ISO IEC TR 27103-2018 PDF

Full title and description

Information technology — Security techniques — Cybersecurity and ISO and IEC Standards. This technical report provides guidance on how to leverage existing ISO and IEC standards within a cybersecurity framework to support consistent implementation and alignment across organizations and sectors.

Abstract

ISO/IEC TR 27103:2018 offers practical guidance for using and mapping existing ISO and IEC standards when establishing or improving cybersecurity frameworks. It helps users identify relevant standards, understand their relationships, and apply them cohesively to address cybersecurity objectives.

General information

• Status: Withdrawn (replaced by a 2026 Technical Specification).
• Publication date: 22 February 2018.
• Publisher: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), produced by ISO/IEC JTC 1/SC 27.
• ICS / categories: 35.030 (Information technology — IT security).
• Edition / version: Edition 1 (2018).
• Number of pages: 23 pages (as published).

Scope

The report describes approaches for leveraging and aligning existing ISO and IEC standards (for example information security management, cybersecurity guidance, sector-specific standards) when designing or assessing a cybersecurity framework. It is intended to make it easier for organizations to select and apply appropriate normative documents and to show relationships between standards to reduce overlap and gaps.

Key topics and requirements

• Overview of how ISO and IEC standards relate to cybersecurity frameworks and objectives.
• Guidance on identifying relevant standards to address specific cybersecurity needs (controls, management, sector-specific aspects).
• Recommendations for mapping and aligning standards to avoid duplication and achieve coherent implementation.
• Considerations for applying standards in different contexts, including smart city and sector-specific deployments (keyword emphasis in original publication).
• Practical advice for standards users, implementers and policy-makers to integrate standards into governance and risk-management processes.

Typical use and users

Intended users include cybersecurity practitioners, information security managers, standards developers, auditors, procurement specialists, system integrators, and policy-makers who need to understand which ISO/IEC standards to apply and how those standards interrelate within a cybersecurity framework. Organizations using or referencing ISO/IEC cybersecurity and information-security standards will find the report useful during standards selection, gap analysis and framework alignment.

Related standards

Closely related standards and series include ISO/IEC 27000 family (ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005), other ISO/IEC cybersecurity and privacy publications, and sector-specific IEC or ISO standards. Note: ISO/IEC TR 27103:2018 has been withdrawn and replaced by ISO/IEC TS 27103:2026 (Technical Specification), which updates and republishes guidance for using ISO and IEC standards in a cybersecurity framework.

Keywords

Cybersecurity, security techniques, ISO, IEC, framework alignment, standards mapping, information security management, smart city.

FAQ

Q: What is this standard?

A: ISO/IEC TR 27103:2018 is a technical report titled "Information technology — Security techniques — Cybersecurity and ISO and IEC Standards" that provides guidance on using and aligning ISO and IEC standards in a cybersecurity framework.

Q: What does it cover?

A: It covers approaches to identify, map and leverage existing ISO and IEC standards to support cybersecurity objectives, reduce overlap and fill gaps when implementing a cybersecurity framework.

Q: Who typically uses it?

A: Cybersecurity practitioners, information security managers, standards developers, auditors, integrators and policy-makers who need guidance on selecting and aligning standards for cybersecurity programs.

Q: Is it current or superseded?

A: ISO/IEC TR 27103:2018 has been withdrawn and superseded by ISO/IEC TS 27103:2026 (published as a Technical Specification in 2026). Users should reference the 2026 TS for the most up-to-date guidance.

Q: Is it part of a series?

A: It is published under ISO/IEC JTC 1/SC 27 (Information security, cybersecurity and privacy protection) and is intended to complement the ISO/IEC 27000 family and other cybersecurity and sector-specific standards.

Q: What are the key keywords?

A: Cybersecurity, standards mapping, ISO, IEC, framework, information security, smart city.