ISO 27008: A Guideline for Information Security Auditing

ISO 27008 is closely related to other standards in the ISO 27000 family, including:

The primary purpose of ISO 27008 is to provide guidelines for organizations to review the effectiveness of their information security controls. This includes evaluating the controls' design and operating effectiveness, identifying areas for improvement, and ensuring that the controls are aligned with the organization's overall information security objectives.

ISO 27008 acts as a bridge between the management requirements and the technical reality of security.

ISO 27008, titled "Information security, cybersecurity and privacy protection — Information security controls — Review of information security controls," provides guidance on the review of information security controls. The standard is part of the ISO 27000 family of standards, which focus on information security management.