Information security standards

Last updated

Information security standards (also cyber security standards [1] ) are techniques generally outlined in published materials that attempt to protect a user's or organization's cyber environment. [2] This environment includes users themselves, networks, devices, all software, processes, information in storage or transit, applications, services, and systems that can be connected directly or indirectly to networks.

Contents

The principal objective is to reduce the risks, including preventing or mitigating cyber-attacks. These published materials comprise tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance, and technologies.

History

Cybersecurity standards have existed over several decades as users and providers have collaborated in many domestic and international forums to effect the necessary capabilities, policies, and practices – generally emerging from work at the Stanford Consortium for Research on Information Security and Policy in the 1990s. [3]

A 2016 US security framework adoption study reported that 70% of the surveyed organizations use the NIST Cybersecurity Framework as the most popular best practice for Information Technology (IT) computer security, but many note that it requires significant investment. [4] Cross-border, cyber-exfiltration operations by law enforcement agencies to counter international criminal activities on the dark web raise complex jurisdictional questions that remain, to some extent, unanswered. [5] [6] Tensions between domestic law enforcement efforts to conduct cross-border cyber-exfiltration operations and international jurisdiction will likely continue to provide improved cybersecurity norms. [5] [7]

International Standards

The subsections below detail international standards related to cybersecurity.

ISO/IEC 27000 Family of Standards

The ISO/IEC 27000 series is a family of international standards jointly published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). These standards provide a globally recognized framework for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The series is designed to help organizations of all sizes and industries protect their information assets systematically and cost-effectively.

At the center of the ISO/IEC 27000 series is ISO/IEC 27001 , which specifies the requirements for establishing and maintaining an ISMS. [8] The standard emphasizes a risk-based approach to managing information security, encouraging organizations to identify, assess, and mitigate risks specific to their operational environment. The ISO/IEC 27000 series is built upon the Plan-Do-Check-Act (PDCA) cycle, a methodology aimed at continuous improvement.

While ISO/IEC 27001 sets the baseline for ISMS requirements, other standards in the series provide complementary guidelines and sector-specific recommendations. Together, they form a comprehensive ecosystem that addresses everything from risk assessment and incident management to privacy controls and cloud security.

Supporting ISO/IEC 27001 is ISO/IEC 27002, which serves as a practical guide for implementing the controls outlined in ISO/IEC 27001. It provides detailed recommendations and best practices for managing information security risks across different domains, including human resource security, physical security, and network security. [9]

For organizations focused on risk management, ISO/IEC 27005 offers a dedicated framework for identifying, assessing, and treating information security risks. It complements ISO/IEC 27001 by providing a methodology specifically tailored to managing information security vulnerabilities. [10]

In recent years, cloud computing has introduced unique security challenges, and ISO/IEC 27017 was developed to address these concerns. [11] This standard provides guidelines for implementing cloud-specific information security controls, ensuring secure use of cloud services by both cloud providers and customers. Alongside it, ISO/IEC 27018 focuses on protecting personally identifiable information (PII) in public cloud environments, helping organizations meet privacy regulations and maintain customer trust. [12]

Additionally, ISO/IEC 27035 addresses incident management, offering guidance on how to effectively prepare for, detect, and respond to security incidents. It emphasizes structured incident response processes to minimize potential damage and ensure timely recovery. [13]

With the rise of data privacy regulations such as the General Data Protection Regulation (GDPR), ISO/IEC 27701 was introduced as an extension of ISO/IEC 27001 and ISO/IEC 27002. This standard provides guidelines for establishing and operating a Privacy Information Management System (PIMS), aligning information security management with privacy and data protection requirements. [14]

ISO/IEC 15408

The Common Criteria for Information Technology Security Evaluation (Common Criteria or CC) is an international standard (ISO/IEC 15408) used to assess and certify the security properties of IT products and systems. It provides a globally recognized framework for defining security requirements, implementing protective measures, and evaluating whether these measures meet specified criteria.

ISO/IEC 15408 is divided into five parts:

Certification under Common Criteria is facilitated by the Common Criteria Recognition Arrangement (CCRA), ensuring mutual recognition of certifications among participating countries. This reduces duplication of effort and cost for vendors seeking global market access. [20]

The EU has adopted the European Cybersecurity Certification Scheme (EUCC), which is based on ISO/IEC 15408, to align with international standards while addressing regional requirements. [21]

IEC 62443

The IEC 62443 cybersecurity standard defines processes, techniques and requirements for Industrial Automation and Control Systems (IACS). Its documents are the result of the IEC standards creation process where all national committees involved agree upon a common standard. All IEC 62443 standards and technical reports are organized into six general categories: General, Policies and Procedures, System,Component, Profiles, and Evaluation.

  1. The first category includes foundational information such as concepts, models, and terminology.
  2. The second category of work products targets the Asset Owner. These address various aspects of creating and maintaining an effective IACS security program.
  3. The third category includes work products that describe system design guidelines and requirements for the secure integration of control systems. The core of this is the zone, conduit, and design model.
  4. The fourth category includes work products that describe the specific product development and technical requirements of control system products.
  5. The fifth category provides profiles for industry-specific cybersecurity requirements according to IEC 62443-1-5.
  6. The sixth category defines assessment methodologies that ensure that assessment results are consistent and reproducible.

ISO/SAE 21434

ISO/SAE 21434 "Road vehicles - Cybersecurity engineering" is a cybersecurity standard jointly developed by ISO and SAE working groups. It proposes cybersecurity measures for the development lifecycle of road vehicles. The standard was published in August 2021. [22]

The standard is related to the European Union (EU) regulation on cyber security that is currently being developed. In coordination with the EU, the UNECE has created a Cyber Security Management System (CSMS) certification mandatory for vehicle-type approval. This is defined in the overarching UN Regulation 155; ISO/SAE 21434 is a technical standard for automotive development which can demonstrate compliance with those regulations.

A derivative of this is in the work of UNECE WP29, which provides regulations for vehicle cybersecurity and software updates. [23]

ETSI EN 303 645

The ETSI EN 303 645 standard provides a set of baseline requirements for security in consumer Internet of Things (IoT) devices. It contains technical controls and organizational policies for developers and manufacturers of Internet-connected consumer devices. The standard was released in June 2020 [24] and is intended to complement other, more specific standards. As many consumer IoT devices handle personally identifiable information (PII), implementing the standard helps comply with the EU's General Data Protection Regulation (GDPR) in the EU. [25]

The Cybersecurity provisions in this European standard are:

  1. No universal default passwords
  2. Implement a means to manage reports of vulnerabilities
  3. Keep software updated
  4. Securely store sensitive security parameters
  5. Communicate securely
  6. Minimize exposed attack surfaces
  7. Ensure software integrity
  8. Ensure that personal data is secure
  9. Make systems resilient to outages
  10. Examine system telemetry data
  11. Make it easy for users to delete user data
  12. Make installation and maintenance of devices easy
  13. Validate input data

Conformance assessment of these baseline requirements is via the standard TS 103 701, which allows self-certification or certification by another group. [26]

EN 18031

The EN 18031 series of standards, published by the European Committee for Standardization (CEN) in cooperation with the European Committee for Electrotechnical Standardization (CENELEC), outlines essential information security requirements for radio-based devices and systems. By aligning with the Radio Equipment Directive (2014/53/EU) and its accompanying Delegated Act, these standards support manufacturers and stakeholders in maintaining compliance and consistency across European markets. They also establish common testing protocols, performance criteria, and security guidelines, thereby aiding cross-border interoperability and addressing evolving industry needs.

National Standards

The subsections below detail national standards and frameworks related to cybersecurity.

NERC CIP

The North American Electric Reliability Corporation (NERC) is responsible for developing and enforcing cybersecurity standards to protect the reliability and security of the North American bulk power system, which spans the United States, Canada, and northern Baja California, Mexico. [27]

Its standards focus on cybersecurity measures for critical assets, including asset identification, electronic security perimeters, personnel training, incident response, and recovery planning. The key cybersecurity standards are defined in the Critical Infrastructure Protection (CIP) series, specifically CIP-002 to CIP-014. [28]

Compliance with these standards is mandatory for power system operators and owners under NERC’s jurisdiction, with enforcement overseen by the Federal Energy Regulatory Commission (FERC) in the United States. Non-compliance can result in significant financial penalties.

NIST Cybersecurity Standards

The National Institute of Standards and Technology (NIST), a U.S. federal agency under the Department of Commerce, plays a central role in developing and maintaining cybersecurity standards, guidelines, and best practices. Initially created to ensure the security of federal information systems, NIST's standards have become globally influential, serving as foundational references for cybersecurity programs across industries and countries.

NIST's approach emphasizes a risk-based methodology, focusing on five core functions: Identify, Protect, Detect, Respond, and Recover. These principles form the backbone of many of its guidelines and frameworks, enabling organizations to assess and manage cybersecurity risks effectively. While federal agencies are mandated to comply with NIST standards, private organizations across finance, healthcare, manufacturing, and other sectors often adopt them voluntarily due to their clarity, flexibility, and comprehensiveness.

The NIST Cybersecurity Framework (CSF)

One of NIST's most influential contributions is the Cybersecurity Framework (CSF) , first published in 2014 and updated in 2024 (CSF 2.0). Developed in response to growing cyber threats and the need for standardized practices, the CSF provides a risk-based approach to managing cybersecurity risks. It is structured around five core functions: Identify, Protect, Detect, Respond, and Recover, each representing a critical phase in cybersecurity risk management. [29]

The CSF serves as a universal guide, designed to be adaptable across organizations of all sizes and sectors. Its adoption extends far beyond U.S. federal agencies, with companies worldwide leveraging the framework to improve their cybersecurity resilience.

Special Publications (SP)

NIST publishes a series of Special Publications (SP), which provide technical guidelines for specific aspects of cybersecurity. Among the most significant is SP 800-53, titled "Security and Privacy Controls for Federal Information Systems and Organizations." [30] This publication outlines a comprehensive set of controls addressing areas such as access control, incident response, system integrity, and encryption. It serves as the cornerstone for securing federal information systems and is often referenced in audits and compliance assessments.

Another critical standard is SP 800-171, which focuses on protecting Controlled Unclassified Information (CUI) in non-federal systems. It provides detailed requirements for organizations handling sensitive federal information, such as defense contractors and private sector partners. Compliance with SP 800-171 is often a prerequisite for participating in federal contracts. [31]

For the secure development of software, NIST introduced SP 800-218, known as the "Secure Software Development Framework (SSDF)." This document emphasizes integrating security throughout all stages of the software development lifecycle, from design to deployment and maintenance. [32]

Recognizing the unique challenges posed by Industrial Control Systems (ICS), NIST published SP 800-82, titled "Guide to Industrial Control Systems (ICS) Security." This guideline addresses the security of critical infrastructure systems, including SCADA systems, programmable logic controllers (PLCs), and other operational technology (OT) components. [33]

Federal Information Processing Standards (FIPS)

In addition to Special Publications, NIST develops Federal Information Processing Standards (FIPS). These standards are legally binding for U.S. federal agencies and cover critical areas such as cryptography and secure data handling. For example, FIPS 140-3, "Security Requirements for Cryptographic Modules," specifies security requirements for cryptographic systems and is widely adopted by both government and private sector organizations requiring robust encryption capabilities.

FIPS standards are not limited to federal use; they are frequently referenced in international compliance frameworks and form the basis for many commercial security products.

NCSC Cyber Essentials

Cyber Essentials is a United Kingdom government information assurance scheme operated by the National Cyber Security Centre (NCSC). It encourages organizations to adopt good practices in information security. Cyber Essentials also includes an assurance framework and a simple set of security controls to protect information from threats coming from the internet.

Essential Eight

The Australian Cyber Security Centre has developed prioritised mitigation strategies, in the form of the Strategies to Mitigate Cyber Security Incidents, to help organisations protect themselves against various cyber threats. The most effective of these mitigation strategies is called the Essential Eight. [34]

BSI IT-Grundschutz

The Federal Office for Information Security (German : Bundesamt für Sicherheit in der Informationstechnik, abbreviated as BSI) standards are an elementary component of the IT baseline protection (German : IT-Grundschutz) methodology. They contain recommendations on methods, processes, and procedures, approaches, and measures for various aspects of information security. Users from public authorities, companies, manufacturers, or service providers can use the BSI standards to make their business processes and data more secure. [35]

Industry-specific Standards

The subsections below detail cybersecurity standards and frameworks related to specific industries.

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. The PCI Standard is mandated by the card brands but administered by the Payment Card Industry Security Standards Council. The standard was created to increase controls around cardholder data to reduce credit card fraud.

UL 2900

UL 2900 is a series of standards published by UL. The standards include general cybersecurity requirements (UL 2900-1) as well as specific requirements for medical products (UL 2900-2-1), industrial systems (UL 2900-2-2), and security and life safety signalling systems (UL 2900-2-3).

UL 2900 requires manufacturers to describe and document the attack surface of the technologies used in their products. It requires threat modeling based on the intended use and deployment environment. The standard requires effective security measures that protect sensitive (personal) data and other assets, such as command and control data. It also requires that security vulnerabilities in the software have been eliminated, security principles, such as defense-in-depth have been followed, and the security of the software has been verified through penetration testing.

Organisations producing Standards

The International Organization for Standardization (ISO) is an international standards organization organized as a consortium of national standards institutions from 167 countries, coordinated through a secretariat in Geneva, Switzerland. ISO is the world's largest developer of international standards. The International Electrotechnical Commission (IEC) is an international standards organization that deals with electrotechnology and cooperates closely with ISO. ISO/IEC 15443: "Information technology – Security techniques – A framework for IT security assurance", ISO/IEC 27002: "Information technology – Security techniques – Code of practice for information security management", ISO/IEC 20000: "Information technology – Service management", and ISO/IEC 27001: "Information technology – Security techniques – Information security management systems – Requirements" are of particular interest to information security professionals.

The US National Institute of Standards and Technology (NIST) is a non-regulatory federal agency within the U.S. Department of Commerce. The NIST Computer Security Division develops standards, metrics, tests, and validation programs, and it publishes standards and guidelines to increase secure IT planning, implementation, management, and operation. NIST is also the custodian of the U.S. Federal Information Processing Standard publications (FIPS).

The Internet Society is a professional membership society with over 100 organizations and over 20,000 individual members in over 180 countries. It provides leadership in addressing issues that confront the future of the Internet, and it is the organizational home for the groups responsible for Internet infrastructure standards, including the Internet Engineering Task Force (IETF) and the Internet Architecture Board (IAB). The ISOC hosts the Requests for Comments (RFCs), including the Official Internet Protocol Standards and the RFC-2196 Site Security Handbook.

The German Federal Office for Information Security (in German Bundesamt für Sicherheit in der Informationstechnik (BSI)) BSI-Standards 100–1 to 100-4 are a set of recommendations including "methods, processes, procedures, approaches, and measures relating to information security". [36] The BSI-Standard 100-2 IT-Grundschutz Methodology describes how information security management can be implemented and operated. The standard includes a specific guide, the IT Baseline Protection Catalogs (IT-Grundschutz Catalogs). Before 2005, the catalogs were formerly known as "IT Baseline Protection Manual". The Catalogs are documents useful for detecting and combating security-relevant weak points in the IT environment (IT cluster). As of September 2013, the collection encompasses over 4,400 pages with the introduction and catalogs. The IT-Grundschutz approach is aligned with the ISO/IEC 2700x family.

The European Telecommunications Standards Institute standardized a catalog of information security indicators headed by the Industrial Specification Group (ISG) ISI.

See also

Related Research Articles

BS 7799 was a British standard "Code of Practice for Information Security Management", first published as such by the British Standards Institution (BSI) in February 1995. Read about the origins of BS 7799 here.

Security controls or security measures are safeguards or countermeasures to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. In the field of information security, such controls protect the confidentiality, integrity and availability of information.

ISO/IEC 27002 is an information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC), titled Information security, cybersecurity and privacy protection — Information security controls.

The ISO/IEC 27000 family comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

ISO/IEC 27006 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Part of the ISO/IEC 27000 series of ISO/IEC Information Security Management System (ISMS) standards, it is titled Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems.

'ISO/IEC 27007' — Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing is a standard providing guidance on:

Information technology risk, IT risk, IT-related risk, or cyber risk is any risk relating to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.

The IT baseline protection approach from the German Federal Office for Information Security (BSI) is a methodology to identify and implement computer security measures in an organization. The aim is the achievement of an adequate and appropriate level of security for IT systems. To reach this goal the BSI recommends "well-proven technical, organizational, personnel, and infrastructural safeguards". Organizations and federal agencies show their systematic approach to secure their IT systems by obtaining an ISO/IEC 27001 Certificate on the basis of IT-Grundschutz.

NIST Special Publication 800-53 is an information security standard that provides a catalog of privacy and security controls for information systems. Originally intended for U.S. federal agencies except those related to national security, since the 5th revision it is a standard for general usage. It is published by the National Institute of Standards and Technology, which is a non-regulatory agency of the United States Department of Commerce. NIST develops and issues standards, guidelines, and other publications to assist federal agencies in implementing the Federal Information Security Modernization Act of 2014 (FISMA) and to help with managing cost effective programs to protect their information and information systems.

Security information and event management (SIEM) is a field within computer security that combines security information management (SIM) and security event management (SEM) to enable real-time analysis of security alerts generated by applications and network hardware. SIEM systems are central to security operations centers (SOCs), where they are employed to detect, investigate, and respond to security incidents. SIEM technology collects and aggregates data from various systems, allowing organizations to meet compliance requirements while safeguarding against threats.

<span class="mw-page-title-main">Risk Management Framework</span> US federal government guideline

The Risk Management Framework (RMF) is a United States federal government guideline, standard, and process for managing risk to help secure information systems. The RMF was developed by the National Institute of Standards and Technology (NIST), and provides a structured process that integrates information security, privacy, and risk management activities into the system development life cycle. The RMF is an important aspect of a systems attainment of its Authority to Operate (ATO).

Control system security, or automation and control system (ACS) cybersecurity, is the prevention of interference with the proper operation of industrial automation and control systems. These control systems manage essential services including electricity, petroleum production, water, transportation, manufacturing, and communications. They rely on computers, networks, operating systems, applications, and programmable controllers, each of which could contain security vulnerabilities. The 2010 discovery of the Stuxnet worm demonstrated the vulnerability of these systems to cyber incidents. The United States and other governments have passed cyber-security regulations requiring enhanced protection for control systems operating critical infrastructure.

ISO/IEC 27001 is an international standard to manage information security. The standard was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005, revised in 2013, and again most recently in 2022. There are also numerous recognized national variants of the standard. It details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) – the aim of which is to help organizations make the information assets they hold more secure. Organizations that meet the standard's requirements can choose to be certified by an accredited certification body following successful completion of an audit.

The Open Trusted Technology Provider Standard (O-TTPS) is a standard of The Open Group that has also been approved for publication as an Information Technology standard by the International Organization of Standardization and the International Electrotechnical Commission through ISO/IEC JTC 1 and is now also known as ISO/IEC 20243:2015. The standard consists of a set of guidelines, requirements, and recommendations that align with best practices for global supply chain security and the integrity of commercial off-the-shelf (COTS) information and communication technology (ICT) products. It is currently in version 1.1. A Chinese translation has also been published.

The Annex SL is a section of the ISO/IEC Directives part 1 that prescribes how ISO Management System Standard (MSS) standards should be written. The aim of Annex SL is to enhance the consistency and alignment of MSS by providing a unifying and agreed-upon high level structure, identical core text and common terms and core definitions. The aim being that all ISO Type A MSS are aligned and the compatibility of these standards is enhanced.

The NIST Cybersecurity Framework (CSF) is a set of voluntary guidelines designed to help organizations assess and improve their ability to prevent, detect, and respond to cybersecurity risks. Developed by the U.S. National Institute of Standards and Technology (NIST), the framework was initially published in 2014 for critical infrastructure sectors but has since been widely adopted across various industries, including government and private enterprises globally. The framework integrates existing standards, guidelines, and best practices to provide a structured approach to cybersecurity risk management.

Cyber risk quantification involves the application of risk quantification techniques to an organization's cybersecurity risk. Cyber risk quantification is the process of evaluating the cyber risks that have been identified and then validating, measuring and analyzing the available cyber data using mathematical modeling techniques to accurately represent the organization's cybersecurity environment in a manner that can be used to make informed cybersecurity infrastructure investment and risk transfer decisions. Cyber risk quantification is a supporting activity to cybersecurity risk management; cybersecurity risk management is a component of enterprise risk management and is especially important in organizations and enterprises that are highly dependent upon their information technology (IT) networks and systems for their business operations.

ISO/IEC 27701:2019 is a privacy extension to ISO/IEC 27001. The design goal is to enhance the existing Information Security Management System (ISMS) with additional requirements in order to establish, implement, maintain, and continually improve a Privacy Information Management System (PIMS). The standard outlines a framework for Personally Identifiable Information (PII) Controllers and PII Processors to manage privacy controls to reduce the risk to the privacy rights of individuals.

Cybersecurity engineering is a tech discipline focused on the protection of systems, networks, and data from unauthorized access, cyberattacks, and other malicious activities. It applies engineering principles to the design, implementation, maintenance, and evaluation of secure systems, ensuring the integrity, confidentiality, and availability of information.

References

  1. ↑ "Guidelines for Smart Grid Cyber Security" (PDF). National Institute of Standards and Technology. September 2014. doi:10.6028/NIST.IR.7628r1 . Retrieved 28 November 2023.
  2. ↑ "ITU-T Recommendation database".
  3. ↑ "FSI - Consortium for Research on Information Security and Policy".
  4. ↑ "NIST Cybersecurity Framework Adoption Hampered By Costs, Survey Finds". 30 March 2016. Retrieved 2016-08-02.
  5. 1 2 Ghappour, Ahmed (2017-01-01). "Tallinn, Hacking, and Customary International Law". AJIL Unbound. 111: 224–228. doi: 10.1017/aju.2017.59 .
  6. ↑ Ghappour, Ahmed (2017-04-01). "Searching Places Unknown: Law Enforcement Jurisdiction on the Dark Web". Stanford Law Review. 69 (4): 1075.
  7. ↑ Ghappour, Ahmed (2017). "Searching Places Unknown: Law Enforcement Jurisdiction on the Dark Web". Stanford Law Review. 69 (4).
  8. ↑ "ISO/IEC 27001:2022". webstore.iec.ch. Retrieved 2024-12-30.
  9. ↑ "ISO/IEC 27002:2022". webstore.iec.ch. Retrieved 2024-12-30.
  10. ↑ "ISO/IEC 27005:2022". webstore.iec.ch. Retrieved 2024-12-30.
  11. ↑ "ISO/IEC 27017:2015". webstore.iec.ch. Retrieved 2024-12-30.
  12. ↑ "ISO/IEC 27018:2019". webstore.iec.ch. Retrieved 2024-12-30.
  13. ↑ "ISO/IEC 27035-1:2023". webstore.iec.ch. Retrieved 2024-12-30.
  14. ↑ "ISO/IEC 27701:2019". webstore.iec.ch. Retrieved 2024-12-30.
  15. ↑ "ISO/IEC 15408-1:2022". ISO. Retrieved 2024-12-30.
  16. ↑ "ISO/IEC 15408-2:2022". ISO. Retrieved 2024-12-30.
  17. ↑ "ISO/IEC 15408-3:2022". ISO. Retrieved 2024-12-30.
  18. ↑ "ISO/IEC 15408-4:2022". ISO. Retrieved 2024-12-30.
  19. ↑ "ISO/IEC 15408-5:2022". ISO. Retrieved 2024-12-30.
  20. ↑ "NIAP". www.niap-ccevs.org. Retrieved 2024-12-30.
  21. ↑ "EUCC Certification Scheme - EU Cybersecurity Certification". certification.enisa.europa.eu. Retrieved 2024-12-30.
  22. ↑ ISO/SAE 21434:2021 Road vehicles — Cybersecurity engineering
  23. ↑ "UN Regulations on Cybersecurity and Software Updates to pave the way for mass roll-out of connected vehicles | UNECE". unece.org.
  24. ↑ ETSI announcement
  25. ↑ ETSI EN 303 645 V2.1.0
  26. ↑ "ETSI TS 103 701 Cyber Security for Consumer Internet of Things: Conformance Assessment of Baseline Requirements" (PDF). ETSI.
  27. ↑ "About NERC". www.nerc.com. Retrieved 2024-12-30.
  28. ↑ "Reliability Standards". www.nerc.com. Retrieved 2024-12-30.
  29. ↑ "Cybersecurity Framework". NIST. 2013-11-12.
  30. ↑ Force, Joint Task (2020-12-10). Security and Privacy Controls for Information Systems and Organizations (Report). National Institute of Standards and Technology.
  31. ↑ Ross, Ron; Pillitteri, Victoria (2024-05-14). Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (Report). National Institute of Standards and Technology.
  32. ↑ "NIST SP 800-218, Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities".
  33. ↑ Stouffer, Keith; Pease, Michael; Tang, CheeYee; Zimmerman, Timothy; Pillitteri, Victoria; Lightman, Suzanne; Hahn, Adam; Saravia, Stephanie; Sherule, Aslam (2023-09-28). Guide to Operational Technology (OT) Security (Report). National Institute of Standards and Technology.
  34. ↑ "Essential Eight Maturity Model". Australian Cyber Security Centre. Retrieved 29 September 2022. CC-BY icon.svg Text was copied from this source, which is available under a Creative Commons Attribution 4.0 International License.
  35. ↑ "BSI - IT-Grundschutz". BSI (in German). Archived from the original on 2013-09-30. Retrieved 2021-03-26.
  36. ↑ "BSI-Standards". BSI. Archived from the original on 3 December 2013. Retrieved 29 November 2013.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.