Overview

ISO/IEC 27030 was the working project number for IoT security and privacy guidelines; the work was renumbered and published as ISO/IEC 27400:2022, which is the standard to reference.

There is no published standard numbered ISO/IEC 27030. ISO/IEC 27030 was the number carried by a draft project titled "Guidelines for security and privacy in Internet of Things (IoT)" during its development within ISO/IEC JTC 1/SC 27. Before publication the work was renumbered into the new IoT security and privacy series, and it was published as ISO/IEC 27400:2022, Cybersecurity — IoT security and privacy — Guidelines. ISO's catalogue record for the original project now shows ISO/IEC 27400:2022. Anyone looking for "ISO 27030" should use ISO/IEC 27400 instead.

ISO/IEC 27400:2022 provides guidelines on risks, principles and controls for security and privacy of Internet of Things solutions. It is addressed to IoT service developers and IoT users, and it applies across the lifecycle of an IoT system — design, development, deployment, operation and decommissioning. Unlike a management system standard, it is a guidance document: it describes controls and principles rather than auditable requirements.

Why IoT needed its own guidance. IoT systems combine constrained devices that may lack the resources for conventional security controls, long deployment lifetimes with limited or no patching, physical accessibility of devices, heterogeneous supply chains, and continuous collection of data about people and physical environments. ISO/IEC 27400 works through the risk sources specific to that combination and sets out security and privacy controls appropriate to IoT service developers and to IoT users separately, recognizing that the two groups have different responsibilities and different degrees of control.

The wider ISO/IEC 27400 family. The series has expanded since 2022. ISO/IEC 27402 addresses baseline requirements for IoT devices, ISO/IEC 27403:2024 gives guidelines for IoT-domotics (connected home environments), and ISO/IEC 27404:2025 defines a cybersecurity labelling framework for consumer IoT. Organizations with an ISO/IEC 27001 information security management system typically use ISO/IEC 27400 to inform IoT-specific risk treatment inside that system, with ISO/IEC 27701 covering privacy information management and IEC 62443 covering industrial automation and control systems.

Certification. Neither the discontinued ISO/IEC 27030 project number nor ISO/IEC 27400:2022 is certifiable. Organizations seeking certification in this area certify their information security management system to ISO/IEC 27001, and may reference ISO/IEC 27400 controls within the scope of that system.

Purpose

To document that the IoT security and privacy guidelines developed under the working number ISO/IEC 27030 were published as ISO/IEC 27400:2022, and to point users to the correct current standard for IoT security and privacy guidance.

Key Benefits

• Clarifies that ISO/IEC 27030 was never published and directs users to ISO/IEC 27400:2022
• IoT-specific security and privacy risk sources and controls in ISO/IEC 27400
• Separate guidance for IoT service developers and IoT users
• Covers the full IoT lifecycle from design through decommissioning
• Complements an existing ISO/IEC 27001 information security management system
• Entry point to the wider ISO/IEC 27400 series including device baselines and consumer labelling

Key Requirements

• Reference ISO/IEC 27400:2022 rather than ISO/IEC 27030 in policies and contracts
• Identify IoT-specific risk sources across devices, networks, platforms and data
• Apply security controls appropriate to constrained devices and long lifecycles
• Apply privacy controls where IoT systems collect data about people or environments
• Distinguish responsibilities between IoT service developers and IoT users
• Address the full lifecycle including update, maintenance and decommissioning
• Integrate IoT risk treatment into an ISO/IEC 27001 management system where one exists

Who Needs This Standard?

IoT product and platform developers, information security teams responsible for connected devices, industrial and building automation operators, healthcare and smart city technology teams, and anyone who has encountered the ISO/IEC 27030 number in older documentation and needs the current reference.

Related Standards