SIST EN ISO/IEC 27000:2026

• Abstract:

  This document gives an overview of the concepts and principles used in the documents related to information security management systems (ISMS), including ISO/IEC 27001. This document is considered to be a horizontal document as it provides an explanation of the concepts and principles that underpin information security and ISMS

• Status: Published
• Public Enquiry End Date: 02-Oct-2025
• Publication Date: 29-Sep-2026
• ICS: 01.040.35 - Information technology (Vocabularies)
• ICS: 03.100.70 - Management systems
• ICS: 35.030 - IT Security
• Technical Committee: ITC - Information technology
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 13-Aug-2026
• Due Date: 18-Oct-2026
• Completion Date: 30-Sep-2026
• Ref Project: EN ISO/IEC 27000:2026 - Information security, cybersecurity and privacy protection - Information security management systems - Overview (ISO/IEC 27000:2026)

• Replaces: SIST EN ISO/IEC 27000:2020 - Information technology - Security techniques - Information security management systems - Overview and vocabulary (ISO/IEC 27000:2018)
• Effective Date: 01-Nov-2026

SIST EN ISO/IEC 27000:2026 gives an overview of the concepts and principles used in the information security management systems (ISMS) document family, including ISO/IEC 27001. It is the Slovenian adoption of EN ISO/IEC 27000:2026, published by SIST, and it explains the ISMS framework for organizations and professionals who need to understand, implement, audit, or assess information security management.

What does SIST EN ISO/IEC 27000:2026 specify?

SIST EN ISO/IEC 27000:2026 specifies the concepts, principles, and relationships behind ISMS documents rather than sector-specific controls or certification rules. It is a horizontal document, which means it explains the underlying ideas that support information security and ISMS use across many settings.

The document is organized into:

• Clause 1 Scope
• Clause 2 Normative references
• Clause 3 Terms and definitions
• Clause 4 Concepts and principles
• Clause 5 Documents related to ISMS including ISO/IEC 27001
• Bibliography

Clause 5 is the practical map of the ISMS standards family. It groups the related documents by purpose, which helps a reader choose the right companion standard for controls, implementation, auditing, governance, competence, or conformity assessment.

Clause 5 category	What it covers
ISMS specification	ISO/IEC 27001
Information security controls	ISO/IEC 27002, ISO/IEC 27010, ISO/IEC 27011, ISO/IEC 27017, ISO/IEC 27019
Fulfilment of ISMS requirements	ISO/IEC 27003, ISO/IEC 27004, ISO/IEC 27005, ISO/IEC 27007
Use of ISMS	ISO/IEC 27013, ISO/IEC 27014, ISO/IEC TR 27016
Control assessment, attributes, processes and competence	ISO/IEC TS 27008, ISO/IEC 27021, ISO/IEC TS 27022, ISO/IEC 27028
Conformity assessment	ISO/IEC 27006-1

What are the key requirements of SIST EN ISO/IEC 27000:2026?

SIST EN ISO/IEC 27000:2026 does not set ISMS requirements in the way ISO/IEC 27001 does. Its key value is that it defines the core ideas that make the ISMS family work together: risk, controls, scope, interested parties, and continual improvement.

Risk, information, and controls

Clause 4.1 explains why information security matters in daily operations. It links information security to the preservation of confidentiality, integrity, and availability, and it treats information as an asset that may belong to the organization or to a third party.

Clause 4.1.4 states that risks change over time and should be monitored, reassessed, and treated as needed. In practice, that means an organization should not treat security as a one-time project. It needs regular review of controls and risk treatment plans.

Clause 4.1.5 explains that controls may be organizational, people-related, physical, or technological, and that they may be preventive, detective, or corrective. This matters because a workable control set is usually a mix, not a single type of safeguard.

ISMS purpose and operation

Clause 4.1.6 defines an ISMS as a management system for preserving information security. It describes an ISMS as a combination of policies, processes, people, physical entities, technology, and related resources. For users, this means the standard treats security as a managed system that supports business objectives, not just a technical toolset.

Clause 4.2.1 describes the operating cycle for an ISMS: understand what is in scope, assess risk, treat unacceptable risk, determine needed controls, and monitor and improve their effectiveness. Clause 4.2.4 adds that information security controls should be integrated into business processes. In practice, security is expected to fit how the organization actually works.

Clause 4.2.2 highlights the conditions that support successful implementation, including management commitment, responsibility, incident response, and continual reassessment. Clause 4.2.3 says information security requirements come from strategy, business objectives, locations, assets, processing needs, and legal, regulatory, and contractual duties. That gives buyers and implementers a clear checklist for defining what the ISMS must cover.

How the related standards fit together

Clause 5.2 states that ISO/IEC 27001 specifies ISMS requirements and that organizations compare selected controls with the reference set in ISO/IEC 27001:2022, Annex A, to check that no necessary controls are omitted. Clause 5.3 adds that ISO/IEC 27002 lists 93 possible controls. Clause 5.4 to 5.7 show the companion standards for guidance, auditing, governance, competence, and conformity assessment.

What terms does SIST EN ISO/IEC 27000:2026 define?

• Information security - the preservation of confidentiality, integrity, and availability of information.
• ISMS - a management system for preserving information security through policies, processes, people, physical entities, technology, and resources.
• Risk - the effect of uncertainty on objectives.
• Risk treatment - the process used to modify risk.
• Control - a measure that maintains and/or modifies risk.
• Conformity assessment - demonstration that specified requirements are fulfilled.

Who uses SIST EN ISO/IEC 27000:2026?

SIST EN ISO/IEC 27000:2026 is used by organizations of all types and sizes that need a common understanding of ISMS concepts before they implement or improve security management. It is also useful for managers who must define scope, interested parties, and risk treatment priorities.

Typical users include:

• information security managers and ISMS teams
• quality, risk, and compliance managers
• auditors and certification bodies
• consultants and trainers
• buyers and suppliers who need a shared ISMS vocabulary
• organizations in telecommunications, cloud services, and energy utilities that use the related sector guidance

It is especially helpful when an organization is deciding which companion standard to use for controls, auditing, governance, or certification work.

What changed in SIST EN ISO/IEC 27000:2026 from the previous edition?

SIST EN ISO/IEC 27000:2026 supersedes SIST EN ISO/IEC 27000:2020 and EN ISO/IEC 27000:2020. The foreword states that this sixth edition cancels and replaces ISO/IEC 27000:2018 and was technically revised.

The stated changes are:

• the title was modified
• the structure was changed to emphasize its role as an overview and relationship map for ISMS documents, including ISO/IEC 27001
• text on the concepts and principles of information security and ISMS was added
• Clause 3 was limited to definitions used in the concept and principle sections
• it is no longer a terminology document

Which standards are used with SIST EN ISO/IEC 27000:2026?

SIST EN ISO/IEC 27000:2026 is used alongside the ISMS family named in Clause 5 and the bibliography. The most important companions are:

Standard	Contribution
ISO/IEC 27001	Specifies ISMS requirements and the basis for conformity assessment
ISO/IEC 27002	Gives control guidance and the catalogue of 93 possible controls
ISO/IEC 27003	Explains how ISO/IEC 27001 requirements can be implemented
ISO/IEC 27004	Supports monitoring, measurement, analysis, and evaluation
ISO/IEC 27005	Gives guidance on information security risk management in line with ISO 31000
ISO/IEC 27007	Supports ISMS auditing and auditor competence
ISO/IEC 27006-1	Sets requirements for bodies providing audit and certification of ISMS
ISO/IEC 27010, 27011, 27017, 27019	Provide sector or context-specific control guidance
ISO/IEC 27013, 27014, ISO/IEC TR 27016	Cover integrated implementation, governance, and economics
ISO/IEC TS 27008, ISO/IEC 27021, ISO/IEC TS 27022, ISO/IEC 27028	Cover control assessment, competence, process models, and control attributes
ISO 31000, ISO/IEC 33004, ISO/IEC 17021-1, ISO 19011, ISO/IEC 20000-1, ISO/IEC 17000:2020	Provide the related risk, process, audit, service management, and conformity assessment frameworks

What does the SIST EN ISO/IEC 27000:2026 document contain?

SIST EN ISO/IEC 27000:2026 contains a short set of foundational definitions, a plain-language explanation of information security and risk, and a map of the related ISMS standards family. It also includes a table that groups the companion standards by purpose and a figure that shows how those standards relate to each other.

For users, the document is mainly a navigation aid. It helps an organization decide whether it needs ISO/IEC 27001 requirements, ISO/IEC 27002 controls, guidance on risk or auditing, or a specialized document for telecoms, cloud services, energy utilities, competence, or conformity assessment.

SLOVENSKI STANDARD
01-november-2026
Nadomešča:
SIST EN ISO/IEC 27000:2020
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Sistemi vodenja
informacijske varnosti - Pregled (ISO/IEC 27000:2026)
Information security, cybersecurity and privacy protection - Information security
management systems - Overview (ISO/IEC 27000:2026)
Informationstechnik - Sicherheitsverfahren -
Informationssicherheitsmanagementsysteme - Überblick und Terminologie (ISO/IEC
27000:2026)
Sécurité de l'information, cybersécurité et protection de la vie privée - Systèmes de
management de la sécurité de l'information - Vue d'ensemble (ISO/IEC 27000:2026)
Ta slovenski standard je istoveten z: EN ISO/IEC 27000:2026
ICS:
01.040.35 Informacijska tehnologija. Information technology
(Slovarji) (Vocabularies)
03.100.70 Sistemi vodenja Management systems
35.030 Informacijska varnost IT Security
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

EUROPEAN STANDARD EN ISO/IEC 27000

NORME EUROPÉENNE
EUROPÄISCHE NORM
July 2026
ICS 35.030
Supersedes EN ISO/IEC 27000:2020
English version
Information security, cybersecurity and privacy protection
- Information security management systems - Overview
(ISO/IEC 27000:2026)
Sécurité de l'information, cybersécurité et protection Informationstechnik - Sicherheitsverfahren -
de la vie privée - Systèmes de management de la Informationssicherheitsmanagementsysteme -
sécurité de l'information - Vue d'ensemble (ISO/IEC Überblick und Terminologie (ISO/IEC 27000:2026)
27000:2026)
This European Standard was approved by CEN on 2 July 2026.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for
giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2026 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. EN ISO/IEC 27000:2026 E
reserved worldwide for CEN national Members and for
CENELEC Members.
Contents Page
European foreword . 3

European foreword
This document (EN ISO/IEC 27000:2026) has been prepared by Technical Committee ISO/IEC JTC 1
"Information technology" in collaboration with Technical Committee CEN-CENELEC/ JTC 13
“Cybersecurity and Data Protection” the secretariat of which is held by DIN.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by January 2028, and conflicting national standards shall
be withdrawn at the latest by January 2028.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN-CENELEC shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO/IEC 27000:2020.
Any feedback and questions on this document should be directed to the users’ national standards
body/national committee. A complete listing of these bodies can be found on the CEN and CENELEC
websites.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,
Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of
North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and the
United Kingdom.
Endorsement notice
The text of ISO/IEC 27000 has been approved by CEN-CENELEC as EN ISO/IEC 27000:2026 without any
modification.
International
Standard
ISO/IEC 27000
Sixth edition
Information security, cybersecurity
2026-07
and privacy protection —
Information security management
systems — Overview
Sécurité de l'information, cybersécurité et protection de
la vie privée — Systèmes de management de la sécurité de
l'information — Vue d'ensemble
Horizontal document
Reference number
ISO/IEC 27000:2026(en) © ISO/IEC 2026

ISO/IEC 27000:2026(en)
© ISO/IEC 2026
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2026 – All rights reserved
ii
ISO/IEC 27000:2026(en)
Contents Page
Foreword .iv
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Concepts and principles . 2
4.1 Concepts .2
4.1.1 The need for information security .2
4.1.2 Information .3
4.1.3 Information security . .3
4.1.4 Constantly changing risks .3
4.1.5 Risk treatment plan .3
4.1.6 Purpose of an information security management system (ISMS) .4
4.1.7 Importance of an ISMS .4
4.1.8 Process approach .5
4.1.9 Scope .5
4.2 Principles .5
4.2.1 Establishing, implementing, maintaining and improving an ISMS .5
4.2.2 Successfully implementing an ISMS .5
4.2.3 Determining information security requirements .5
4.2.4 Integration into business processes .6
5 Documents related to ISMS including ISO/IEC 27001 . 6
5.1 General .6
5.2 ISO/IEC 27001 (specification of an ISMS) .6
5.3 Candidate necessary information security controls .7
5.3.1 ISO/IEC 27002 (information security controls) .7
5.3.2 ISO/IEC 27010 (inter-sector and inter-organizational communications) .7
5.3.3 ISO/IEC 27011 (telecommunications organizations) .7
5.3.4 ISO/IEC 27017 (cloud services) .7
5.3.5 ISO/IEC 27019 (energy utility industry) .7
5.4 Fulfilment of ISMS requirements .7
5.4.1 ISO/IEC 27003 (ISMS guidance) .7
5.4.2 ISO/IEC 27004 (monitoring, measurement, analysis and evaluation) .7
5.4.3 ISO/IEC 27005 (guidance on managing information security risks) .7
5.4.4 ISO/IEC 27007 (ISMS auditing) .7
5.5 Use of ISMS .8
5.5.1 ISO/IEC 27013 (integrated implementation of ISO/IEC 27001 and ISO/IEC
20000-1) .8
5.5.2 ISO/IEC 27014 (governance of information security) .8
5.5.3 ISO/IEC TR 27016 (organizational economics) .8
5.6 Control assessment, attributes, processes and competence .8
5.6.1 ISO/IEC TS 27008 (assessment of information security controls) .8
5.6.2 ISO/IEC 27021 (competence requirements for ISMS professionals) .8
5.6.3 ISO/IEC TS 27022 (ISMS processes) .8
5.6.4 ISO/IEC 27028 (ISO/IEC 27002 attributes) .8
5.7 ISO/IEC 27006-1 (Conformity assessment) .8
5.8 Relationships between the standards .8
Bibliography .10

© ISO/IEC 2026 – All rights reserved
iii
ISO/IEC 27000:2026(en)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/
IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, Information security, cybersecurity and privacy protection, in collaboration with the
European Committee for Standardization (CEN) Technical Committee CEN/CLC/JTC 13, Cybersecurity and
data protection, in accordance with the Agreement on technical cooperation between ISO and CEN (Vienna
Agreement).
This sixth edition cancels and replaces the fifth edition (ISO/IEC 27000:2018), which has been technically
revised.
The main changes are as follows:
— the title has been modified;
— the structure of the document has been changed to stress its primary role, which is to provide an
overview of, and explain the relationships between, documents related to ISMS (information security
management systems) including ISO/IEC 27001;
— text presenting the concepts and principles of information security and information security management
systems has been added;
— Clause 3 has been modified to only contain definitions for those terms used in presenting the concepts
and principles described in this document;
— it is no longer a terminology document.
This document has been given the status of a horizontal document in accordance with the ISO/IEC Directives,
Part 1.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.

© ISO/IEC 2026 – All rights reserved
iv
ISO/IEC 27000:2026(en)
© ISO/IEC 2026 – All rights reserved
v
ISO/IEC 27000:2026(en)
Introduction
This document explains the concepts and principles that underpin information security and information
security management systems. It provides an overview of all documents related to ISMS (information
security management systems) including ISO/IEC 27001 and explains the relationship between them.

© ISO/IEC 2026 – All rights reserved
vi
International Standard ISO/IEC 27000:2026(en)
Information security, cybersecurity and privacy protection —
Information security management systems — Overview
1 Scope
This document gives an overview of the concepts and principles used in the documents related to information
security management systems (ISMS), including ISO/IEC 27001.
This document is considered to be a horizontal document as it provides an explanation of the concepts and
principles that underpin information security and ISMS.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
information security
preservation of confidentiality (3.2), integrity (3.3) and availability (3.4) of information
3.2
confidentiality
property that information is not made available or disclosed to unauthorized individuals, entities, or
processes
3.3
integrity
property of accuracy and completeness
3.4
availability
property of being accessible and usable on demand by an authorized entity
3.5
event
occurrence or change of a particular set of circumstances
[SOURCE: ISO/IEC 27005:2022, 3.1.11, modified — The two notes to entry have been omitted.]
3.6
likelihood
chance of something happening
[SOURCE: ISO/IEC 27005:2022, 3.1.13, modified — The two notes to entry have been omitted.]

© ISO/IEC 2026 – All rights reserved
ISO/IEC 27000:2026(en)
3.7
consequence
outcome of an event (3.5) affecting objectives
[SOURCE: ISO/IEC 27005:2022, 3.1.14, modified — The three notes to entry have been omitted.]
3.8
risk
effect of uncertainty on objectives
[SOURCE: ISO/IEC 27005:2022, 3.1.3, modified — The seven notes to entry have been omitted.]
3.9
risk treatment
process to modify risk (3.8)
3.10
control
measure that maintains and/or modifies risk (3.8)
[SOURCE: ISO/IEC 27002:2022, 3.1.8, modified — The two notes to entry have been omitted.]
3.11
specified requirement
need or expectation that is stated
[SOURCE: ISO/IEC 17000:2020, 4.1, modified — The four notes to entry have been omitted.]
3.12
conformity assessment
demonstration that specified requirements (3.12) relating to a product, process, system, person or body are
fulfilled
[SOURCE: ISO/IEC 17000:2020, 5.1, modified — The two notes to entry have been omitted.]
4 Concepts and principles
4.1 Concepts
4.1.1 The need for information security
Organizations of all types and sizes:
a) collect, process, store, transmit and delete information;
b) recognize that some information (and the associated information and commun
...