With the rapid development of the Internet of Things (IoT), cloud services, mobile applications, artificial intelligence and distributed systems, secure communication between devices and services has become a critical element of cybersecurity. In this context, ISO/IEC 27071:2023 provides an internationally recognized framework and security recommendations for establishing trusted connections between devices and services based on hardware security mechanisms.
The standard is part of the ISO/IEC 27000 family and complements other standards related to information security management and cybersecurity.
 
Scope and Objectives of the Standard
ISO/IEC 27071 provides a framework and security recommendations aimed at establishing trust between:

• end devices (IoT devices, mobile devices, industrial controllers, servers);
• services (cloud platforms, backend systems, digital services).

The primary objective is to ensure that:

• the device communicates with the genuine and legitimate service;
• the service receives data from an authorized and unmodified device;
• the data is authentic and its integrity is assured.

The standard does not address privacy or personal data protection issues, but focuses exclusively on cybersecurity and technical trust.
 
Why an Encrypted Channel Is Not Sufficient
In practice, protocols such as TLS/SSL are commonly used to encrypt communications. ISO/IEC 27071 emphasizes that this is not sufficient because:

• an encrypted channel does not guarantee that the data originates from the correct device;
• it does not prevent the use of fake or compromised devices;
• it does not provide evidence of the trustworthiness of the environment in which the device operates.

For this reason, the standard introduces the concept of hardware-based trust.
 
Key Components in ISO/IEC 27071
1. Hardware Security Module (HSM) and Root of Trust
At the core of a trusted connection is a hardware root of trust, implemented for example through:

• hardware security modules (HSMs);
• trusted platform modules (TPMs);
• secure enclaves or secure elements.

These components protect cryptographic keys and the device identity from compromise.
2. Identity of Devices and Services
The standard recommends:

• unique, cryptographically protected identities;
• issuance of identities by trusted parties (e.g. certification authorities);
• the use of public key infrastructure (PKI).

Identity without a reliable root of trust is considered easy to forge.
3. Mutual Authentication and Key Establishment
ISO/IEC 27071 recommends mutual authentication, whereby:

• the device authenticates the service;
• the service authenticates the device.

This helps prevent impersonation and man-in-the-middle attacks.
4. Remote Attestation
Remote attestation enables a service to verify:

• whether the device is running trusted firmware;
• whether the execution environment has been compromised;
• whether the environment complies with a predefined trusted state before accepting the data.

This mechanism is particularly important in industrial and IoT environments.
5. Data Integrity and Authenticity
Data that:

• is collected from sensors;
• is entered by users;
• is generated by algorithms,

should be labelled and cryptographically signed so that its integrity and origin can be verified over the long term.
 
Applicable Scenarios
ISO/IEC 27071 is applicable to a wide range of use cases, including:

• IoT platforms and smart devices;
• industrial systems and operational technology (OT) environments;
• cloud services;
• mobile applications with high security requirements;
• critical infrastructure systems.

 
Relationship with Other Standards

• ISO/IEC 27001 — Information Security Management Systems (ISMS);
• ISO/IEC 27002 — Information security controls;
• ISO/IEC 27070 — Virtualized roots of trust.

ISO/IEC 27071 is not a certification standard and does not define mandatory requirements; instead, it provides guidance and security recommendations.
 
Benefits for Organizations
Implementing ISO/IEC 27071 helps organizations to:

• reduce the risk of fake or compromised devices and data;
• establish trust in distributed systems;
• increase their cybersecurity maturity;
• meet customer and regulatory expectations.

 
ISO/IEC 27071 provides a clear and structured approach to building trust in modern, distributed digital systems. For organizations that rely on automated data exchange between devices and services, the standard is a key tool for improving the resilience and security of their platforms.

ISO/IEC 27071:2023 Cybersecurity — Security recommendations for establishing trusted connections between devices and services