Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (Information security, cybersecurity and privacy protection), published by ISO and IEC
- Latest version
- ISO/IEC 27400:2022, Edition 1 (Cybersecurity — IoT security and privacy — Guidelines)
- Effective
- 7 June 2022
- Official text
- www.iso.org ↗
What is ISO/IEC 27400?
ISO/IEC 27400, often searched as ISO 27400, is the international standard giving guidelines on the risks, principles and controls for the security and privacy of Internet of Things (IoT) solutions. ISO and IEC publish it through committee JTC 1/SC 27. It is relevant to organisations that make, deploy or run IoT solutions.
The current edition is ISO/IEC 27400:2022, Cybersecurity — IoT security and privacy — Guidelines, the first edition, published on 7 June 2022. It runs to 42 pages and sits under ICS 35.030, the IT security classification.
People search for it as "iso 27400", "27400" or by its subtitle, "IoT security and privacy guidelines". All of those mean this one document.
The standard is paywalled. This entry stays at the level of ISO's public abstract and does not describe clauses we have not seen.
Why it matters
A connected product is judged twice: once on whether it can be attacked, and once on what it does with the data it collects. ISO/IEC 27400 takes both questions together, because its stated scope is the security and privacy of IoT solutions.
The pressure to look at it rarely comes from law. In the UK, the law points at another standard: the Product Security and Telecommunications Infrastructure (PSTI) regime aligns with ETSI EN 303 645 (see the UK position below). ISO/IEC 27400 usually arrives because a customer or tender names it.
Naming a standard in a tender is not the same as the law requiring it.
That gap is where ISO/IEC 27400 sits. It is a guidelines document: a reference for teams who want to reason about IoT risks, principles and controls, not a statute to be met.
Who it applies to
ISO/IEC 27400 is relevant to the organisations that make, deploy or operate IoT solutions: device makers, and the firms that run connected services around them. A firm with no connected products or services has little reason to read it.
On obligation, ISO describes the document as guidelines and states no obligation. No UK regime in the sources we checked requires it, so for UK purposes it is voluntary. It becomes contractual only if a customer or tender names it.
ISO/IEC 27400 is guidance for IoT solutions, not a management system standard. ISO 27001 is the management system a customer usually expects you to hold. An ISO 27001 holder that builds connected products can use ISO/IEC 27400 as a reference for those products' risks, but an ISO 27001 certificate does not show that it has.
The UK position
A UK firm meets ISO/IEC 27400 voluntarily, or when a customer names it. UK law points elsewhere.
The consumer connectable product security regime, the PSTI Act 2022 and the 2023 Regulations, came into effect on 29 April 2024. It applies to manufacturers, importers and distributors of consumer connectable products made available in the UK, and its security requirements align with key provisions of ETSI EN 303 645. The Office for Product Safety and Standards (OPSS) enforces it on behalf of the Department for Science, Innovation and Technology.
The regime does not name ISO/IEC 27400, which can support the same outcomes as a voluntary guideline.
Key requirements
ISO's abstract says the document provides guidelines on three things, all in relation to the security and privacy of IoT solutions:
- Risks. The risks that IoT solutions create for security and for privacy.
- Principles. The principles that should guide how those solutions are secured and how privacy is protected.
- Controls. The controls that respond to those risks.
The abstract is the limit of what we have verified. We have not read the clause and annex structure, so this entry does not list clauses. Anyone who needs the controls themselves needs the standard from ISO or IEC.
What the UK baseline asks, for comparison
The PSTI requirements, aligned with ETSI EN 303 645, include:
- banning universal default and easily guessable passwords;
- publishing how to report security issues;
- publishing minimum security update periods.
These are baseline security requirements for consumer connectable products sold in the UK. ISO/IEC 27400 does not set them.
Frequently asked questions
ISO/IEC 27402:2023 is the companion standard from the same committee, JTC 1/SC 27. ISO/IEC 27400 gives guidelines on the risks, principles and controls for whole IoT solutions. ISO/IEC 27402 sets baseline ICT requirements that IoT devices should meet to support security and privacy controls. One is guidance for the solution; the other is a requirements baseline for the device.
ISO/IEC 27400 is written as guidelines, not requirements, so there is nothing to certify against in the way there is for ISO 27001. A firm shows it has used ISO/IEC 27400 through its own risk assessments and design records. If a customer contract names ISO/IEC 27400, agree up front what evidence will count.
Yes. ISO/IEC 27400's abstract covers IoT solutions in general, not only consumer products. That matters in the UK, where the PSTI regime applies to consumer connectable products. A supplier of business or industrial IoT falls outside PSTI, so its customers set the security bar, and ISO/IEC 27400 is one reference they may name.
ISO/IEC 27400:2022, the first edition, published on 7 June 2022, is the only edition. ISO reviews each standard at least every five years, so a first review of ISO/IEC 27400 is due around 2027. Until a change is published, cite the 2022 edition, and check the ISO page for its status before relying on it in a contract.
Yes. ISO/IEC 27400's stated scope is the security and privacy of IoT solutions, so the personal data a device or service collects sits in the same risk picture as attacks on it. ISO/IEC 27400 does not replace data protection law: a UK firm handling personal data through IoT still answers to UK GDPR, whatever guidance it follows.