ISO/IEC 27040:2024 is the international standard for storage security—helping organisations protect information while it is stored in ICT systems and while it moves across storage-related communication links (for example, between hosts, storage, backups, and storage networks).

It provides requirements and practical guidance for a consistent approach to the planning, design, documentation, and implementation of storage security—so protection is built in, measurable, and easier to audit.

It focuses on storage security across the full lifecycle, including:

• Storage devices and media (handling, protection, and control)
• Storage management activities (secure administration and operations)
• Applications and services that interact with storage
• Monitoring and control of user activity, including after end-of-use / end-of-life

If your organization stores sensitive data on-premises or in the cloud, ISO/IEC 27040:2024 helps you strengthen security where breaches often occur: data at rest, backups, storage administration, and storage connectivity.

• Builds trust — provides clear assurance that stored information is protected with recognised good practice.
• Strengthens procurement — supports security requirements in tenders and supplier due diligence.
• Reduces breach impact — improves storage hardening, monitoring, and control of privileged access.
• Supports compliance — reinforces governance over retained data, backups, and end-of-life disposal.
• Improves resilience — strengthens recoverability, including protection of backup and archive repositories.

ISO/IEC 27040 is relevant to anyone owning, operating, or using storage devices, media, and storage networks—including senior managers, procurement teams, security leaders, storage administrators, and solution architects. It is especially valuable where storage is complex (multiple platforms, shared environments, outsourced services, or high regulatory expectations) and responsibilities must be clearly defined.

As a cyber security research organization, Cyber Security Centre provides evidence-based guidance grounded in current research and industry practice. Our team holds postgraduate qualifications (Masters level and above), with staff undertaking PhD research, enabling us to deliver clear, practical advice that supports governance, implementation, and assurance activities.