ISO/IEC 27400:2022 7.2.2-02: 7.2.2-02 IoT privacy by default

Control: Stakeholders in an IoT system make sure the most protective privacy settings apply by default, with no action or intervention needed from the user. Purpose: Protecting personal information without relying on the user to act. Audience: IoT service developer, IoT service provider. IoT domain marked in the held rendering: Operations and Management Domain (OMD).

Maintained by Gerard BlokdykControl text last updated 25 September 2026

Other controls in Clause 7: Security and privacy controls – ISO/IEC 27400:2022

7.1.2-01 7.1.2-01 IoT security policy
7.1.2-02 7.1.2-02 Organization of IoT security
7.1.2-03 7.1.2-03 Asset management
7.1.2-04 7.1.2-04 Equipment and assets outside physically protected areas
7.1.2-05 7.1.2-05 Secure disposal or reuse of equipment
7.1.2-06 7.1.2-06 Learning from security incidents
7.1.2-07 7.1.2-07 Secure IoT systems engineering principles
7.1.2-08 7.1.2-08 Secure development environment and procedures

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ISO/IEC 27400:2022 controls