I am interested in standardizations for secure design and development of products, especially towards operational technology / IoT / ICS. My understanding of information security management systems via the ISO 27XXX and country-specific standards from NIST etc. is that they usually consider the complete organisation.

This includes processes, buildings, employee trainings, servers etc. which is relevant for most companies. But I feel like I am missing guidelines for IT end products, which must be secured, too. I know that there are some sector-specific standards for IT companies like ISO 27011 for telecommunication, 27019 (energy) or 27017 (cloud). Also, there is the ISO 62443 which considers security for operational technology. For web applications OWASP seems to be the go-to.

My question is: Which standards (if any) am I missing that focus on security measures, risk analysis, etc. for the product itself? For instance what should you adhere to when developing

  1. IoT devices with some sensors and a simple web access?
  2. A public but simple device like a billboard control unit? I would not expect this to count as an ICS.
  3. Turnstiles which even play a security role.

The general steps are probably similar between all security standards but I feel like there should be defined solutions and approaches for operational technology systems to analyse from hardware via interfaces and operating systems to running apps and network services. Maybe I just have wrong expectations and it's normal to picks together the relevant parts from different standards that meet their system? E.g. security for a web server here, operating system security there, add some C coding guidelines and so.

2 Answers 2


If you're looking at IoT devices then the EU's EN303 645 standard [pdf] would be a good starting point - and may be (or become) mandatory for you to follow, depending on where your devices will be sold.

You can read more about it (and the key requirements) on the ETSI website.

  • 1
    This is already interesting, especially as it will probably become mandatory. Thanks
    – Nesuma
    Oct 16, 2023 at 11:19

Currently there is not really a standard for securing IoT devices. There are several initiatives such as Baseline Security Recommendations for IoT — ENISA. Several jurisdictions are in the process of proposing laws that require IoT devices to be secure. For example, the product security legislation in the United Kingdom.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .