTS published in October 2020 Publication in February 2021 Further to the March 2022 meeting, a revision is underway, at CD level |
| Comments |
27018:2014 IS Code of practice for protection of PII in public clouds acting as PII processors
| Editor |
|
| Scope |
This International Standard establishes control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information (PII) in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. It specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which might be applicable within the context of the information security risk environment(s) of a provider of public cloud services. The standard concerns public cloud only and cloud service providers acting as PII processors. |
| Documentation | |
| Comments |
1st published in 2014 Further to the April 2023, discussion is taking place for a revision |
27400:2022 IS Security and Privacy for the Internet of Things
| Editor |
Faud Khan, Koji Nakao, Luc Poulin, Antonio Kung (initial stages) |
| Scope |
This document provides guidelines on risks, principles and controls for security and privacy of Internet of Things (IoT). |
| Documentation | https://www.iso.org/standard/44373.html |
| Calendar |
Started in Wuhan April 2018 1st WD provided in June 2018 2nd WD provided in November 2018 3rd WD provided in June 2019 1st CD provided in December 2019 2nd CD provided in May 2020 3rd CD provided in March 2021 DIS provided in April 2021 FDIS provided in January 2022 Published in June 2022 |
| Comments |
Follow up of
Aprll 2020: Renamed from 27030 to 27400 |
27402:2023 IS IoT security and privacy - Device baseline requirements
| Editor | Elaine Newton, Amit Elazari Bar On, Faud Khan |
| Scope |
This document provides baseline ICT requirements for IoT devices to support security and privacy controls |
| Documentation | https://www.iso.org/standard/80136.html |
| Calendar |
1st WD was provided in May 2020 1st CD was provided in November 2020 2nd CD was provided in July 2021 DIS was provided in December 2022 FDIS was provided in October 2023 Publication in November 2023 |
| Comments | Is a WG4 project. Delay between 2nd CD and DIS was due to discussions on requirements conformance (e.g. 27402 focuses on device requirements rather than device developer requirements) |
27550:2019 TR Privacy engineering for system lifecycle processes
| Editor |
Antonio Kung, Mathias Reinis |
| Scope |
This technical report provides privacy engineering guidelines that are intended to help organisations integrate recent advances in privacy engineering into their engineering practices:
The intended audience includes engineers and practitioners who are involved in the development, implementation or operation of systems that need privacy consideration, as well as managers in organisations responsible for privacy, development, product management, marketing, and operations |
| Documentation |
A youtube presentation on privacy engineering: https://www.youtube.com/watch?v=BymNvbmSr2E |
| Calendar |
1st WD provided in January 2017 2nd WD provided in June 2017 1st PDTR provided in January 2018 2nd PDTR provided in June 2018 3rd PDTR provided in October 2018 Version for publication provided in April 2019 Publication in September 2019 |
| Comments |
[Antonio Kung]
|
27551:2021 IS Requirements for attribute-based unlinkable entity authentication
| Editor |
Nat Sakimura, Jaehoon Na, Pascal Pailler |
| Scope |
This International Standard
This International Standard is applicable to any information system that performs attribute-based unlinkable entity authentication |
| Documentation | https://www.iso.org/standard/44373.html |
| Calendar |
1st WD provided in April 2017 2nd WD provided in Dec 2017 3rd WD provided in July 2018 4th WD provided in February 2019 1st CD provided in October 2019 DIS provided in November 2019 FDIS provided in September 2020 Published in September 2021 |
| Comments |
27555:2021 IS Guidelines on Personally Identifiable Information Deletion
| Editor |
Dorotea Alessandra de Marco, Yan Sun, Volker Hammer |
| Scope |
This document specifies the conceptual framework for deletion of PII. It gives guidelines for establishing organizational policies that embrace concepts presented by specifying:
This document is intended to be used by organizations where PII and other personal data is being stored or processed. This document does not address:
|
| Documentation | https://www.iso.org/fr/standard/71673.html |
| Calendar |
1st WD provided in March 2019 2nd WD provided in June 2019 1st CD provided in December 2019. Title changed (former title: establishing a PII deletion concept in organisations) 2nd CD was published in June 2020 DIS was provided in January 2021 FDIS was provided in April 2021 Publication in October 2021 |
| Comments | It is based on a German standard |
27556:2022 IS User-centric privacy preferences management framework
| Editor |
Shinsaku Kiyomoto, Antonio Kung, Heung Youl Youm |
| Scope |
This document provides a user-centric framework for handling personally identifiable information (PII), based on privacy preferences. |
| Calendar |
Established in Gjovik (October 2018) 1st WD provided In June 2019 2nd WD provided in December 2019 1st CD provided in May 2020 2nd CD provided in October 2020 3rd CD provided in April 2021 DIS provided in October 2021 FDIS provided in May 2022 Publication in October 2022 |
| Documentation | https://www.iso.org/standard/71674.html |
| Comments | Project named changed from "User-centric framework for the handling of personally identifiable information (PII) based on privacy preferences" to "User-centric privacy preferences management framework" |
27557:2022 IS Organizational privacy risk management
| Editor |
Kimberly Lucy, Markus Gierschmann, Kelvin Magtalas, Carlo Harpes |
| Scope |
Provides guidelines for organizational privacy risk management. Designed to provide guidance to organizations processing personally identifiable information (PII) for integrating risks to the organization related to the processing of PII, including the privacy impact to individuals, as part of an organizational privacy risk management program. Assists in the implementation of a risk-based privacy program which can be integrated in the overall risk management of the organization, and supports the requirement for risk management as specified in management systems (such as ISO/IEC 27701:2019). |
| Documentation | https://www.iso.org/standard/71674.html |
| Calendar |
1 st WD was published in May 2020 2nd WD was published in October 2020 1st CD was published in April 2021 DIS was provided in October 2021 FDIS was provided in June 2022 Published in November 2022 |
27559:2022 IS Privacy-enhancing data de-identification framework
| Editor | Malcolm Townsend, Santa Borel |
| Scope |
This document provides a framework for identifying and mitigating re-identification risks and risks associated with the lifecycle of de-identified data. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations implementing data de-identification processes for privacy enhancing purposes. |
| Documentation | https://www.iso.org/standard/71677.html |
| Calendar |
1st WD was provided in July 2020 2nd WD was provided in February 2021 1st CD was prrovided in April 2021 DIS was provided in October 2021 FDIS was provided in June 2022 Published in November 2022 |
27563:2023 TR Security and privacy in artificial intelligence use cases - Best practices
| Leaders | Antonio Kung, Peter Dickman, Heung Youl Youm, Yunwei Zhao, Volker Smoljko, Kelvin Magtalas, Srinivas Poorsala |
| Objective |
This document provides information on how to assess the impact of security and privacy in AI use cases, covering in particular those published in ISO/IEC TR 24030 (Information technology – Artificial Intelligence (AI) – use cases) |
| Documentation | https://www.iso.org/standard/80396.html
ISO/IEC 24030 covers 132 use cases that are described here: https://standards.iso.org/iso-iec/tr/24030/ed-1/en/Use+cases-v05_electronic_attachment_022021.pdf ISO/IEC 27563 covers the security of privacy of the 132 use cases, described here: https://standards.iso.org/iso-iec/tr/27563/ed-1/en/Security-privacy-AI-use-cases.pdf |
| Calendar |
Established in October 2021 Draft TR was provided in December 2021 Further to March 2022 meeting, title is changed from Impact of security and privacy in AI use cases to security and privacy in AI use cases, and 2nd Draft TR was provided in May 2022 3rd draft DTR was provided in September 2022 Further to April 2023 meeting, publication was mede in May 2023 |
| Comments |
It is the result of phase 1 of PWI 6089 Impact of AI on security and privacy |
27570:2021 TS Privacy Guidelines for Smart Cities
| Editor | Antonio Kung, Heung Youl Youm, Clotilde Cochinaire |
| Scope |
The document takes into account a multiple agency as well as a citizen centric viewpoint, and provides guidance on how privacy standards can be used at a global level and at an organisational level for the benefit of citizens This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, that provides service in the smart city environments |
| Documentation | https://www.iso.org/standard/71678.html |
| Calendar |
1st WD was provided in June 2018 further the Wuhan meeting. 2nd WD was provided in October 2018 further to the Gjovik meeting. A 1st PDTS was provided in May 2019 further to the Tel Aviv meeting. A 2nd PDTS was provided in November 2019 further to the Paris meeting A 3rd PDTS was provided in May 2020 further to the April 2020 virtual meeting The document will go to publication further to the September 2020 virtual meeting. The standard was published in January 2021 see following press release: https://www.iso.org/news/ref2631.html |
| Comments |
First ecosystem oriented standard for privacy Follow up of SP Privacy in Smart cities Liaison will take place with WG11 (smart cities), SC40 (IT Service Management and IT Governance), TC268/SC1/WG4 (sustainable cities and communities), EIP-SCC (European Innovation Platform - Smart Cities and Communities) |
27701:2019 IS Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines
| Editor |
Alan Shipman, Oliver Weissmann, Srinivas Poosarla, Heung Youl Youm |
| Scope |
This document specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization. In particular, this document specifies PIMS-related requirements and provides guidance for PII controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are PII controllers and/or PII processors processing PII within an ISMS. Excluding any of the requirements specified in clause 5 of this document is not acceptable when an organization claims conformity to this document. |
| Documentation | https://www.iso.org/standard/71670.html |
| Calendar |
1st WD provided in April 2017 2nd WD provided in June 2017 1st CD provided in April 2018 2nd CD provided in June 2018 DIS provided in March 2019 Publication in August 2019 A revision has been initiated in 2022-10 Further to April 2023 mode, a Final Draft International Standard (FDIS) will be provided |
| Comments |
Was initially ISO/IEC 27552. Was renamed to ISO/IEC 27701 in August 2019 |
29100:2011 IS Privacy framework
| Editor |
Stefan Weiss Revision : Nat Sakimura |
| Scope | This International Standard provides a framework for defining privacy control requirements related to personally identifiable information within an information and communication technology environment.This International Standard is designed for those individuals who are involved in specifying, procuring, architecting, designing, developing, testing, administering and operating ICT systems. |
| Documentation | Is a free standard : see http://standards.iso.org/ittf/PubliclyAvailableStandards/index.html |
| Comments |
In the Tampa meeting, a recommendation was made to go for a review (see below study period) A number of limited modifications have been identified in the Abu Dhabi that will lead to an amendment work The amended version will be available further to the Berlin meeting |
29101:2018 IS Privacy architecture framework
| Editor |
Stefan Weiss and Dan Bogdanov, For revision: Nat Sakimura, Shinsaku Kiyomoto |
| Scope |
This International Standard describes a privacy architecture framework that
This International Standard is applicable to entities involved in specifying, procuring, architecting, designing, testing, maintaining, administering and operating ICT systems that process PII. It focuses primarily on ICT systems that are designed to interact with PII principals. |
| Documentation | https://www.iso.org/standard/75293.html |
| Comments | Revision initiated in Berlin (November 2017) |
29134:2017 IS Guidelines for Privacy impact assessment
| Editor | Mathias Reinis |
| Scope |
This Standard establishes guidelines for the conduct of privacy impact assessments that are used for the protection of personally identifiable information (PII). It should be used by organizations that are establishing or operating programs or systems that involve the processing of PII, or that are making significant changes to existing programs or systems. This International Standard also provides guidance on privacy risk treatment options. Privacy Impact Assessments can be conducted at various stages in the life cycle of a programme or systems ranging from the prelaunch phase and decommissioning. In particular, it will provide a framework for privacy safeguarding and specific method for privacy impact assessment. It will be applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations and will be relevant to any staff involved in designing or implementing projects which will have an impact on privacy within an organization, including operating data processing systems and services and, where appropriate, external parties supporting such activities. This Standard describes privacy risk assessment as introduced by ISO/IEC 29100:2011. For the basic elements of the privacy framework and the privacy principles, reference is made to ISO/IEC 29100:2011. For principles and guidelines on risk management, reference is made to ISO 31000:2009. |
| Documentation | https://www.iso.org/standard/62289.html |
| Calendar | Published in June 2017 |
| Comments |
29151:2017 IS Code of Practice for PII Protection (also a ITU document - ITU-T X.1058)
| Editor | Heung Youl Youm, Alan Shipman |
| Scope |
This International Standard establishes commonly accepted control objectives, controls and guidelines for implementing controls, to meet the requirements identified by a risk and impact assessment related to the protection of Personally Identifiable Information (PII). In particular, this International Standard specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for processing PII which may be applicable within the context of an organization's information security risk environment(s). This International Standard is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which process PII, as part of their information processing. |
| Documentation |
March 3rd presentation made by editor during an informal confcall with Dawn Jutla (OASIS) and Antonio Kung (PRIPARE): http://ipen.trialog.com/wiki/File:X.gpim-29151_oasis.pdf |
| Calendar | Published in August 2017 |
| Comments | Also an ITU reference (ITU-T X.gpim) |
29184:2020 IS Online privacy notices and consent
| Editor |
Nat Sakimura, Srinivas Poorsala, Jan Schallaboeck |
| Scope |
This document is a specification for the content and the structure of online privacy notices as well as the process of requesting consent to collect and process PII from a PII principal. This document is applicable to all situations, where a PII controller or any other entity processing PII interacts with PII principals in any online context. |
| Documentation | https://www.iso.org/standard/71678.html |
| Calendar |
1st WD provided in June 2016 2nd WD provided in April 2017 3rd WD provided in June 2017 1nd CD provided in December 2017 2nd CD provided in July 2018 3rd CD provided in January 2019 DIS provided in April 2019 FDIS provided in May 2020 Published in June 2020 |
| Comments |
initiated in Jaipur (Oct 2015) Follows Study Period initiated in Kuching (May 2015) User friendly online privacy notice and consent |
29190:2015 IS Privacy capability assessment model
| Editor | Alan Shipman |
| Scope |
This International Standard provides organizations with high-level guidance about how to assess their capability to manage privacy-related processes. In particular, it:
|
| Documentation | https://www.iso.org/standard/45269.html |
| Calendar | |
| Comments |
29191:2012 IS Requirements for partially anonymous, partially unlinkable authentication
| Editor |
Kazue Sako (NEC) |
| Scope |
This International Standard defines requirements on relative anonymity with identity escrow based on the model of authentication and authorization using group signature techniques. This document provides guidance to the use of group signatures for data minimization and user convenience. This guideline is applicable in use cases where authentication or authorization is needed. It allows the users to control their anonymity within a group of registered users by choosing designated escrow agents. |
| Documentation | https://www.iso.org/standard/45270.html |
| Comments |
Published in December 2012 Under pre-revie |
31700-1 IS Consumer Protection - Privacy-by-design for consumer goods and services - High level requirements
| Editor |
Project leader: Michelle Chibba |
| Scope |
Specification of the design process to provide consumer goods and services that meet consumers’ domestic processing privacy needs as well as the personal privacy requirements of Data Protection. In order to protect consumer privacy the functional scope includes security in order to prevent unauthorized access to data as fundamental to consumer privacy, and consumer privacy control with respect to access to a person’s data and their authorized use for specific purposes. The process is to be based on the ISO 9001 continuous quality improvement process and ISO 10377 product safety by design guidance, as well as incorporating privacy design JTC1 security and privacy good practices, in a manner suitable for consumer goods and services |
| Documentation | See https://www.iso.org/standard/76402.html |
| Calendar |
|
| Versions |
|
| Comments |
Note that this is an ISO standard managed by the PC 317 technical committee that is chaired by Jan Schallaboek Further to the Seventh meeting, a proposal was made to provide a technical report on use cases. 31700 would be changed into a multipart standard ISO 31700-1 Privacy-by-design for consumer goods and servives - high level requirements ISO 31700-2 Privacy-by-design for consumer goods and servives - use cases
see launch event : https://www.eventbrite.co.uk/e/launch-event-iso-31700-privacy-by-design-for-consumer-goods-and-services-tickets-488718479127 |
31700-2 TR Consumer Protection - Privacy-by-design for consumer goods and services - Use cases
| Editor |
Project leader: Michelle Chibba Draft provided by AhG use cases: Antonio Kung (Ahg Convenor), Rae Dulmage, Peter Esisenegger, Gail Magnusson, Rusne Juozapaitene, Dorotea de Marco |
| Scope |
This document provides suggestions on how to use ISO 31700-1 as well as use cases illustrating the application of ISO 31700-1. The intended audience includes engineers and practitioners who are involved in the development, implementation or operation of digitally enabled consumer goods and services. |
| Documentation | See https://www.iso.org/standard/76402.html |
| Calendar |
|
| Versions |
|
| Comments |
Includes 3 use case: on-line retainling, fitness company, and smart locks. Note that the last two use cases are IoT use cases see launch event : https://www.eventbrite.co.uk/e/launch-event-iso-31700-privacy-by-design-for-consumer-goods-and-services-tickets-488718479127 |
Standards in development
5181 IS Security and privacy - Data provenance
| Editor | Ryan Ko, Jan de Meer, Yi Zhang |
| Scope |
This document provides guidelines, methodology and techniques for deriving securely information called meta-data, from sources, intermediaries and users creating, manipulating, and transforming data. The meta-data derived from data creations and transformations serves for earning trust in entities and stakeholders during the whole lifecycle of data use and data manipulations. By referring to provenance meta-data an information respectively a decision base is provided to processes or, to individuals. Provenance meta-data of data records can also be applied from both, processes, or individuals when they have to decide which one of their data, they want to make voluntarily available to the public as a common good and which one not. |
| Documentation | https://www.iso.org/standard/80971.html |
| Calendar | Started in February 2023 |
| Comments | Follow-up of PWI 5181 Data provenance
1st WD was provided in March 2023 2nd WD was provided in August 2023 |
27006-2 IS Requirements for bodies providing audit and certification of information security management systems – Part 2: Privacy information management systems
| Editor | Kimberly Lucy, Fuki Azetsu, Gigi Robinson | |
| Scope |
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701 in combination with ISO/IEC 27001, in addition to the requirements contained within ISO/IEC 27006-1. It is primarily intended to support the accreditation of certification bodies providing PIMS certification. The requirements contained in this document need to be demonstrated in terms of competence and reliability by any body providing PIMS certification, and the guidance contained in this document provides additional interpretation of these requirements for any body providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes. | |
| Documentation | https://www.iso.org/standard/82894.html | |
| Calendar |
1st CD was provided in May 2022 2nd CD was provided in November 2022 DIS was provided in May 2023 Further to October 2023 meeting, FDIS to be provided | |
| Comments |
Follow-up of ISO/IEC 27006-2 TS |
27091 IS Cybersecurity and privacy - Artificial Intelligence - Privacy Protection
| Editor | Lenora Zimmerman, Antonio Kung, Byoung-Moon Chin |
| Scope |
This document provides guidance for organizations to address privacy risks in artificial intelligence (AI) systems and machine learning (ML) models. The guidance in this document helps organizations identify privacy risks throughout the AI system lifecycle, and establishes mechanisms to evaluate the consequences of and treat such risks. This document is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations that develop or use AI systems. |
| Documentation | https://www.iso.org/standard/56582.html |
| Calendar | Project started in February 2023 |
| Comments | Follow-up of PWI 6089 Impact of Artificial Intelligence on Security and Privacy
Is also the counterpart of ISO/IEC 27090 Cybersecurity and privacy — Artificial Intelligence — Guidance for addressing security threats and failures in artificial intelligence systems (under development) 1st WD was provided in May 2023 Further to October 2023 meeting, 2nd WD will be provided |
27402 IS IoT security and privacy - Device baseline requirements
| Editor | Elaine Newton, Amit Elazari Bar On, Faud Khan |
| Scope |
This document provides baseline ICT requirements for IoT devices to support security and privacy controls |
| Documentation | https://www.iso.org/standard/80136.html |
| Calendar |
1st WD was provided in May 2020 1st CD was provided in November 2020 2nd CD was provided in July 2021 DIS was provided in December 2022 FDIS was provided in October 2023 Publication in November 2023 |
| Comments | Is a WG4 project. Delay between 2nd CD and DIS was due to discussions on requirements conformance (e.g. 27402 focuses on device requirements rather than device developer requirements) |
27403 IS Security techniques - ioT security and privacy - Guidelines for IoT domotics
| Editor |
Qin QIu, Yanghuichen Lin, Luc Poulin |
| Scope |
This proposal provides guidelines to analyse security and privacy risks and identifies controls that need to be implemented in IoT domotis systems |
| Documentation | https://www.iso.org/standard/78702.html |
| Calendar |
Started in Paris October 2018 with a preliminary version 1st WD provided in October 2019 2nd WD provided in May 2020 3rd WD and 4th WD provided in March 2021 4th WD was provided in April 2021 5th WD was provided in May 2021 6th WD was provided in July 2021 1st CD was provided in January 2022 2nd CD war provided in June 2022 DIS was provided in October 2021 |
| Comment | Is a WG4 project |
27560 TS Privacy technologies – Consent record information structure
| Editor | Jan LIndquist, Andrew Hughes, Kelvin Magtalas |
| Scope |
This document specifies an interoperable, open and extensible information structure for recording PII Principals' or data subjects' consent to data processing. This document further provides guidance on the use of consent receipts and consent records associated with a PII Principal's data processing consent to support the: — provision of a record of the consent to the PII Principal; — exchange of consent information between information systems; and, — management of the lifecycle of the recorded consent. |
| Documentation | https://www.iso.org/standard/80392.html |
| Calendar |
1st WD was provided in May 2020 2nd WD was provided in January 2021 3rd WD was provided in April 2021 4th WD was provided in October 2021 5th WD was provided in June 2022 DTS was provided in October 2022, publication is pending |
27561 IS POMME Privacy operationalization model and method for engineering
| Leaders | John Sabo, Antonio Kung, Srinivas Poorsala, Dorotea Alessandra de Marco, Aswathy KUMAR |
| Objective |
This document describes a model and method to operationalize privacy principles into sets of controls and functional capabilities.
|
| Documentation | https://www.iso.org/standard/80394.html |
| Calendar |
1st WD was published in April 2021 2nd WD was published in October 2021 1st CD was published in May 2022 2nd CD was published in November 2022 Further to April 2023 plenary, DIS to be provided |
| Comments |
It the result of the study period privacy engineering model It is based on OASIS-PMRM http://docs.oasis-open.org/pmrm/PMRM/v1.0/cs02/PMRM-v1.0-cs02.html |
27562 IS Privacy guidelines for Fintech services
| Leaders | Heung Youl Youm, Janssen Esguerra |
| Objective |
This document provides guidelines on privacy for Fintech services. It identifies all relevant business models and roles in consumer-to-business relation as well as in business-to-business relation, privacy risks, and privacy requirements, which are related to Fintech services. It also considers regulatory requirements, such as those from anti-money laundering, fraud detection, and countering terrorist financing. It provides privacy controls specific to Fintech services to address the privacy risks, taking in consideration the legal context of the respective business role. The principles are based on the ones described in ISO/IEC 29100 and ISO/IEC 27701 and privacy impact assessment framework described in ISO/IEC 29134 and ISO 31000. It also provides guidelines focussing a set of privacy requirements for each stakeholder. This document can be applicable to all kinds of organisations such as regulators, Institutions, service providers and product providers in the Fintech service environment. |
| Documentation | https://www.iso.org/standard/80395.html |
| Calendar |
1st WD was provided in April 2021 2nd WD was provided in October 2021 3rd WD was provided in May 2022 Further to April 2023 metting, CD will be provided |
| Comments |
It the result of the study period privacy guidelines for Fintech services |
27565 IS Guidance on privacy preservation based on zero-knowledge proofs
| Leaders |
Bingsheng Zhang, Patrick Curry, Srinivas Poosarla |
| Objective |
This document provides guidelines on using zero knowledge proofs (ZKP) to improve privacy by reducing the risks associated with the sharing or transmission of personal data between organisations and users by minimizing the information shared. It will include several ZKP |
| Documentation | https://www.iso.org/standard/80398.html |
| Calendar |
Established in October 2021 1st WD provided in June 2022 2nd WD provided in November 2022 Further to April 2023 meeting, 3rd WD will be provided |
| Comments |
It the result of PWI 7758 Guidance on privacy preservation based on zero knowledge proofs |
27566 IS Age assurance - Framework
| Leaders |
Tony Allen |
| Scope |
This document establishes core principles, including privacy, for the purpose of enabling age related eligibility decisions, by setting out a framework for indicators of confidence about age or an age range of a natural person. |
| Documentation | https://www.iso.org/standard/80399.html |
| Calendar |
Started in February 2023 Further to April 2023, 1st working draft to be provided |
| Comments |
It the result of PWI 7732 Age verification |
Active Preliminary Work Items
PWI 7709 Security and privacy reference architecture for multi-party data fusion and mining (Started in April 2021)
| Leaders |
Xiaoyuan Bai, Jin Peng |
| Objective |
This document provides the followings:
|
| Documentation | |
| Calendar |
|
| Comments |
Is a WG4 project |
PWI 27045 Big data security and privacy - guidelines for data security management framework (Started in April 2021)
| Editor |
Xiaoyuan Bai - Hongru Zhu - Vicky Hailey - Shiqi Li - Liu Dapeng |
| Scope |
This document provides a data security management framework that helps organizations to build the data security capabilities in the context of big data including guidelines to develop security measures. This document is applicable to all organizations, regardless of type, size or nature, that develop or use big data systems. |
| Documentation | https://www.iso.org/standard/63929.html |
| Calendar |
|
| Comments |
Is a WG4 project. An initial projects was started in October 2018 on processes with a different scope:
It seems that the project will focus on security only |
PWI 27046 Big data security and privacy - Implementation guidelines (restarted in April 2023)
| Editor | Le Yu, Victoria Hailey, Jinghua Min |
| Scope |
This proposal aims to analyze challenges and risks of big data security and privacy, and proposes guidelines for implmentation of big data secuirty and privacy in aspects of big data resources, and organizing, distributing, computing and destroying big data |
| Documentation | https://www.iso.org/standard/78572.html |
| Calendar |
1st WD was provided in October 2019 2nd WD was provided in June 2020 3rd WD was provided in November 2020 4th WD was provided in April 2021 5th WD was provided in April 2022 1st CD was provided in October 2022 Further to April 2023 meeting, this project will be reverted to preliminary work item (PWI)
|
| Comments | Is a WG4 project |
PWI 27564 Privacy models (Started in October 2021)
| Leaders |
Yod Samuel Martin, Antonio Kung, Jonathan Fox, Michelle Chibba |
| Objective |
Scope: PWI will study the value of specifying and maintaining privacy models Tasks:
|
| Documentation |
|
| Calendar |
|
| Comments |
Initiated as a result of the H2020 project PDP4E A report was provided at the April 2023 meeting. Further to this meeting a proposal for a technical specification will be prepared |
PWI 27568 Security and privacy of digital twins (Started in October 2022)
| Leaders |
Antonio Kung, Srinivas Poosarla, Heung Youl Youm, Mark Lizar, Vitor Jesus, Vishnu Kanhere, Patrick Curry, Karim Tobich |
| Objective |
The PWI will monitor the progress in standardisation work on digital twins and investigate stakeholders concerns on the security and privacy of digital twins. A call for contributions will circulated to SC 27/WG 5, and liaison will take place with SC41. A report and recommendation for further work will be prepared for discussion in the next meeting. A report was provided at the April 2023 meeting. |
| Documentation |
|
| Calendar |
|
| Comments |
Needs to liaise with on-going work in ISO/IEC JTC 1/SC 41 IoT and digital twins |