Information security standards

Information security standards (also cyber security standards) are guidelines generally outlined in published materials that aim to protect a user's or organization's cyber environment from threats. This environment includes the users themselves, hardware such as devices and networks, software such as applications or services, and any information in storage or transit. In general, a cyber environment consists of systems that can be connected, directly or indirectly, to networks. These standards cover security concepts and technologies, recommended policies and best practices to deal with an adverse event, and training and guidelines to implement the published standards. They may also include assessment criteria, a body to audit the implementation of these criteria, and certification for organizations implementing the recommended changes. The principal objectives of these standards are to prevent or mitigate cyber-attacks, ensure consistency among developers, and establish a minimum standard in industries susceptible to an attack. They are published by various national and international bodies to help users and organizations enhance their cybersecurity posture and present a coordinated and structured response.