Reduced exposure
Internet-facing risks identified and treated in priority order.
Implementation & guidance
ISO/IEC 27032 Cybersecurity Guidelines
Current edition: ISO/IEC 27032:2023 · guidelines
Guidelines for strengthening cybersecurity in the internet environment: the risks that arise from connectivity, the threats and attack methods involved, and the controls and cooperation that address them.
What the guidance covers
Cybersecurity in the internet environment
ISO/IEC 27032 helps organisations understand internet-related security risk and select controls, building on ISO/IEC 27001 and ISO/IEC 27002.
Stakeholder roles
Responsibilities of individuals, organisations and providers in the internet environment.
Threats and attack methods
Common attack vectors and how they exploit internet exposure.
Risk assessment
Internet-facing risks assessed within your security risk process.
Controls
Organisational, people and technical controls for internet-facing risk.
Incident management
Detection, response and coordination for cyber incidents.
Information sharing
Cooperation and coordination with partners and authorities.
Awareness
Staff awareness of phishing, social engineering and safe practice.
Supplier exposure
Internet-facing risk from suppliers and connected services.
Why organisations implement it
What a cybersecurity programme delivers
Faster response
Incident handling and coordination practised before they are needed.
Board visibility
Cyber risk reported in business terms.
Customer confidence
A structured answer to cyber questions from customers and insurers.
Regulatory support
A practical basis for NIS2-style cyber risk expectations.
Builds on your ISMS
No parallel system: the guidance feeds your ISO/IEC 27001 controls.
How we work
Path to a stronger cyber posture
One AEC methodology from first assessment to a sustained programme, delivered by registered lead auditors.
- AssessInternet exposure, threats and current controls reviewed
- DesignControl improvements and responsibilities agreed
- ImplementControls and processes put in place
- TrainAwareness and incident response training
- VerifyTesting, exercises and internal audit
- SustainControls maintained within your ISMS
Cyber baseline
We assess exposure and set a prioritised improvement plan, often as a first step to ISO/IEC 27001.
Typically 1 to 2 monthsISMS enhancement
We use the guidance to strengthen internet-facing controls in your ISMS.
Typically 2 to 4 monthsReadiness review
We test controls against the questions you are being asked.
Typically 1 month
How it is recognised
Guidelines, implemented through your ISMS
ISO/IEC 27032 is a set of guidelines and is not certifiable on its own. Organisations apply it within an ISO/IEC 27001 information security management system, which can be certified by an accredited certification body. AEC helps you apply the guidance and prepares your ISMS for audit.
Practical
Guidance turned into controls you can operate and evidence.
Certifiable route
Where certification is needed, the route is ISO/IEC 27001.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO/IEC 27032 by industry
Finance · online banking and payments
IT services · internet-facing platforms
Power & utilities · connected critical infrastructure
Government · digital public services
Related standards
Questions
ISO/IEC 27032 FAQ
Can we be certified to ISO/IEC 27032?
No. ISO/IEC 27032 is a set of guidelines. Where certification is needed, organisations apply it through an ISO/IEC 27001 ISMS, which accredited certification bodies certify.
How is it different from ISO/IEC 27001?
ISO/IEC 27001 sets requirements for an information security management system. ISO/IEC 27032 gives focused guidance on internet-related cyber risk that you can apply within that system.
Is it useful if we do not plan ISO/IEC 27001?
Yes. It provides a structured way to assess and improve internet-facing security, and the work carries over if you pursue ISO/IEC 27001 later.
Does AEC test our systems?
Our work covers risk assessment, controls, processes and readiness. Where technical testing such as penetration testing is needed, we help you scope it and use the results in your risk treatment.
Strengthen your cybersecurity
Tell us your internet-facing services and current controls. We reply with a proposal covering assessment, improvement and readiness.
Certification, where sought, is carried out by independent, accredited certification bodies. AEC prepares organisations and does not guarantee audit outcomes.