At the beginning of 2015, the international standard ISO/IEC 27040:2015 Information technology — Security techniques — Storage security was published. It provides detailed guidance for protecting data storage systems and the information stored within them.
The standard is part of the ISO/IEC 27000 family, which focuses on information security management, and aims to support organizations in planning, designing, and implementing secure data storage solutions. The document provides a consistent approach to reducing risks associated with information storage by offering technical guidance and best practices for protecting storage devices, data media, and related services.
ISO/IEC 27040:2015 addresses the security of information both while it is stored and while it is transmitted through communication links associated with storage systems. The standard covers various aspects of security, including the protection of hardware and media, the management of storage devices, the security of applications and services, and protective measures throughout the entire lifecycle of storage media—from their use to their disposal.
The document is intended for a wide range of professionals, from managers and information security experts to system architects and administrators involved in the design and management of data storage infrastructures. In addition, the standard presents key concepts and definitions, examines typical threats to storage systems, and provides control mechanisms and architectural approaches for mitigating them.
The publication of ISO/IEC 27040:2015 comes at a time when the volume of stored data continues to grow, and the protection of information resources is becoming an increasingly important priority for organizations around the world.