ISO/IEC 27040:2024

ISO/IEC 27040:2024 gives requirements and guidance for the security of data storage: protection of data while stored in ICT systems and in transit across the links associated with storage, covering devices and media, their management, applications and services, and user activity through the lifetime of devices and media and after end of use. Structured on the ISO/IEC 27002:2022 themes: organizational controls (aligning storage with policy, business continuity, compliance), people controls, physical controls (physically secure storage, protected physical interfaces, isolation of storage systems) and technological controls (secure design principles, quality attributes, retention and disposal; system hardening, logging and monitoring, storage vulnerability management; management authentication, authorization and interfaces; encryption and key management for storage, transferred data and data at rest; sanitization by clear, purge and destruct, logical sanitization, cryptographic erase, verification and proof; and the technology areas of direct attached storage, SANs and NAS protocols, Fibre Channel and IP storage, NFS and SMB, cloud storage and CDMI, object storage, data reduction, backups, replication and snapshots, archives and repositories, virtualization, multi-tenancy and autonomous data movement), with Annex A summarizing the labelled requirements and guidance. The storage and backup-plane companion to ISO/IEC 27001 and 27002 and the ISO reference behind backup, media and sanitization controls across the security frameworks.