35.030 - IT Security
ICS 35.030 Details
IT Security
Sécurité des technologies de l’information
Informacijska varnost
General Information
Frequently Asked Questions
ICS 35.030 is a classification code in the International Classification for Standards (ICS) system. It covers "IT Security". The ICS is a hierarchical classification system used to organize international, regional, and national standards, facilitating the search and identification of standards across different fields.
There are 886 standards classified under ICS 35.030 (IT Security). These standards are published by international and regional standardization bodies including ISO, IEC, CEN, CENELEC, and ETSI.
The International Classification for Standards (ICS) is a hierarchical classification system maintained by ISO to organize standards and related documents. It uses a three-level structure with field (2 digits), group (3 digits), and sub-group (2 digits) codes. The ICS helps users find standards by subject area and enables statistical analysis of standards development activities.
e-Library Subscription
Create subscription and get permanent access to documents within 35.030 - IT Security
Currently subscription includes documents marked with .We are working on making all documents available within the subscription.
This document provides packages of security assurance and security functional requirements that are intended to be useful in support of common usage by stakeholders. The users of this document can include consumers, developers and evaluators of secure IT products.
- Standard27 pagesEnglish languagesale 15% off
- Standard28 pagesFrench languagesale 15% off
This document provides terminology, concepts and a description of mechanisms in the field of data exchange focusing on trusted data transactions.
Those elements can be used in the development of standards in support of trusted data transactions and constitute a basis to identify key dimensions and criteria that contribute to the trust in a data transaction between interested parties.
Therefore, those elements constitute a foundational understanding on which trusted data transactions can be based, independently of any architectural choices or technical implementation.
- Standard13 pagesEnglish languagee-Library read for1 day
This document defines the policy, functional and security requirements on (qualified) trust services for electronic ledger. This includes requirements to ensure:
- their provision by one or more trust service providers;
- the establishment of the origin of data records in the ledger;
- the unique sequential chronological ordering of data records in the ledger;
- the recording of data in such a way that any subsequent change to the data is immediately detectable, ensuring their integrity over time.
- Technical specification18 pagesEnglish languagee-Library read for1 day
This document defines and establishes a framework for access management (AM) and the secure management of the process to access information and information and communications technologies (ICT) resources, associated with the accountability of a subject within some contexts.
This document provides concepts, terms and definitions applicable to distributed access management techniques in network environments.
This document also provides explanations about related architecture, components and management functions.
The subjects involved in access management can be uniquely recognized to access information systems, as defined in the ISO/IEC 24760 series.
The nature and qualities of physical access control involved in access management systems are outside the scope of this document.
- Draft39 pagesEnglish languagee-Library read for1 day
This document provides terminology, concepts and a description of mechanisms in the field of data exchange focusing on trusted data transactions.
Those elements can be used in the development of standards in support of trusted data transactions and constitute a basis to identify key dimensions and criteria that contribute to the trust in a data transaction between interested parties.
Therefore, those elements constitute a foundational understanding on which trusted data transactions can be based, independently of any architectural choices or technical implementation.
- Standard13 pagesEnglish languagee-Library read for1 day
This document defines the policy, functional and security requirements on (qualified) trust services for electronic ledger. This includes requirements to ensure:
- their provision by one or more trust service providers;
- the establishment of the origin of data records in the ledger;
- the unique sequential chronological ordering of data records in the ledger;
- the recording of data in such a way that any subsequent change to the data is immediately detectable, ensuring their integrity over time.
- Technical specification18 pagesEnglish languagee-Library read for1 day
This document provides information security controls, including implementation guidance, for health organizations. It is based on ISO/IEC 27002:2022
In addition to generic ICT equipment and software used in many other environments, the scope of this document includes software and systems specifically for healthcare, such as electronic health record systems and medical devices incorporating health software. Such medical devices can be programmed or programmable and can contain software, firmware or both.
Other digital equipment (such as that for environmental and infection control, building management, and physical security), which can be used in premises where healthcare is provided, is also in scope.
This document applies to information in all its aspects, whatever form the information takes (including text and numbers, sound recordings, drawings, images and video), by whatever means it has been acquired or captured, whatever means are used to store it (such as printing or writing on paper or storage electronically), and whatever means are used to transfer or exchange it (orally, by hand, by post, movement of storage media, direct links or networking).
This document is for organizations of all types and sizes that provide healthcare or are custodians of personal health information for other reasons. The information that they are responsible for can be stored and processed in many possible ways and locations, including on premises or in the cloud, but remains in scope.
This document applies to all physical settings where healthcare is intended to be delivered, such as hospitals, clinics and other locations or facilities designated for healthcare purposes such as ambulances and mobile imaging or diagnostic units. It also applies to care provided elsewhere, such as in residential premises. In addition to the range of settings, this document applies to all methods of service provision including remote or virtual healthcare.
- Standard83 pagesEnglish languagee-Library read for1 day
This document describes the test methods for determining conformance for the security crypto suite ECDSA-ECDH defined in ISO/IEC 29167-16. This document contains conformance tests for all mandatory and applicable optional functions. Unless otherwise specified, the tests in this document are only applicable to radio frequency identification (RFID) Tags and Interrogators defined in the ISO/IEC 18000 series using ISO/IEC 29167-16.
- Standard20 pagesEnglish languagesale 15% off
This document describes the test methods for determining conformance for the security crypto suite AES-128 defined in ISO/IEC 29167-10. This document contains conformance tests for all mandatory and applicable optional functions. Unless otherwise specified, the tests in this document are only applicable to radio frequency identification (RFID) Tags and Interrogators defined in the ISO/IEC 15693 series and in the ISO/IEC 18000 series using ISO/IEC 29167-10.
- Standard42 pagesEnglish languagesale 15% off
This document describes the test methods for determining conformance for the security crypto suite SPECK defined in ISO/IEC 29167-22. This document contains conformance tests for all mandatory functions. Unless otherwise specified, the tests in this document are only applicable to radio frequency identification (RFID) Tags and Interrogators defined in the ISO/IEC 18000 series using ISO/IEC 29167-22.
- Standard18 pagesEnglish languagesale 15% off
This document describes the test methods for determining conformance to the security crypto suite SIMON defined in ISO/IEC 29167-21. This document contains conformance tests for all mandatory functions. Unless otherwise specified, the tests in this document are only applicable to radio frequency identification (RFID) Tags and Interrogators defined in the ISO/IEC 18000 series using ISO/IEC 29167-21.
- Standard16 pagesEnglish languagesale 15% off
This document describes the test methods for determining conformance for the security crypto suite Grain-128A defined in ISO/IEC 29167-13. This document contains conformance tests for all mandatory and optional functions. Unless otherwise specified, the tests in this document are only applicable to radio frequency identification (RFID) tags and interrogators defined in the ISO/IEC 18000 series using ISO/IEC 29167-13.
- Standard19 pagesEnglish languagesale 15% off
This document specifies the evaluation methodology to support achieving repeatable and
reproducible evaluation results for IACS components under evaluation against IEC 62443-4-2
requirements.
This document does not specify the definition of a complete certification scheme or certification
program.
This document does not specify the process evaluations of the secure development lifecycle
according to IEC 62443-4-1. The existing secure development lifecycle according to
IEC 62443-4-1 is a prerequisite in this evaluation methodology.
This document does not specify particular tools, e.g. for the use in vulnerability or penetration
testing.
This document does not focus on lACS components which were not developed according to the
lifecycle process of IEC 62443-4-1.
- Technical specification65 pagesEnglish languagee-Library read for1 day
This document provides guidelines on using zero-knowledge proofs (ZKP) to improve privacy by reducing the risks associated with the sharing or transmission of personal data between organizations and users by minimizing unnecessary information disclosure. It includes several ZKP functional requirements relevant to a range of different business use cases, then describes how different ZKP models can be used to meet those functional requirements securely.
- Standard37 pagesEnglish languagesale 15% off
This document provides guidance on how to leverage existing ISO and IEC standards in a cybersecurity framework.
- Technical specification19 pagesEnglish languagesale 15% off
- Standard220 pagesEnglish languagesale 15% off
This document provides the minimum requirements for the knowledge and skills of assessment body testers and validators performing testing activities and validating activities for a conformance scheme using ISO/IEC 19790 and ISO/IEC 24759.
- Draft39 pagesEnglish languagee-Library read for1 day
This document provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes. This includes in particular the following:
— central and distributed process control, monitoring and automation technology as well as information systems used for their operation, such as programming and parameterization devices;
— digital controllers and automation components such as control and field devices or programmable logic controllers (PLCs), including digital sensor and actuator elements;
— all further supporting information systems used in the process control domain, e.g. for supplementary data visualization tasks and for controlling, monitoring, data archiving, historian logging, reporting and documentation purposes;
— communication technology used in the process control domain, e.g. networks, telemetry, telecontrol applications and remote-control technology;
— Advanced metering infrastructure (AMI) components, e.g. smart meters;
— measurement devices, e.g. for emission values;
— digital protection and safety systems, e.g. protection relays, safety PLCs, emergency governor mechanisms;
— energy management systems, e.g. for distributed energy resources (DER), electric charging infrastructures, and for private households, residential buildings or industrial customer installations;
— distributed components of smart grid environments, e.g. in energy grids, in private households, residential buildings or industrial customer installations;
— all software, firmware and applications installed on above-mentioned systems, e.g. distribution management system (DMS) applications or outage management systems (OMS);
— any premises housing the abovementioned equipment and systems;
— remote maintenance systems for abovementioned systems.
This document does not apply to the process control domain of nuclear facilities. This domain is covered by IEC 63096.
- Standard50 pagesEnglish languagee-Library read for1 day
This document contains recommendations on how to integrate the principle of ‘data protection and privacy by design’ during the entire lifecycle of biometric access-control products and services, in order to achieve ‘data protection and privacy by default’.
NOTE 1 The GDPR requires the effective integration of data-protection safeguards into the processing of personal data (Article 25).
NOTE 2 Biometric access control includes cards and passports, biometric comparisons on card, in databases and a combination of both, as well as one-to-one and one-to-many (and many-to-many) comparisons.
NOTE 3 Biometric access control is used at work and border control as well as in combination with cards and PINs and in online and mobile services.
Facial recognition for access control is covered by this document.
This document extends EN 17529.
This document applies to aspects of data protection and privacy by design.
This document is not applicable to non-biometric aspects of access control, or to aspects not relating to data protection or privacy.
NOTE 4 In general, biometrics is for example covered by ISO/JTC 1/SC 37 and CEN/TC 224/WG 18.
- Technical report12 pagesEnglish languagee-Library read for1 day
This document establishes an organized set of concepts and relationships to understand the competency requirements for information security conformance-testing and evaluation specialists, thereby establishing a basis for shared understanding of the concepts and principles central to the ISO/IEC 19896 series across its user communities.
- Standard20 pagesEnglish languagee-Library read for1 day
- Standard20 pagesEnglish languagee-Library read for1 day
This document provides the specialized requirements for individuals to demonstrate competence in performing IT product security evaluations and reviews according to the ISO/IEC 15408 series and ISO/IEC 18045.
NOTE It is possible that evaluators and testers belong to bodies operating under ISO/IEC 17025 and reviewers belong to bodies operating under ISO/IEC 17065.
- Standard54 pagesEnglish languagee-Library read for1 day
This document provides the minimum requirements for the knowledge and skills of assessment body testers and validators performing testing activities and validating activities for a conformance scheme using ISO/IEC 19790 and ISO/IEC 24759.
- Standard17 pagesEnglish languagesale 15% off
- Standard17 pagesFrench languagesale 15% off
This document provides information security controls, including implementation guidance, for health organizations. It is based on ISO/IEC 27002:2022
In addition to generic ICT equipment and software used in many other environments, the scope of this document includes software and systems specifically for healthcare, such as electronic health record systems and medical devices incorporating health software. Such medical devices can be programmed or programmable and can contain software, firmware or both.
Other digital equipment (such as that for environmental and infection control, building management, and physical security), which can be used in premises where healthcare is provided, is also in scope.
This document applies to information in all its aspects, whatever form the information takes (including text and numbers, sound recordings, drawings, images and video), by whatever means it has been acquired or captured, whatever means are used to store it (such as printing or writing on paper or storage electronically), and whatever means are used to transfer or exchange it (orally, by hand, by post, movement of storage media, direct links or networking).
This document is for organizations of all types and sizes that provide healthcare or are custodians of personal health information for other reasons. The information that they are responsible for can be stored and processed in many possible ways and locations, including on premises or in the cloud, but remains in scope.
This document applies to all physical settings where healthcare is intended to be delivered, such as hospitals, clinics and other locations or facilities designated for healthcare purposes such as ambulances and mobile imaging or diagnostic units. It also applies to care provided elsewhere, such as in residential premises. In addition to the range of settings, this document applies to all methods of service provision including remote or virtual healthcare.
- Standard83 pagesEnglish languagee-Library read for1 day
The present document defines baseline security requirements for AI models and systems. The present document includes in its scope systems that incorporate deep neural networks, such as generative AI. For consistency, the term "AI systems" is used throughout the present document when framing the scope of provisions and the term "AI security", which is considered a subset of cybersecurity, is used when addressing any cybersecurity issues in the scope of the provisions. The present document is not designed for academics who are creating and testing AI systems only for research purposes (AI systems which are not going to be deployed).
- Standard16 pagesEnglish languagesale 15% off
- Standard16 pagesEnglish languagesale 15% off
- Standard16 pagesEnglish languagee-Library read for1 day
This document provides information security controls, including implementation guidance, for health organizations. It is based on ISO/IEC 27002:2022 In addition to generic ICT equipment and software used in many other environments, the scope of this document includes software and systems specifically for healthcare, such as electronic health record systems and medical devices incorporating health software. Such medical devices can be programmed or programmable and can contain software, firmware or both. Other digital equipment (such as that for environmental and infection control, building management, and physical security), which can be used in premises where healthcare is provided, is also in scope. This document applies to information in all its aspects, whatever form the information takes (including text and numbers, sound recordings, drawings, images and video), by whatever means it has been acquired or captured, whatever means are used to store it (such as printing or writing on paper or storage electronically), and whatever means are used to transfer or exchange it (orally, by hand, by post, movement of storage media, direct links or networking). This document is for organizations of all types and sizes that provide healthcare or are custodians of personal health information for other reasons. The information that they are responsible for can be stored and processed in many possible ways and locations, including on premises or in the cloud, but remains in scope. This document applies to all physical settings where healthcare is intended to be delivered, such as hospitals, clinics and other locations or facilities designated for healthcare purposes such as ambulances and mobile imaging or diagnostic units. It also applies to care provided elsewhere, such as in residential premises. In addition to the range of settings, this document applies to all methods of service provision including remote or virtual healthcare.
- Standard72 pagesEnglish languagesale 15% off
- Standard82 pagesFrench languagesale 15% off
This document establishes a framework for age assurance systems and describes their core characteristics, including privacy and security, for enabling age-related eligibility decisions.
- Standard29 pagesEnglish languagesale 15% off
- Standard2 pagesEnglish languagesale 15% off
This document provides information security controls for the energy utility industry, based on ISO/IEC 27002:2022, for controlling and monitoring the production or generation, transmission, storage and distribution of electric power, gas, oil and heat, and for the control of associated supporting processes.
- Standard50 pagesEnglish languagee-Library read for1 day
This document contains recommendations on how to integrate the principle of ‘data protection and privacy by design’
during the entire lifecycle of biometric access-control products and services, in order to achieve ‘data protection and
privacy by default’.
Biometric facial recognition for access control is covered by this document. Biometric facial recognition for surveillance is
covered by CEN/CLC/JTC 13 TR ‘Video surveillance’.
This document specifies recommendations for the management of data protection and privacy by design in biometricaccess-
control products and services. This document extends ISO/IEC 27552. This document applies to aspects of data
protection and privacy by design. This document is not applicable to non-biometric aspects of access control, or to aspects
not relating to data protection or privacy.
- Technical report12 pagesEnglish languagee-Library read for1 day
This document establishes an organized set of concepts and relationships to understand the competency requirements for information security conformance-testing and evaluation specialists, thereby establishing a basis for shared understanding of the concepts and principles central to the ISO/IEC 19896 series across its user communities.
- Standard20 pagesEnglish languagee-Library read for1 day
- Standard20 pagesEnglish languagee-Library read for1 day
This document provides the specialized requirements for individuals to demonstrate competence in performing IT product security evaluations and reviews according to the ISO/IEC 15408 series and ISO/IEC 18045.
NOTE It is possible that evaluators and testers belong to bodies operating under ISO/IEC 17025 and reviewers belong to bodies operating under ISO/IEC 17065.
- Standard54 pagesEnglish languagee-Library read for1 day
This document provides the specialized requirements for individuals to demonstrate competence in performing IT product security evaluations and reviews according to the ISO/IEC 15408 series and ISO/IEC 18045. NOTE It is possible that evaluators and testers belong to bodies operating under ISO/IEC 17025 and reviewers belong to bodies operating under ISO/IEC 17065.
- Standard46 pagesEnglish languagesale 15% off
- Standard48 pagesFrench languagesale 15% off
This document establishes an organized set of concepts and relationships to understand the competency requirements for information security conformance-testing and evaluation specialists, thereby establishing a basis for shared understanding of the concepts and principles central to the ISO/IEC 19896 series across its user communities.
- Standard12 pagesEnglish languagesale 15% off
- Standard13 pagesFrench languagesale 15% off
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701, in addition to the requirements contained within ISO/IEC 17021-1.
The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing PIMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing PIMS certification.
NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.
- Standard33 pagesEnglish languagee-Library read for1 day
This document specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS).
Guidance is also provided to assist in the implementation of the requirements in this document.
This document is intended for personally identifiable information (PII) controllers and PII processors holding responsibility and accountability for PII processing.
This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations.
- Standard73 pagesEnglish languagee-Library read for1 day
This document specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS).
Guidance is also provided to assist in the implementation of the requirements in this document.
This document is intended for personally identifiable information (PII) controllers and PII processors holding responsibility and accountability for PII processing.
This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations.
- Standard73 pagesEnglish languagee-Library read for1 day
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701, in addition to the requirements contained within ISO/IEC 17021-1.
The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing PIMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing PIMS certification.
NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.
- Standard33 pagesEnglish languagee-Library read for1 day
This document defines a cybersecurity labelling framework for the development and implementation of cybersecurity labelling programmes for consumer Internet of things (IoT) products. It provides requirements and guidance on the following topics: — risks and threats associated with consumer IoT products; — stakeholders, roles and responsibilities; — relevant standards and guidance documents; — conformity assessment; — labelling issuance and maintenance; — mutual recognition. This document is limited to consumer IoT products, such as: — IoT gateways, base stations and hubs to which multiple devices connect; smart cameras, televisions, and speakers; — wearable devices; — connected smoke detectors, door locks and window sensors; — connected home automation and alarm systems; — connected appliances, such as washing machines and fridges; — smart home assistants; and — connected children’s toys and baby monitors. Products that are not intended for consumer use are excluded from this document. Examples of excluded devices are those that are primarily intended for manufacturing, healthcare and other industrial purposes. This document is applicable to consumers, developers, issuing bodies of cybersecurity labels and conformity assessment bodies.
- Standard63 pagesEnglish languagesale 15% off
This document specifies requirements for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). Guidance is also provided to assist in the implementation of the requirements in this document. This document is intended for personally identifiable information (PII) controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations.
- Standard64 pagesEnglish languagesale 15% off
- Standard71 pagesFrench languagesale 15% off
This document specifies requirements and provides guidance for bodies providing audit and certification of a privacy information management system (PIMS) according to ISO/IEC 27701, in addition to the requirements contained within ISO/IEC 17021-1. The requirements contained in this document are demonstrated in terms of competence and reliability by bodies providing PIMS certification. The guidance contained in this document provides additional interpretation of these requirements for bodies providing PIMS certification. NOTE This document can be used as a criteria document for accreditation, peer assessment or other audit processes.
- Standard24 pagesEnglish languagesale 15% off
- Standard25 pagesFrench languagesale 15% off
This document presents an informative set of common, high-level security-related capabilities and additional considerations to be used across the life cycle of health software and health IT systems, for the information exchange between the health software manufacturers (including medical device manufacturers), healthcare delivery organizations (HDOs) and other stakeholders. It is applicable to health software running on any platform and in any environment such as cloud, on premise or hybrid. While important security topics, the following are outside the scope of this document: a) the security policies of the HDO, b) the product and services security policies of the manufacturer, c) determinations of risk tolerance by the HDO or manufacturer, and d) clinical studies where there is a need to secure personal data. As security risks can be caused by any product on health IT systems and health IT Infrastructure, considerations in this document can be applied for other products that are not health software. IEC TS 81001-2-2:2025 withdraws and replaces: – IEC TR 80001-2-2, Application of risk management for IT-networks incorporating medical devices – Part 2-2: Guidance for the communication of medical device security needs, risks and controls – IEC TR 80001-2-8, Application of risk management for IT-networks incorporating medical devices – Part 2-8: Application guidance – Guidance on standards for establishing the security capabilities identified in IEC TR 80001-2-2 This document includes the following significant changes: a) Combines and updates the contents of IEC TR 80001-2-2 and IEC TR 80001-2-8; b) Extends the scope to health software instead to only medical device software; c) Aligns contents and definitions to ISO 81001-1:2021 and the updated IEC 80001-1; d) Removed the Configuration of Security Features (CNFS) capability, as any configurable security capability shall be clearly communicated. e) Provide security control mappings to several new standards, e.g. IEC TR 60601-4-5, IEC 62443-4-2, ISO/IEEE 11073-40102 and the recent versions of previous standards, e.g. ISO/IEC 27002 and NIST 800-53 version 5.
- Technical specification96 pagesEnglish languagesale 15% off
This document specifies methods for determining conformance to the security crypto suite defined in ISO/IEC 29167-11. This document contains conformance tests for all mandatory functions. Unless otherwise specified, the tests in this document are intended to be applied exclusively to RFID tags and interrogators defined in the ISO/IEC 18000 series using ISO/IEC 29167-11.
- Standard10 pagesEnglish languagesale 15% off
This document provides guidance on how to use modelling in privacy engineering. It describes categories of models that can be used, the use of modelling to support engineering, and the relationships with other references, including International Standards on privacy engineering and on modelling. It provides high-level use cases describing how models are used.
- Technical specification32 pagesEnglish languagesale 15% off
This document: — provides requirements and guidance for the management of identity information and for ensuring that an identity management system conforms to ISO/IEC 24760-1 and ISO/IEC 24760-2; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: — it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, — it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.
- Standard31 pagesEnglish languagesale 15% off
This document: — provides guidelines for the implementation of systems for the management of identity information; — specifies requirements for the implementation and operation of a framework for identity management; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: ¾ it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, ¾ it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.
- Standard46 pagesEnglish languagesale 15% off
This document: — defines terms for identity management and specifies core concepts of identity and identity management, and their relationships; — is applicable to any information system where information relating to identity is processed or stored; — is considered to be a horizontal document for the following reasons: ¾ it applies concepts such as distinguishing the term “identity” from the term “identifier” on the implementation of systems for the management of identity information and on the requirements for the implementation and operation of a framework for identity management, ¾ it provides an important contribution to assess identity management systems with regard to their privacy-friendliness and their ability to assure the relevant attributes of an identity, and consequently it provides a foundation and a common understanding for any other standard addressing identity, identity information, and identity management.
- Standard23 pagesEnglish languagesale 15% off
This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. In particular, this document specifies guidelines based on ISO/IEC 27002:2022, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations. The guidelines in this document can also be relevant to organizations acting as PII controllers.
- Standard35 pagesEnglish languagesale 15% off
This document establishes a methodology to evaluate the resistance of BSs to morphing attacks, including multiple identity attacks. The document is limited to image-based morphing attacks. The term "image-based" includes modalities such as face, iris and finger image data. The document establishes: — a definition of biometric sample modifications and manipulation with a specific focus on manipulations that constitute a multiple identity attack. This can be, for instance, an enrolment attack with face image morphing; — a methodology to measure the morphing attack potential of a morphing method. The document also describes how morphing algorithms can be used for system evaluation.
- Standard16 pagesEnglish languagesale 15% off
The present document specifies policy and security requirements relating to the operation and management practices of TSPs issuing time-stamps. These policy requirements are applicable to TSPs issuing time-stamps. Such time-stamps can be used in support of digital signatures or for any application requiring to prove that a datum existed before a particular time. The present document can be used by independent bodies as the basis for confirming that a TSP can be trusted for issuing time-stamps. The present document does not specify protocols used to access the TSUs.
NOTE 1: A time-stamping protocol is defined in IETF RFC 3161 [i.2] including optional update in IETF RFC 5816 [i.3] and profiled in ETSI EN 319 422 [5].
The present document does not specify how the requirements identified can be assessed by an independent party, including requirements for information to be made available to such independent assessors, or requirements on such assessors.
NOTE 2: See ETSI EN 319 403-1 [i.9] for guidance on assessment of TSP's processes and services.
NOTE 3: The present document references ETSI EN 319 401 [4] for general policy requirements common to all classes of TSP's services.
- Standard33 pagesEnglish languagesale 15% off
- Standard34 pagesEnglish languagesale 15% off
- Standard34 pagesEnglish languagesale 15% off
- Standard34 pagesEnglish languagee-Library read for1 day
The present document defines multiple profiles for PAdES digital signatures which are digital signatures embedded within a PDF file.
The present document contains a profile for the use of PDF signatures, as described in ISO 32000-2 [1] and based on CMS digital signatures [i.6], that enables greater interoperability for PDF signatures by providing additional restrictions beyond those of ISO 32000-2 [1]. This first profile is not related to ETSI EN 319 142-1 [4].
The present document also contains a second set of profiles that extend the scope of the profile in ETSI EN 319 142-1 [4], while keeping some features that enhance interoperability of PAdES signatures. These profiles define three levels of PAdES extended signatures addressing incremental requirements to maintain the validity of the
signatures over the long term, in a way that a certain level always addresses all the requirements addressed at levels that are below it. These PAdES extended signatures offer a higher degree of optionality than the PAdES baseline signatures specified in ETSI EN 319 142-1 [4]. The present document also defines a third profile for usage of an arbitrary XML document signed with XAdES signatures that is embedded within a PDF file. The profiles defined in the present document provide equivalent requirements to profiles found in ETSI TS 102 778 [i.10]. Procedures for creation, augmentation, and validation of PAdES digital signatures are out of scope and specified in ETSI EN 319 102-1 [i.11]. Guidance on creation, augmentation and validation of PAdES digital signatures including the usage of the different attributes is provided in ETSI TR 119 100 [i.9]. The present document does not repeat the base requirements of the referenced standards, but instead aims to maximize interoperability of digital signatures in various business areas.
- Standard32 pagesEnglish languagesale 15% off
- Standard32 pagesEnglish languagesale 15% off
- Standard32 pagesEnglish languagee-Library read for1 day