ISO 27400 Foundation key terms

A system of interconnected physical devices, sensors, and software that collect, exchange, and act on data over networks, often with limited human intervention and constrained computing resources.

A physical object with embedded sensing, processing, and network connectivity that participates in an IoT system, frequently constrained in power, memory, and physical accessibility.

The full set of interacting elements around an IoT deployment, including devices, gateways, networks, cloud services, applications, operators, users, and third-party suppliers across the lifecycle.

An organised assembly of devices, communication links, data processing, and management functions that together deliver an intended service, considered as a whole for security purposes.

A device with strict limits on processing power, memory, energy, or bandwidth, which restricts the cryptographic and security mechanisms it can realistically support.

Anything of value to an organisation or individual within an IoT context, such as data, device functionality, credentials, availability of service, or physical safety of people.

A potential cause of an unwanted incident that could harm an asset, arising from human attackers, environmental events, or accidental failures in an IoT system.

A weakness in a device, software, configuration, process, or design that a threat could exploit to compromise confidentiality, integrity, availability, or privacy.

The combination of the likelihood of a threat exploiting a vulnerability and the resulting impact on assets, expressed qualitatively or quantitatively to guide treatment decisions.

The process of selecting and applying options to address identified risk, such as mitigation through controls, avoidance, transfer, or acceptance with documented justification.

The risk that remains after controls have been implemented, which must be evaluated, documented, and accepted by an accountable party before a system is deployed or operated.

A layered approach that applies multiple independent controls so that failure of one safeguard does not by itself lead to compromise of the IoT system or its data.

A safeguard, countermeasure, or process that modifies risk by preventing, detecting, or reducing the effect of threats to IoT devices, networks, data, or users.

The principle that devices, services, and users receive only the access rights needed for their defined function, limiting the damage that a compromised account or component can cause.

An approach that builds privacy protection into system architecture, defaults, and processes from the earliest design stage rather than adding it after deployment.

A configuration principle ensuring that, without user action, an IoT product collects and shares the minimum personal data and exposes the most protective privacy settings.

Information relating to an identified or identifiable natural person, including sensor readings, location traces, biometrics, and device identifiers that can be linked to an individual.

The principle of collecting and retaining only personal data that is adequate, relevant, and necessary for a specified purpose, reducing exposure if a device is compromised.

A freely given, specific, informed indication of a person's agreement to the processing of their personal data, which must be obtained where required and be withdrawable.

Processing that removes or alters identifiers so that data can no longer be attributed to an individual, reducing privacy obligations when the result is genuinely irreversible.

Replacing direct identifiers with artificial keys so that data cannot be linked to a person without additional information kept separately, while retaining some analytical utility.

The sum of entry points and exposed functionality an attacker could use, including network interfaces, physical ports, web interfaces, APIs, and supply chain dependencies.

An individual, group, or natural phenomenon capable of acting on a vulnerability, ranging from opportunistic criminals and insiders to nation-state actors and environmental hazards.

The consequence of a security or privacy incident on assets, people, or the environment, measured in terms such as financial loss, safety harm, or reputational damage.

The core information security properties: preventing unauthorised disclosure, protecting accuracy and completeness, and ensuring timely and reliable access to systems and data.

Freedom from unacceptable physical harm, a property that in IoT can depend directly on security because compromised devices may actuate physical processes or disable protective functions.

The stages an IoT system passes through, from concept and development through deployment, operation, maintenance, and decommissioning, each requiring appropriate security and privacy activity.

Building software and hardware with security requirements, threat modelling, coding standards, and testing integrated into the development process rather than added afterwards.

A structured analysis that identifies assets, entry points, potential attackers, and attack paths in a planned or existing IoT system to prioritise controls early.

A verifiable representation of a device, typically anchored in a hardware root of trust and credentials, used to authenticate it to networks and services.

The process of verifying that a device, user, or service is who or what it claims to be before granting access to resources or accepting data.

Mechanisms that decide which subjects may perform which actions on which resources, commonly implemented through roles, policies, or attribute-based rules in IoT platforms.

A protected hardware component that stores keys and performs security functions in a way software cannot subvert, providing a trusted foundation for boot and identity.

A startup process that verifies the integrity and authenticity of firmware using cryptographic signatures before execution, preventing unauthorised code from running on a device.

A controlled process for delivering and installing corrected or improved device software, requiring authenticity checks and rollback protection to avoid introducing malicious or faulty code.

The organised process of identifying, testing, deploying, and verifying software fixes for known vulnerabilities across devices throughout their supported lifetime.

Transforming data using cryptographic algorithms and keys so that only authorised parties can read it, applied to data in transit, at rest, or during processing.

Cryptographic algorithms and protocols designed to provide adequate security with low processing, memory, and energy demands suitable for constrained IoT devices.

The property that data and code have not been altered or destroyed in an unauthorised way, supported by checksums, message authentication codes, and digital signatures.

Dividing an IoT network into isolated zones so that compromise of one segment, such as consumer devices, cannot freely reach critical systems or sensitive data.

An intermediary that connects constrained devices to wider networks, often terminating protocols, filtering traffic, and enforcing security policy between local and remote systems.

Setting devices and services to a hardened state, including changing default credentials, disabling unused services and ports, and applying restrictive permissions.

The generation, distribution, storage, rotation, and revocation of passwords, keys, and certificates, ensuring unique credentials per device and protection against disclosure.

Recording and reviewing security-relevant events across devices and platforms so that attacks, misbehaviour, and control failures can be detected and investigated promptly.

A prepared set of roles, procedures, and communications for detecting, containing, eradicating, and recovering from security or privacy incidents affecting IoT deployments.

The stage when a device or service stops receiving support, requiring clear disclosure of support periods, secure decommissioning, and removal of data and credentials.

The risk that components, software, or services obtained from third parties contain vulnerabilities, malicious features, or weak practices that undermine the final IoT system.

Risk arising from people within an organisation, such as employees or contractors, who misuse legitimate access or negligently cause security or privacy harm.