List of drafts

ISO/IEC DIS 27007 Public enquiry

Comment end date 2026-09-01

Information security, cybersecurity and privacy protection — Guidelines for information security management systems auditing

Read draft and comment View

prEN ISO/IEC 27018 Public enquiry

Comment end date 2026-09-04

Information security, cybersecurity and privacy protection - Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors (ISO/IEC 27018:2025)

This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. In particular, this document specifies guidelines based on ISO/IEC 27002:2022, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations. The guidelines in this document can also be relevant to organizations acting as PII controllers.

View

prEN ISO/IEC 29100 Public enquiry

Comment end date 2026-09-04

Information technology - Security techniques - Privacy framework (ISO/IEC 29100:2024)

This document provides a privacy framework which: — specifies a common privacy terminology; — defines the actors and their roles in processing personally identifiable information (PII); — describes privacy safeguarding considerations; — provides references to known privacy principles for information technology. This document is applicable to natural persons and organizations involved in specifying, procuring, architecting, designing, developing, testing, maintaining, administering, and operating information and communication technology systems or services where privacy controls are required for the processing of PII

View

prEN ISO/IEC 27007 Public enquiry

Comment end date 2026-09-01

Information security, cybersecurity and privacy protection - Guidelines for information security management systems auditing (ISO/IEC DIS 27007:2026)

This document provides guidance on managing an information security management system (ISMS) audit programme, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011. This document is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme.

Read draft and comment View

ISO/IEC DIS 27004 Public enquiry

Comment end date 2026-09-01

Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation

Read draft and comment View

ISO/IEC DIS 25093-1 Public enquiry

Comment end date 2026-08-17

Cybersecurity — Confidential computing — Part 1: Overview and concepts

Read draft and comment View

ISO/IEC DIS 27045.2 Public enquiry

Comment end date 2026-07-24

Information security, cybersecurity and privacy protection — Big data security and privacy — Guidelines for managing big data risks

Read draft and comment View

ISO/IEC DIS 10267 Public enquiry

Comment end date 2026-08-16

Information technology — Data usage — Methods to quantify the amount of personal information in a dataset

Read draft and comment View

ISO/IEC DIS 25330-1 Public enquiry

Comment end date 2026-08-07

Information security — Oblivious transfer — Part 1: General

Read draft and comment View

ISO/IEC DIS 27555 Public enquiry

Comment end date 2026-08-05

Information security, cybersecurity and privacy protection — Guidelines on personally identifiable information deletion

Read draft and comment View

prEN ISO/IEC 27555 Public enquiry

Comment end date 2026-08-04

Information security, cybersecurity and privacy protection - Guidelines on personally identifiable information deletion (ISO/IEC DIS 27555:2026)

This document contains guidelines for developing and establishing policies and procedures for deletion of personally identifiable information (PII) in organizations by specifying: — a harmonized terminology for PII deletion; — an approach for defining deletion rules in an efficient way; — a description of required documentation; — a broad definition of roles, responsibilities and processes. This document is intended to be used by organizations where PII is stored or processed. This document does not address: — specific legal provision, as given by national law or specified in contracts; — specific deletion rules for particular clusters of PII that are defined by PII controllers for processing PII; — deletion mechanisms; — reliability, security and suitability of deletion mechanisms; — specific techniques for de-identification of data.

Read draft and comment View

prEN 18235-3 Public enquiry

Comment end date 2026-08-04

Trusted data transactions - Part 3: Interoperability requirements

This document specifies requirements and guidance for the interoperability of data, data sharing mechanisms, and services within data spaces. It covers requirements, criteria and implementation guidance on: - dataset content, use restrictions, licences, data collection methodology, data quality and uncertainty, and on machine-readable formats to find, access and use of data; - data structures, data formats, vocabularies, classification schemes, taxonomies and code lists, and how to describe these elements a publicly available and consistent manner; - technical means to access the data, such as application programming interfaces, and their terms of use and quality of service to enable automatic access and transmission of data between parties; - where applicable, the means to enable the interoperability of tools for automating the execution of data sharing contracts. This document is applicable to all organizations participating in dataspaces, regardless of their size or type.

Read draft and comment View

prEN 18229-1 Public enquiry

Comment end date 2026-08-02

AI trustworthiness framework - Part 1: Logging

This document provides terminology, concepts, requirements, and guidance for logging of AI systems. It is primarily intended for organizations placing on the market or putting into service AI systems and is not specific to any particular sector.

Read draft and comment View

prEN 40000-11 Public enquiry

Comment end date 2026-07-28

Essential cybersecurity requirements for products - Part 11: Hardware Devices with Security Boxes incorporating a hardware physical envelope and designed to provide security functions such as secure storage and cryptographic operations in an open environment

This document defines cyber security requirements for products with digital elements belonging to product category “Hardware Device with Security Boxes” (hereinafter called “Product” or “HWSB product”). The technical description of “Hardware Devices with Security Boxes” can be found in Annex II of [CRA]. The Hardware Devices with Security Boxes in scope are designed for deployment in a range of environments and where the threat landscape includes attackers with various attack potential. HWSB are hardware-based systems intended to provide secure storage, processing and use of sensitive data, including cryptographic assets, within a protected hardware boundary (envelope). This document applies to the HWSB part of the product. The applicability of this document to specific products is determined based on their intended purpose, use case and risk assessment.

Read draft and comment View

prEN ISO/IEC 24760-1 Public enquiry

Comment end date 2026-07-21

Information security, cybersecurity and privacy protection - A framework for identity management - Part 1: Core concepts and terminology (ISO/IEC 24760-1:2025)

This document: defines terms for identity management and specifies core concepts of identity and identity management, and their relationships; is applicable to any information system where information relating to identity is processed or stored; is considered to be a horizontal document for the following reasons: it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

Read draft and comment View

prEN ISO/IEC 24760-3 Public enquiry

Comment end date 2026-07-21

Information security, cybersecurity and privacy protection - A framework for identity management - Part 3: Practice (ISO/IEC 24760-3:2025)

This document: provides requirements and guidance for the management of identity information and for ensuring that an identity management system conforms to ISO/IEC 24760-1 and ISO/IEC 24760-2; is applicable to any information system where information relating to identity is processed or stored; is considered to be a horizontal document for the following reasons: it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

Read draft and comment View

prEN ISO/IEC 24760-2 Public enquiry

Comment end date 2026-07-21

Information security, cybersecurity and privacy protection - A framework for identity management - Part 2: Reference architecture and requirements (ISO/IEC 24760-2:2025)

This document: provides guidelines for the implementation of systems for the management of identity information; specifies requirements for the implementation and operation of a framework for identity management; is applicable to any information system where information relating to identity is processed or stored; is considered to be a horizontal document for the following reasons: it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.

Read draft and comment View

prEN 17926 Public enquiry

Comment end date 2026-07-14

Privacy information management system per EN ISO/IEC 27701 – Refinements in European context

This document specifies refinements for an application of EN ISO/IEC 27701 in a European context. This document is applicable to the same entities as is ISO/IEC 27701: all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are PII controllers and/or PII processors. An organization can use this document for the implementation of the generic requirements and controls of EN ISO/IEC 27701 according to its context and its applicable obligations. Certification criteria based on these refinements can provide a certification model under ISO/IEC 17065 for processing operations performed within the scope of a privacy information management system according to EN ISO/IEC 27701, which can be combined with certification requirements for EN ISO/IEC 27701 under ISO/IEC 17021.

Read draft and comment View

prEN 18282 Public enquiry

Comment end date 2026-07-14

Artificial intelligence - Cybersecurity specifications for AI Systems

This document addresses organizational and technical solutions aimed at ensuring the cybersecurity of high-risk AI systems over the life cycle, appropriate to the relevant circumstances and the risks. The technical solutions to address AI-specific vulnerabilities include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training dataset (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws. This document provides objective criteria to enable decisions on whether a given technical or organizational solution adequately achieves a given vulnerability-related goal.

Read draft and comment View

Extended search

Results

Quick filters

Organisation

Technical Committee

ICS

Mandatory cookies

Statistics cookies

Newsletter subscription

List of drafts

Extended search

Results

Quick filters

Organisation

Technical Committee

ICS