Riccardo Sirigu

— Security standards without the headache — just facts, links, and context.

Security standards provide the technical and organizational foundations for protecting systems, data, and infrastructure. While they are not laws, they’re often essential for demonstrating compliance with legal and regulatory requirements, including European mandates like the Cyber Resilience Act (CRA) and the Radio Equipment Directive (RED).

Whether you're working in enterprise IT, cloud services, automotive, healthcare, or industrial systems, these standards, when applied correctly, help you build systems that are more secure, more resilient, and easier to prove compliant.

🧭 What You’ll Find in This Guide

This guide cuts through the noise and helps you make sense of security standards, fast. Here’s what to expect:

• A clear overview of how security policies and standards fit into your organization’s governance
• A breakdown of both horizontal standards (applicable across industries) and vertical standards tailored to specific domains like automotive, healthcare, and industrial systems
• Coverage of specialized areas like secure software development, AI risk, incident response, and more
• Contextual notes to help you understand which standards apply where, and how they map to regulations like GDPR, CRA, RED, and others
• Direct links to authoritative sources

📑 Table of Contents

1. From Policies to Standards
2. Core Cybersecurity Standards (ISO/IEC)
3. Risk, Governance & Security Frameworks
4. Secure Systems, Software & Supply Chain
5. Sector-Specific & EU-Aligned Standards
6. Identity, Authentication & Cryptography
7. Incident & Vulnerability Management
8. Data Privacy & Payment Security
9. Glossary

🧭 From Policies to Standards

Security standards don’t exist in a vacuum — they flow from your company’s broader governance structure.

In most organizations, the structure looks like this:

• Laws & Regulations — define the legal obligations (e.g., GDPR, HIPAA, RED, CRA)
• Policies — internal rules set by your organization to guide actions and align with legal and ethical requirements
• Standards — frameworks and best practices used to implement your policies
• Procedures — specific instructions, tools, or workflows that operationalize the standards

💡 Note on Terminology
This post uses “security standards” in a broad, practical sense — including both formal standards (like ISO/IEC 27001) and widely adopted frameworks (like the NIST Cybersecurity Framework or CIS Controls). Some are certifiable, some are guidelines, and some are strategic models for risk management. Wherever you see “standard,” think: “trusted reference for doing security right.”

📋 Example: Policy → Standard → Procedure

This layered structure ensures your security program:

• ✅ Aligns with laws and regulations
• 🔎 Is clear, enforceable, and auditable
• 🧱 Scales as your company grows
• 🤝 Builds trust with customers, partners, and auditors

ℹ️ Note on ISO and IEC
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) collaborate to publish many cybersecurity standards under the ISO/IEC label.

📘 Note on EN and hEN Standards
EN standards (European Norms) are official European standards, and hENs are a subset recognized by the EU for legal compliance (e.g., RED, CRA).
The OJEU (Official Journal of the European Union) lists harmonised standards that provide presumption of conformity with EU laws.

📑 Core Cybersecurity Standards (ISO/IEC)

These ISO/IEC standards form the foundation of most modern cybersecurity programs. ISO/IEC 27001 is certifiable and widely used for compliance, while others offer detailed guidance for implementation and sector-specific needs.

• ISO/IEC 27001 – Information Security Management Systems (ISMS)
  Requirements for establishing and maintaining an information security program.

• ISO/IEC 27002 – Information Security Controls
  Implementation guidance for ISO/IEC 27001 controls.

• ISO/IEC 27017 – Cloud Security Guidelines
  Cloud-specific security recommendations for providers and customers.

• ISO/IEC 27018 – PII Protection in the Cloud
  Privacy-specific controls for cloud environments handling personal data.

• ISO/IEC 27005 – Risk Management
  Risk assessment and treatment aligned with ISO/IEC 27001.

🏛 Risk, Governance & Security Frameworks

These frameworks help align cybersecurity with business goals, legal obligations, and risk management practices.

• COBIT – IT Governance Framework
  Used for aligning IT strategy and operations with enterprise goals.

• ISO 31000 – Enterprise Risk Management
  High-level risk principles and processes applicable across industries.

• NIST Cybersecurity Framework (CSF) – Risk-Based Cybersecurity Model
  Voluntary but widely used framework for managing cybersecurity risks.

• NIST SP 800-53 – Security and Privacy Controls
  A catalog of detailed controls for information systems.

• NIST SP 800-171 – Protecting Controlled Unclassified Information (CUI)
  For non-federal organizations handling sensitive government data.

• CIS Controls – Prioritized Cybersecurity Best Practices
  A practical set of defensive actions for all organization sizes.

🔧 Secure Systems, Software & Supply Chain

These standards support building secure systems from the ground up, covering secure software development, engineering practices, and managing supply chain risks.

Secure Engineering & Development

• NIST SP 800-160 Vol. 1 – Engineering Secure Systems
  Applies systems engineering principles to build trustworthy and resilient systems.

• ISO/IEC 27034 – Application Security
  Integrates security into the software development lifecycle.

• NIST SSDF (SP 800-218) – Secure Software Development Framework
  Outlines best practices for designing and building secure software.

Supply Chain Security

• NIST SP 800-161 Rev. 1 – Cybersecurity Supply Chain Risk Management
  Helps organizations manage cyber risks in third-party and supplier ecosystems.

• ISO/IEC 27036 – Security for Supplier Relationships
  Addresses governance, contract clauses, and ongoing assurance for suppliers.

🚗 Sector-Specific & EU-Aligned Standards

This group includes standards tailored for IoT, automotive, industrial systems, and those aligned with key EU regulations like RED and CRA.

IoT, Automotive, Medical, and Industrial

• ISO/SAE 21434 – Automotive Cybersecurity Engineering
  Ensures cybersecurity across the vehicle lifecycle. Required for UNECE R155.

• ISO 24089:2023 – Road vehicles — Software update engineering
  Specifies requirements and recommendations for software update engineering for road vehicles. Useful for UNECE R156.

• ETSI EN 303 645 – Baseline Security for Consumer IoT Devices
  Sets baseline security requirements like default passwords and updates.

• ETSI TR 103 935 – Assessment of cyber risk based on products' properties Provides guidance for evaluating the cyber risk of IoT products

• IEC 81001-5-1 – Health software and health IT systems safety, effectiveness and security defines the life cycle requirements for development and maintenance of health software.

• IEC 62443 – Industrial Automation & Control Systems Security
  The go-to standard for OT environments like SCADA and manufacturing.

EU Regulatory Alignment

• hEN 18031 – Cybersecurity for Radio Equipment (RED)
  A harmonised EU standard providing presumption of conformity under RED and CRA.

🔐 Identity, Authentication & Cryptography

Identity, authentication, and cryptography form the backbone of digital trust. These standards help secure access, manage credentials, and protect sensitive communications.

• Helps you design secure authentication flows for users and systems
• Supports GDPR, CRA, and eIDAS compliance with structured identity assurance
• Essential for systems involving SSO, MFA, remote onboarding, or cross-border ID verification

📝 Note: eIDAS (Electronic Identification, Authentication and Trust Services) is an EU regulation that ensures secure and interoperable digital identity, signatures, and trust services across member states. It's especially relevant for organizations handling electronic transactions or user identification in the EU.

NIST Digital Identity Guidelines (SP 800-63)

• 800-63A – Enrollment & Identity Proofing
• 800-63B – Authentication & Lifecycle Management
• 800-63C – Federation & Assertions

🔐 Key Concepts:

• IAL: Identity Assurance Level
• AAL: Authenticator Assurance Level
• FAL: Federation Assurance Level

ISO/IEC Identity Standards

• ISO/IEC 24760-1 – Framework for Identity Management
• ISO/IEC 29115 – Authentication Assurance Framework
• ISO/IEC 29003 – Identity Proofing

Cryptographic Standards

• NIST FIPS 140-3 – Security Requirements for Cryptographic Modules
• NIST SP 800-131A Rev. 2 – Approved Algorithm Transitions
• NIST – Cryptographic Standards and Guidelines
• ISO/IEC 19790 – International Crypto Module Requirements
• NIST SP 800-52 Rev. 2 - Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations
• NIST Post-Quantum Encryption Standards

🧯 Incident & Vulnerability Management

These standards provide guidance for detecting, responding to, and disclosing cybersecurity incidents and vulnerabilities.

Incident Response

• NIST SP 800-61 Rev. 3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• NIST SP 800-34 Rev. 1 Contingency Planning Guide
• ISO/IEC 27035 – Incident Management Lifecycle
• ISO 22301:2019 – Security and resilience - Business continuity management systems

Vulnerability Management & Disclosure

• ISO/IEC 30111 – Vulnerability Handling Processes
• ISO/IEC 29147 – Vulnerability Disclosure Guidelines

💳 Data Privacy & Payment Security

These standards are focused on securing sensitive personal and financial data, including GDPR alignment and industry regulations.

• PCI DSS – Payment Card Industry Data Security Standard
• ISO/IEC 27701 – Privacy Information Management System (PIMS)

🎯 Final Thoughts

Security standards are more than checklists, they’re strategic tools for protecting digital assets, demonstrating compliance, and earning customer trust. Whether you’re building a connected car, running a cloud platform, or operating critical infrastructure, these standards help you manage risk and prove that you're doing things right.

📘 Glossary

💬 Let’s Connect

If you found this post helpful, or if you want to chat more about this or anything at the intersection of development and security — I’d love to hear from you.

Feel free to reach out on LinkedIn

Always happy to connect with fellow developers, researchers, and security-minded folks.

Stay curious. Stay secure. 🔒🚀