Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (Information security, cybersecurity and privacy protection), published by ISO and IEC
- Latest version
- ISO/IEC 27032:2023, Cybersecurity — Guidelines for Internet security (Edition 2); supersedes the withdrawn ISO/IEC 27032:2012
- Effective
- 28 June 2023
- Official text
- www.iso.org ↗
What is ISO 27032?
ISO 27032 is the international guidance standard on Internet security, formally ISO/IEC 27032:2023, Cybersecurity — Guidelines for Internet security. ISO and IEC publish it through committee JTC 1/SC 27. It is intended for organisations that use the Internet, so it applies across sectors rather than to one industry.
The current edition is ISO/IEC 27032:2023 (Edition 2), published on 28 June 2023. It replaces ISO/IEC 27032:2012, which has been withdrawn. No revision of the 2023 edition had been announced as of October 2026.
Its first job is vocabulary. The standard explains how Internet security, web security, network security and cybersecurity relate to one another. Those four terms are easy to use loosely, and a shared definition is what lets two parties agree on what they are discussing.
Guidance is not a requirement, so a claim of "ISO 27032 compliance" deserves a question back: which part?
Why it matters
The usual tension is this. A customer, tender or internal policy names ISO 27032, and you go looking for the certificate. There isn't one to offer, because the standard is guidance, not a certifiable requirements standard.
That changes what the standard is good for. ISO/IEC 27032 gives you a common frame for Internet-facing security: what the terms mean, who is involved and which common issues to address. It is a reference for a conversation, not a pass mark.
Three situations bring people to it:
- A named reference in a questionnaire or contract. Someone has cited the standard by number. Ask what evidence they expect, then answer that.
- A need for shared language. Security, IT and the business may use "Internet security", "network security" and "cybersecurity" differently. The standard sets out how they relate.
- Unclear ownership. The standard identifies interested parties and describes their roles in Internet security, which gives you a starting list for who should be in the room.
A standard cited without a clause is a question, not a requirement.
Who it applies to
ISO says the document is intended for organisations that use the Internet. That is nearly every organisation, so the audience is broad rather than sector-specific. A software company and a services firm sit in the same audience.
The obligation is voluntary. As guidance, ISO/IEC 27032 is not mandatory in itself and carries no certificate. It becomes contractual only if a customer or contract names it, and then the contract, not the standard, defines what is expected.
Who usually doesn't need it: a firm looking for a certificate to show buyers. That firm needs a certifiable standard instead.
The relationship to ISO 27001 is one of purpose. ISO 27001 is the certifiable management system standard; ISO/IEC 27032 is guidance on Internet security with no certificate of its own, so it cannot stand in for one. For the management system view, see the ISO 27001 vault.
The UK position
A UK firm rarely meets ISO/IEC 27032 as a legal requirement. It is voluntary guidance, and we know of no UK law or regulator that requires it.
Where a UK firm does meet it, the route is commercial: a buyer, tender or supplier questionnaire cites the standard, or an internal policy borrows its vocabulary. Ask the buyer what evidence they want. Guidance cannot be evidenced the way a certificate can.
Key requirements
ISO/IEC 27032 is guidance, so it has no numbered requirements to pass or fail. ISO's abstract describes what the 2023 edition provides:
- An overview of Internet security. The scene-setting for the rest of the document.
- How the terms relate. The relationship between Internet security, web security, network security and cybersecurity.
- Interested parties and their roles. Who is involved in Internet security and what each party does.
- High-level guidance on common issues. Direction for addressing common Internet security issues, pitched at a high level.
Read as questions rather than a checklist, that gives you three useful prompts. Have we agreed what "Internet security" covers for us? Do we know the parties involved and who owns what? Have we considered the common issues the standard points to?
What the standard does not give you
- A certification route. ISO/IEC 27032 is not a certifiable requirements standard, so there is no organisational certificate to audit against. If an offer uses the standard's name, ask exactly what it certifies.
- A detailed control catalogue. ISO describes the guidance as high-level. For controls, look to a certifiable or control-based standard, starting from the ISO 27001 vault.
- A requirements list you can lift from older material. Some summaries list risk assessment, policy, controls and monitoring as its requirements. ISO's abstract does not say that, so read the standard itself before relying on such a list.
Frequently asked questions
ISO/IEC 27032:2023 (Edition 2) is current. It replaced ISO/IEC 27032:2012, which was titled Information technology — Security techniques — Guidelines for cybersecurity and is now withdrawn. The new title matters: the 2023 edition is framed as Internet security guidance for organisations that use the Internet, so cite the 2023 title and year, not the 2012 ones.
ISO/IEC 27032 is guidance, not a certifiable requirements standard, so there is no organisational certificate to audit against. Treat any offer of "ISO 27032 certification" with care and ask exactly what is being certified. An organisation that needs a certificate should look to a certifiable standard such as ISO 27001.
No. ISO/IEC 27032 is voluntary guidance, and because it carries no certificate there is no pass mark to hold you to. It binds you only when a contract or internal policy adopts it. If a contract does, agree in writing what evidence will satisfy the clause, because ISO/IEC 27032 itself does not define one.
ISO 27032 Lead Cybersecurity Manager is a personal qualification offered by training providers, not by ISO. It shows that an individual has completed a course on ISO/IEC 27032; it does not certify an organisation. Treat it as evidence of one person's training, not of how your organisation manages Internet security.
ISO 27001 does not require ISO/IEC 27032, and an ISO 27001 audit is assessed against ISO 27001, not against ISO/IEC 27032. The two can still work together: an ISO 27001 holder can draw on ISO/IEC 27032's terms and roles when describing Internet-facing risks in its risk assessment. That use is optional, not a certification requirement.