I am interested in standardizations for secure design and development of products, especially towards operational technology / IoT / ICS. My understanding of information security management systems via the ISO 27XXX and country-specific standards from NIST etc. is that they usually consider the complete organisation.
This includes processes, buildings, employee trainings, servers etc. which is relevant for most companies. But I feel like I am missing guidelines for IT end products, which must be secured, too. I know that there are some sector-specific standards for IT companies like ISO 27011 for telecommunication, 27019 (energy) or 27017 (cloud). Also, there is the ISO 62443 which considers security for operational technology. For web applications OWASP seems to be the go-to.
My question is: Which standards (if any) am I missing that focus on security measures, risk analysis, etc. for the product itself? For instance what should you adhere to when developing
- IoT devices with some sensors and a simple web access?
- A public but simple device like a billboard control unit? I would not expect this to count as an ICS.
- Turnstiles which even play a security role.
The general steps are probably similar between all security standards but I feel like there should be defined solutions and approaches for operational technology systems to analyse from hardware via interfaces and operating systems to running apps and network services. Maybe I just have wrong expectations and it's normal to picks together the relevant parts from different standards that meet their system? E.g. security for a web server here, operating system security there, add some C coding guidelines and so.