National foreword

This Published Document is the UK implementation of ISO/IEC TS 30149:2024.

The UK participation in its preparation was entrusted to Technical Committee IOT/1, Internet of Things.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

This publication is not to be regarded as a British Standard.

Compliance with a Published Document cannot confer immunity from legal obligations.

This Published Document was published under the authority of the Standards Policy and Strategy Committee on 31 May 2024.

FOREWORD

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The formal decisions or agreements of IEC and ISO on technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC and ISO National bodies.
IEC and ISO documents have the form of recommendations for international use and are accepted by IEC and ISO National bodies in that sense. While all reasonable efforts are made to ensure that the technical content of IEC and ISO documents is accurate, IEC and ISO cannot be held responsible for the way in which they are used or for any misinterpretation by any end user.
In order to promote international uniformity, IEC and ISO National bodies undertake to apply IEC and ISO documents transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC and ISO document and the corresponding national or regional publication shall be clearly indicated in the latter.
IEC and ISO do not provide any attestation of conformity. Independent certification bodies provide conformity assessment services and, in some areas, access to IEC and ISO marks of conformity. IEC and ISO are not responsible for any services carried out by independent certification bodies.
All users should ensure that they have the latest edition of this document.
No liability shall attach to IEC and ISO or their directors, employees, servants or agents including individual experts and members of its technical committees and IEC and ISO National bodies for any personal injury, property damage or other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this ISO/IEC document or any other IEC and ISO documents.
Attention is drawn to the Normative references cited in this document. Use of the referenced publications is indispensable for the correct application of this document.
IEC and ISO draw attention to the possibility that the implementation of this document may involve the use of (a) patent(s). IEC and ISO take no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, IEC and ISO had not received notice of (a) patent(s), which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at https://patents.iec.ch and www.iso.org/patents. IEC and ISO shall not be held responsible for identifying any or all such patent rights.

ISO/IEC 30149 has been prepared by subcommittee 41: Internet of Things and Digital Twin, of ISO/IEC joint technical committee 1: Information technology. It is a Technical Specification.

The text of this Technical Specification is based on the following documents:

Full information on the voting for its approval can be found in the report on voting indicated in the above table.

The language used for the development of this Technical Specification is English.

This document was drafted in accordance with ISO/IEC Directives, Part 2, and developed in accordance with ISO/IEC Directives, Part 1, and the ISO/IEC Directives, JTC 1 Supplement available at www.iec.ch/members_experts/refdocs and www.iso.org/directives.

INTRODUCTION

With the complexity of many Internet of Things (IoT) solutions today, understanding the inherent risks of these products and solutions can be difficult without the correct context or technical understanding of the solution. Trust is a concept to ensure that all relevant stakeholders understand the specific trust elements of a solution and any potential risks to their given use case.

As potential vulnerabilities and attacks increase in complexity, they are only one aspect of the risk at hand. Design, components, and development techniques are some of the elements that can be considered during the creation, building and deployment of an IoT solution. Ensuring trust elements are identified at each stage of development for each component while considering all relevant stakeholders will provide a means to demonstrate a level of trustworthiness.

Leveraging the system architecture-based approach to ensure alignment to products and services used in ISO/IEC 30141:–[1] 1 will allow all stakeholders to implement trustworthiness for products and solutions.

Figure 1 shows the relationship with ISO/IEC 30141.

This document specializes the trustworthiness view of the IoT reference architecture.
This document lists in Annex A a number of patterns that can be used in the construction view of the IoT reference architecture.

1 Scope

This document provides elements of IoT trustworthiness based on the IoT reference architecture specified in ISO/IEC 30141.

2 Normative references

3 Terms and definitions

4 Abbreviated terms

5 Concept of trustworthiness

5.1 Relation to trust

5.2 Relation to context

5.3 Relation to characteristics, behaviour, assurance and confidence

6 Characteristics

6.1 Safety

6.2 Security

6.3 Privacy

6.4 Resilience

6.5 Reliability

7 Managing trustworthiness

7.1 General

7.2 Assumptions

7.3 Assurance

7.4 Risks

7.5 Composition

7.6 Trustworthiness profiles

8 Building trustworthiness

8.1 General

8.2 Capability viewpoint

8.3 Risk viewpoint

8.4 Assurance viewpoint

8.5 Operationalization

Bibliography

PD ISO/IEC TS 30149:2024

Internet of Things (IoT). Trustworthiness principles

Current

Published:

31 May 2024

1 Scope