Overview

Guidelines for Internet security, explaining how Internet security relates to network, web and cybersecurity; second edition published 2023, replacing the 2012 cyberspace-focused edition

ISO/IEC 27032:2023 provides guidelines for Internet security. The second edition, published in June 2023, cancels and replaces ISO/IEC 27032:2012 and is a substantially different document. The 2012 edition was titled Guidelines for cybersecurity and was built around "cyberspace" and collaboration between stakeholders; the 2023 edition narrows and sharpens the scope to Internet security specifically, and rebuilds the risk material.

The standard sets out four things: an explanation of the relationship between Internet security, web security, network security and cybersecurity — terms that are routinely conflated; an overview of Internet security; identification of interested parties and a description of their roles; and high-level guidance for addressing common Internet security issues. It is intended for any organization that uses the Internet, which in practice means almost all of them.

The 2023 revision changed the risk approach. It adds material on threats, vulnerabilities and attack vectors as the basis for identifying and managing Internet security risks, and provides a mapping in Annex A between the Internet security controls it discusses and the controls of ISO/IEC 27002. That mapping is the practical bridge for organizations that already run an ISO/IEC 27001 ISMS and want to check their coverage of Internet-facing risk.

Typical subject areas include securing Internet-facing services and access, protecting against malicious content and social engineering, browser and web application exposure, use of Internet services by employees, and the sharing and coordination of information about threats between organizations and with external bodies such as CERTs.

ISO/IEC 27032 is guidance, not requirements, and there is no organizational certification against it. This is a frequent source of confusion because a number of training providers market "ISO 27032 Lead Cybersecurity Manager" qualifications; those are personal training certificates, and they do not represent certification of an organization. Organizations seeking certifiable cybersecurity assurance implement ISO/IEC 27001.

The standard sits within the ISO/IEC 27000 family and is normally used alongside ISO/IEC 27001 (ISMS requirements), ISO/IEC 27002 (control set), ISO/IEC 27005 (information security risk), ISO/IEC 27031 (ICT readiness for business continuity), ISO/IEC 27033 (network security), ISO/IEC 27034 (application security) and ISO/IEC 27035 (incident management).

Purpose

To clarify the relationship between Internet, web, network and cybersecurity, and to give organizations that use the Internet high-level, practical guidance on identifying and addressing common Internet security risks.

Key Benefits

• Disentangles the overlapping terms Internet security, web security, network security and cybersecurity
• Provides a technology-neutral overview of Internet security suitable for management audiences
• Identifies interested parties and their roles in Internet security, including external coordination
• Adds explicit treatment of threats, vulnerabilities and attack vectors in the 2023 edition
• Maps its controls to ISO/IEC 27002 in Annex A, supporting gap analysis for ISO/IEC 27001 users
• Applicable to any organization that uses the Internet, regardless of size or sector
• Useful as an awareness and scoping document before committing to a full ISMS programme
• Supports coordination and information sharing on threats with external parties and CERTs
• Free of certification cost, since it is guidance
• Complements the more specialised ISO/IEC 27033, 27034 and 27035 documents

Key Requirements

• Note: ISO/IEC 27032 is guidance — there are no auditable requirements and no organizational certification against it
• Understand the relationship between Internet security, web security, network security and cybersecurity
• Identify interested parties involved in Internet security and their respective roles
• Identify assets and services exposed to the Internet within the organization's scope
• Identify threats, vulnerabilities and attack vectors relevant to Internet-facing services
• Assess and treat Internet security risks using a documented risk approach
• Apply high-level controls for common Internet security issues, including malicious content and social engineering
• Secure Internet-facing services, access mechanisms and web applications
• Establish guidance for the use of Internet services by personnel
• Use the Annex A mapping to align Internet security controls with ISO/IEC 27002
• Establish arrangements for sharing and coordinating threat information with external parties
• Review and update Internet security measures as threats and technologies change

Who Needs This Standard?

Any organization operating Internet-facing services or relying on Internet connectivity, particularly security managers scoping cybersecurity work, ISO/IEC 27001 practitioners checking coverage of Internet-specific risk, and IT teams in organizations without a dedicated security function.

Related Standards