Cybersecurity Standards

Standards underpin quality, safety, and efficiency in almost every industry. They support trade, improve product quality, and give companies a reliable framework for governance and compliance. This page explains how formal standards differ from other specifications, what standards mean for corporate governance, which organizations develop them, and how standards are harmonized in the European Union.

Contents

1. Formal standards and other specifications
2. Standards in corporate governance
3. Standardization organizations
4. Harmonized standards in the EU
5. Key cybersecurity standards

Formal standards and other specifications

German distinguishes between a Norm and a Standard. English uses “standard” for both, so the difference is easy to miss.

In the broad sense, a standard is any technical specification developed by a recognized organization. Applying it is usually voluntary. Such specifications often describe specific methods, procedures, or properties of products and services, and they frequently cover the needs of a single industry.

Formal standards are published by official standardization bodies such as ISO, IEC, CEN, CENELEC, and ETSI. They are developed by consensus, are widely accepted, and are increasingly referenced in regulation, for example under the EU's New Legislative Framework. They usually have a broad scope and carry considerable weight in legislation.

Standards in corporate governance

Standards are an essential part of governance, risk, and compliance (GRC). They help companies meet legal requirements, identify and manage risks, and build transparent and efficient structures.

Standards such as ISO 31000 (risk management) and ISO/IEC 27001 (information security management) provide proven frameworks for managing operational risks systematically.

Standardization organizations

At the international level, the International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), and the International Telecommunication Union (ITU) develop most globally applicable standards.

In Europe, the European Committee for Standardization (CEN), the European Committee for Electrotechnical Standardization (CENELEC), and the European Telecommunications Standards Institute (ETSI) carry out the main work on European standards.

Each country also has a national standards body that adopts European and international standards and maintains national ones. In Germany, for example, these are DIN (German Institute for Standardization) and DKE (German Commission for Electrical, Electronic & Information Technologies of DIN and VDE).

Harmonized standards in the EU

The EU harmonizes standards by publishing references to harmonized standards in the Official Journal of the European Union (OJEU). These standards help companies develop products and services that are accepted in all Member States and comply with the rules that apply there.

Publication in the OJEU shows that the EU institutions recognize the standard. Products that comply with it are presumed to conform with the corresponding requirements of EU law.

Key cybersecurity standards

ISO/IEC 27001 is one of the most important cybersecurity standards. It provides a framework for managing information security and helps organizations protect themselves against security threats.

Key cross-industry standards for operators:

• ISO/IEC 27001: “Information security, cybersecurity and privacy protection – Information security management systems – Requirements”
  Specifies requirements for an information security management system (ISMS). It provides a systematic approach to managing sensitive company information and applies across industries.
• ISO/IEC 27701: “Security techniques – Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines”
  Extends ISO/IEC 27001 with a focus on privacy. It provides guidance for implementing, maintaining, and continually improving a privacy information management system (PIMS).
• ISO 22301: “Security and resilience – Business continuity management systems – Requirements”
  Specifies requirements for a business continuity management system (BCMS). It helps organizations prepare for, respond to, and recover from disruptions.

Key standards for product manufacturers:

• ISO/IEC 15408: “Information security, cybersecurity and privacy protection – Evaluation criteria for IT security”
  This series, also known as the Common Criteria, provides a framework for specifying, implementing, and evaluating security functions in IT products. It is often used to certify security products.
• ISO/IEC 30111: “Information technology – Security techniques – Vulnerability handling processes”
  Provides guidance for handling vulnerabilities in products and services. It describes the internal processes for dealing with security flaws.
• ISO/IEC 29147: “Information technology – Security techniques – Vulnerability disclosure”
  Provides guidance for disclosing vulnerabilities. It helps organizations set up effective processes for receiving and processing vulnerability reports.
• EN 18031: “Common security requirements for radio equipment”
  Sets requirements for information security and the protection of personal data for internet-connected radio equipment.

There are also sector-specific standards.

Industry in general

• IEC 62443: “Security for industrial automation and control systems”
  This series covers the security of industrial automation and control systems (IACS). It provides requirements and guidance for manufacturers, integrators, and operators of industrial plants.

Automotive and agricultural machinery

• ISO/SAE 21434: “Road vehicles – Cybersecurity engineering”
  Focuses on cybersecurity in the automotive industry. It defines requirements for cybersecurity risk management in vehicle development and throughout the product lifecycle.
• ISO 24089: “Road vehicles – Software update engineering”
  Covers the processes and requirements for software updates in vehicles. It is particularly relevant as vehicles become more digital and connected.
• ISO 24882: “Agricultural machinery, tractors, and earth-moving machinery – Product cybersecurity”
  This standard, also still under development, is to set cybersecurity requirements for agricultural machinery, tractors, and earth-moving, construction, mining, and forestry machinery in order to reduce security risks across the entire lifecycle.

Railways

• CLC/TS 50701: “Railway applications – Cybersecurity”
  This technical specification covers cybersecurity in the railway sector. It provides guidance for implementing cybersecurity measures in railway systems.
• IEC 63452: “Railway applications – Cybersecurity”
  This standard, still under development, describes a uniform method for managing the cybersecurity of railway systems. It adapts the requirements of the IEC 62443 series to the specific applications and operating environments of railways and integrates them with the RAMS lifecycles of the IEC 62278 series.

Machinery

• EN 50742: “Safety of machinery – Protection against corruption”
  This standard, still under development, describes how to protect machinery against intentional and unintentional corruption as required by the Machinery Regulation.

Medical technology

• IEC 80001-5-1: “Application of risk management for IT-networks incorporating medical devices – Part 5-1: Security – Activities in the product life cycle”
  Provides guidance on the cybersecurity of connected medical devices. It supports healthcare organizations in assessing and reducing risks.
• IEC TR 60601-4-5: “Medical electrical equipment – Part 4-5: Guidance and interpretation – Safety-related technical security specifications”
  This technical report covers the cybersecurity of medical electrical equipment and systems. It provides manufacturers with guidance on cybersecurity aspects.

Lifts, escalators, and moving walks

• ISO 8102-20: “Electrical requirements for lifts, escalators and moving walks – Part 20: Cybersecurity”
  Sets cybersecurity requirements specifically for lifts, escalators, and moving walks. It defines measures to protect against cyber threats across the entire lifecycle, from development and operation to decommissioning. The standard builds on the principles of IEC 62443 and adapts them to vertical transportation.

Internet of Things

• ETSI EN 303 645: “CYBER; Cyber Security for Consumer Internet of Things: Baseline Requirements”
  This European standard defines cybersecurity requirements for consumer IoT devices. It aims to ensure a baseline level of security for these devices.

Cybersecurity standards do more than assure technical quality. They are a pillar of good corporate governance. They help companies meet regulatory requirements, reduce risks, and build trust in digital products and services. International cooperation on standards and harmonization at EU level allow companies to compete in a global market without losing sight of security.