ISO/IEC 27400 IoT Security Controls and Risk Management
The exam tests how you convert IoT risk into selected, justified and owned controls using ISO/IEC 27400 as the reference framework, and how clearly you separate guidance from certification requirements.
What the standard is
ISO/IEC 27400:2022, Cybersecurity - IoT security and privacy - Guidelines, describes risks and gives principles and controls for IoT across the lifecycle. It is guidance, not a certifiable requirements standard: an assessment against it is not a certification, and an ISO/IEC 27001 ISMS remains the management-system backbone. Companion documents such as ISO/IEC 27402 address device baseline requirements.
Risk method
Identify assets, threats and vulnerabilities; estimate likelihood and impact, including safety and privacy impact, not only confidentiality loss; evaluate against risk criteria; treat by mitigating, avoiding, transferring or accepting; record residual risk with a named owner and review date. Controls are then selected to match the risk, spanning governance and organisational controls plus technical controls for devices, communications and backend services.
Worked example
A hospital deploys infusion pumps that clinical engineering cannot patch without recertification. Reasoning: asset = drug delivery and patient safety; threat = remote manipulation or ransomware; vulnerability = unpatched operating system on a flat network. Patching is not feasible, so the manager applies compensating controls - segmentation into a clinical VLAN, restrictive egress, monitoring and manual checks - and documents residual risk accepted by the clinical owner with a review date. The decision is defensible because it is explicit, owned and time-bound.
Traps that cost marks
Treating 27400 as a checklist to be passed; buying a product because a vendor claims a mapping to the standard; forgetting residual risk and the risk owner; omitting privacy risk; assuming a control works without testing or evidencing it.