ISO/IEC 27040

ISO/IEC 27040[1] is part of a growing family of International Standards published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in the area of security techniques; the standard is being developed by Subcommitee 27 (SC27) - IT Security techniques of the first Joint Technical Committee 1 (JTC 1) of the ISO/IEC. A major element of SC27's program of work includes International Standards for information security management systems (ISMS), often referred to as the 'ISO/IEC 27000-series'.

The full title of ISO/IEC 27040 is Information technology — Security techniques — Storage security.

Overview and introduction

The purpose of ISO/IEC 27040 is to provide security guidance for storage systems and ecosystems as well as for protection of data in these systems. It supports the general concepts specified in ISO/IEC 27001.

This International Standard is relevant to managers and staff concerned with information security risk management within an organization and, where appropriate, external parties supporting such activities. The objectives for this International Standard are to:

  • publicizing the risks,
  • assist organizations in better securing their data,
  • provide a basis for designing and auditing storage security controls.

ISO/IEC 27040 provides specific, detailed implementation guidance relevant to storage security for the general security controls described in ISO/IEC 27002.

This International Standard is not a reference or normative document for regulatory and legislative security requirements as they vary by country.


Work commenced on ISO/IEC 27040 in the fall of 2010, following the SC27 meeting in Redmond, WA. The project was placed on the extended timeline, allowing up to 48 months to develop the standard rather than the normal 36 months. The ISO/IEC 27040 standard was published on January 5, 2015.

Throughout the development of ISO/IEC 27040, organizations such as the Storage Networking Industry Association (SNIA) with its Storage Security Best Current Practices (BCPs),[2][3] the Trusted Computing Group's (TCG) Storage Working Group with its work on self-encrypting drives, and INCITS' storage-oriented Technical Committees (T10, T11, and T13) provided important comments and contributions.

Eric Hibbard served as the ISO Editor throughout the development of ISO/IEC 27040.

Structure of the standard

27040:2015 has seven short clauses and three annexes, which cover:

1. Scope of the standard
2. A list of other standards that are indispensable to understanding and using ISO/IEC 27040
3. Terminology that is either imported from other standards or defined in this standard
4. A list of used abbreviations and acronyms used in the standard
5. An overview of key storage and storage security concepts as well as information on the associated risks
6. Describes the controls that support storage security technical architectures, including Direct Attached Storage (DAS), storage networking, storage management, block-based storage, file-based storage, object-based storage, and security services.
7. Provides guidelines for the design and implementation of storage security (e.g., design principles; data reliability, availability, and resilience; data retention; data confidentiality and integrity; visualization; and design and implementation considerations)
Annex A. Media-specific guidance for sanitization, including cryptographic erase (parallels NIST SP 800-88r1)
Annex B. Tables for selecting appropriate security controls based on data sensitivity or security priorities (confidentiality, integrity, or availability)
Annex C. Descriptions of important security and storage concepts (mini-tutorials)
Bibliography. A list of standards and specifications that had an influence on materials in ISO/IEC 27040

It is worth noting that the bibliography is one of the more comprehensive lists of references on storage security.

Supporting controls for storage security

A major element of the ISO/IEC 27040 standard is focused on the identification of security controls for different types of storage systems and architectures, including the following:

  • Recommendations to help secure Direct Attached Storage (DAS)
  • Broad coverage of security for storage networking technologies and topologies with an emphasis on Storage Area Networks or SAN (e.g., Fibre Channel, iSCSI, FCoE, etc.) and Network Attached Storage or NAS (e.g., NFS and SMB/CIFS)
  • Identifying important security issues and guidance for storage management
  • Security for block-based storage systems with Fibre Channel and IP interfaces (above and beyond the storage networking materials)
  • Security for file-based storage systems with NFS, SMB/CIFS, and pNFS interfaces (above and beyond the storage networking materials)
  • Security for cloud storage, object-based storage (OSD) and Content Addressable Storage (CAS)
  • Recommendations for storage security services (sanitization, data confidentiality, and data reductions)

Design and implementation guidance for storage security

Despite the increased power of personal computers and departmental workstations, there continues to be a dependency on centralized data centers due to needs for data integration, data consistency, and data quality. With the enormous growth of critical data volumes, many organizations have adopted storage-centric architectures for their ICT infrastructure. Consequently, storage security plays an important role in securing this data, and in many instances, it serves as the last line of defense from both internal and external adversaries.

The design of storage security solutions is guided by core security principles while considering data sensitivity, criticality and value. Section 6 of the standard (Supporting Controls) provides guidance on applying storage-relevant controls in implementing the designed solution. The materials in this section are further divided into:

  • Storage security design principles (Defense in depth, Security domains, Design resilience, and Secure initialization)
  • Data reliability, availability, and resilience (including Backups and replication as well as Disaster Recovery and Business Continuity)
  • Data retention (Long-term and Short to medium-term retention)
  • Data confidentiality and integrity
  • Virtualization (Storage virtualization and Storage for virtualized systems)
  • Design and implementation considerations (Encryption and key management issues, Align storage and policy, Compliance, Secure multi-tenancy, Secure autonomous data movement)

Media sanitization

"Sanitization" is the technical term for assuring that data left on storage at the end of its useful life is rendered inaccessible to a given level of effort. Or to put it another way, sanitization is the process that assures an organization doesn't commit a data breach by repurposing, selling, or discarding storage devices.

Sanitization can take many forms depending on both the sensitivity of the information and the level of effort a likely adversary would invest in attempting to recover the information. Methods used in sanitization range from simple overwrites to destruction of the cryptographic keys for encrypted data (the technique is known as cryptographic erasure) to physical destruction of the storage media. This standard provides guidance to help organizations select the proper sanitization methods for their data.

The specific details on sanitization are provided in a series of tables in Annex A, which were based on NIST Special Publication 800-88 Revision 1.[4] The tables were designed so that vendors can make specific references to them, based on the type of media, instead of using obsolete sources such as DoD 5220.22-M (from 1995).

Selecting appropriate storage security controls

The developers of ISO/IEC 27040 did not intend that all of the guidance had to be implemented (i.e., all or nothing). Consequently, Annex B was created to help organizations select the appropriate controls based on either data sensitivity (high or low) or security priorities, based on confidentiality, integrity and availability. To support this selection, all of the storage security controls in ISO/IEC 27040 are listed in 13 different tables along with information that shows how each control is relevant from both data sensitivity and security prioritization perspectives.

It is worth noting that although Annex B is informative, it is very likely that auditors will use it as a basis for checklists when reviewing the security of storage systems and ecosystems.

Important security concepts

One of the challenges in developing ISO/IEC 27040 was that there were two distinct target audiences: 1) storage professionals and 2) security professionals. To help both communities, Annex C was populated with useful tutorial information for the following:


  1. ^ "ISO/IEC 27040". ISO Standards Catalogue. ISO. Retrieved 2014-06-15.
  2. ^ Eric A. Hibbard; Richard Austin (2007). "SNIA Storage Security Best Current Practices (BCPs)". Storage Network Industry Association.
  3. ^ Eric A. Hibbard (2012). "SNIA Security Tutorial: Storage Security - The ISO/IEC Standard" (PDF). Storage Network Industry Association.
  4. ^ "Special Publication 800-88r1" (PDF). National Institute of Standards and Technology (NIST).
Data breach

A data breach is the intentional or unintentional release of secure or private/confidential information to an untrusted environment. Other terms for this phenomenon include unintentional information disclosure, data leak and also data spill. Incidents range from concerted attacks by black hats associated with organized crime, political activist or national governments to careless disposal of used computer equipment or data storage media and unhackable source.

Definition: "A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so."

Data breaches may involve financial information such as credit card or bank details, personal health information (PHI), Personally identifiable information (PII), trade secrets of corporations or intellectual property. Most data breaches involve overexposed and vulnerable unstructured data – files, documents, and sensitive information.According to the nonprofit consumer organization Privacy Rights Clearinghouse, a total of 227,052,199 individual records containing sensitive personal information were involved in security breaches in the United States between January 2005 and May 2008, excluding incidents where sensitive data was apparently not actually exposed.Many jurisdictions have passed data breach notification laws, requiring a company that has been subject to a data breach to inform customers and takes other steps to remediate possible injuries.

ISO/IEC 27000-series

The ISO/IEC 27000-series (also known as the 'ISMS Family of Standards' or 'ISO27K' for short) comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).The series provides best practice recommendations on information security management - the management of information risks through information security controls - within the context of an overall Information security management system (ISMS), similar in design to management systems for quality assurance (the ISO 9000 series), environmental protection (the ISO 14000 series) and other management systems.The series is deliberately broad in scope, covering more than just privacy, confidentiality and IT/technical/cybersecurity issues. It is applicable to organizations of all shapes and sizes. All organizations are encouraged to assess their information risks, then treat them (typically using information security controls) according to their needs, using the guidance and suggestions where relevant. Given the dynamic nature of information risk and security, the ISMS concept incorporates continuous feedback and improvement activities to respond to changes in the threats, vulnerabilities or impacts of incidents.

The standards are the product of ISO/IEC JTC1 (Joint Technical Committee 1) SC27 (Subcommittee 27), an international body that meets in person twice a year.

The ISO/IEC standards are sold directly by ISO, mostly in English, French and Chinese. Sales outlets associated with various national standards bodies also sell directly translated versions in other languages.

List of International Organization for Standardization standards, 26000-27999

This is a list of published International Organization for Standardization (ISO) standards and other deliverables. For a complete and up-to-date list of all the ISO standards, see the ISO catalogue.The standards are protected by copyright and most of them must be purchased. However, about 300 of the standards produced by ISO and IEC's Joint Technical Committee 1 (JTC1) have been made freely and publicly available.

Storage security

Storage security is a specialty area of security that is concerned with securing data storage systems and ecosystems and the data that resides on these systems.

ISO standards by standard number
IEC standards
ISO/IEC standards

This page is based on a Wikipedia article written by authors (here).
Text is available under the CC BY-SA 3.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.