ISO/IEC 27032

Cybersecurity guidelines - cyberspace stakeholder roles, controls, information sharing.


Short name	ISO 27032
Region	International
Country or scope	International
Sector	General
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers ISO 27032

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for ISO 27032.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for ISO 27032 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`ISO27032-ASSET` Cyberspace Asset Identification	Organisations must identify the assets they expose to and depend on in cyberspace, which for applications means an inventory of their software components (ISO/IEC 27032 asset identification guidance)	Scan
`ISO27032-CTRL` Technical Integrity Controls	Recommended technical controls include protecting systems against malicious code and unauthorised modification, evidenced by cryptographic integrity hashes on software artifacts (ISO/IEC 27032 technical controls guidance)	Scan
`ISO27032-STAKE` Provider and Stakeholder Coordination	Cybersecurity in cyberspace depends on coordination between consumers and providers of services and software, requiring documented knowledge of who supplies each component (ISO/IEC 27032 stakeholder roles guidance)	Scan
`ISO27032-SHARE` Information Sharing Framework	Effective inter-organisational information sharing requires structured, standardised data about systems, which for software estates means machine-readable SBOM formats (ISO/IEC 27032 information sharing and coordination framework)	Scan
`ISO27032-INC` Incident Coordination Readiness	Coordinated incident handling across stakeholders requires that affected components can be unambiguously identified and communicated (ISO/IEC 27032 incident handling coordination guidance)	Scan
`ISO27032-POC` Coordination Contact Points	Information sharing and coordination frameworks require established organisational points of contact, evidenced by contact details recorded alongside system documentation (ISO/IEC 27032 coordination and contact guidance)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`5.2`	Cyberspace Stakeholder Responsibilities: Consumers
`5.3`	Cyberspace Stakeholder Responsibilities: Providers
`10.1`	Asset Management in Cyberspace
`10.2`	Threat and Vulnerability Management
`11.1`	Application Security Controls
`12.1`	Server and Infrastructure Security
`13.1`	End-User Security Controls
`14.1`	Controls Against Social Engineering
`15.1`	Information Sharing and Coordination
`15.2`	Cybersecurity Incident Response Coordination

Policy templates

Written for ISO 27032:

Cybersecurity Programme Charter
Cyber Threat Intelligence Information Sharing Policy

And 22 from the standard set, adapted to ISO 27032.