BS IS0/IEC 27404:2025 BSl Standards Publication Cybersecurity IoT security and privacy - Cybersecurity labelling framework for consumer IoT bsi. BSIS0/IEC27404:2025 BRITISH STANDARD Nationalforeword This British Standard is theUKimplementation ofIS0/IEC27404:2025. The UKparticipation inits preparation was entrusted toTechnical CommitteeIST/33/4, SecurityControlsand Services. A list of organizations represented on this committee can be obtained on request to its committeemanager. Contractual and legal considerations This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted liability is expressly disclaimed to the full extent permitted by the law. This publication is provided as is, and is to be used at the recipient's own risk. The recipient is advised to consider seeking professional guidance with respect to its use of this publication. This publication is not intended to constitute a contract. Users are responsiblefor its correct application. @TheBritish Standards Institution2025 PublishedbyBSIStandardsLimited2025 ISBN9780539259537 ICS35.030;35.240.95 Compliance with a British Standard cannot confer immunity from legal obligations. This British Standard was published under the authority of the StandardsPolicyandStrategyCommitteeon31October2025. Amendments/corrigendaissued sincepublication Date Textaffected BS IS0/IEC 27404:2025 IEC International ISo Standard ISO/IEC 27404 First edition Cybersecurity IoT security and privacy - Cybersecurity labelling 2025-10 framework for consumer IoT Cybersécurite-Sécurite et protection de la vie priveepourIIDO -Cadred'étiquetagedecybersécuritepourI'IDOgrandpublic Reference number ISO/IEC27404:2025(en) @ISO/IEC2025 BSIS0/IEC27404:2025 IS0/IEC27404:2025(en) COPYRIGHTPROTECTEDDOCUMENT @IS0/IEC2025 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISo at the address below or Iso's member body in the country of the requester. ISO copyright office CP 40i : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +4122 749 0111 Email: [email protected] Website: www.iso.org Published in Switzerland IS0/IEC2025-Allrightsreserved ii BSIS0/IEC27404:2025 IS0/IEC27404:2025(en) Contents Page Foreword. Introduction .vi 1 Scope. .1 2 Normative references. .1 3 .2 Terms and definitions. 4 Abbreviated terms. 4 5 OverviewofcybersecuritylabellingforconsumerIoT 5 5.1 Cybersecuritylabelling for consumer loT .5 5.2 Guiding principles.. 5 5.3 Programmeobjectives .6 5.4 Threats and risks to consumer IoT products .6 6 5.4.1 General 5.4.2 Assumptions ..6 5.4.3 Risk considerations and high-level categories .7 5.4.4 .7 Security threats and risks. 5.4.5 Privacythreatsandrisks .8 5.5 Relevant standards and guidancedocuments .9 International alignmentthrough a cybersecuritylabelling framework. 9 6 6.1 Objectivesforinternational alignment 9 6.2 Determination of cybersecurity requirements through relevant standards and guidancedocuments .9 7 Requirements and guidance for the components of the cybersecurity labelling frameworkforconsumerIoT. .10 7.1 ..10 General .10 7.2 Requirementsfor the cybersecurity labelling framework components. 7.3 Guidanceon thecorecomponents of cybersecuritylabellingframework 11 7.4 Guidance onkeystakeholders'rolesand responsibilities .12 7.5 Guidanceon binaryand multi-level labelling schemes. 13 7.5.1 General. 13 7.5.2 Binary versus multi-level labelling schemes 13 7.5.3 Basis for levels. 14 7.6 Guidance on mutual- and cross-recognition. .14 7.6.1 General .14 7.6.2 Benefits. .14 7.6.3 Equivalencydetermination. 15 7.7 Guidance on conformity assess