EXIN ISFS cheat sheet

Confidentiality, Integrity, Availability (CIA triad) are the three core information security objectives; a control may support one or more of them.

Confidentiality ensures information is accessible only to authorized parties; breaches include eavesdropping, shoulder surfing, and unencrypted data transmission.

Integrity ensures information is accurate, complete, and protected against unauthorized modification; controls include hashing, digital signatures, and version control.

Availability ensures authorized users can access information and systems when needed; threats include DoS attacks, hardware failure, and power outages.

Information security is the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

A threat is a potential cause of an unwanted incident; a vulnerability is a weakness that can be exploited by a threat; risk is the combination of likelihood and impact.

Risk treatment options per ISO/IEC 27001: mitigate (apply controls), accept (retain risk), avoid (eliminate activity), transfer (share risk, e.g., insurance).

Defense in depth uses multiple layers of controls (physical, technical, administrative) so that failure of one layer does not compromise the whole.

The security triad is often extended with non-repudiation and accountability; non-repudiation prevents denial of having performed an action, typically via digital signatures.

ISO/IEC 27001 is the international standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).

The ISMS follows the Plan-Do-Check-Act (PDCA) cycle: Plan (establish ISMS), Do (implement and operate), Check (monitor and review), Act (maintain and improve).

ISO/IEC 27001:2013 clauses 4-10 contain mandatory requirements: context of the organization, leadership, planning, support, operation, performance evaluation, and improvement.

Annex A of ISO/IEC 27001:2013 lists 114 controls in 14 domains (A.5-A.18); the 2022 revision restructures Annex A into 93 controls in 4 themes (organizational, people, physical, technological).

A Statement of Applicability (SoA) documents which Annex A controls are applicable, why, and their implementation status; it is a mandatory requirement.

Risk assessment and risk treatment are mandatory planning activities; the organization must define a risk assessment methodology and risk acceptance criteria.

Leadership commitment is required: top management must establish the information security policy and assign roles and responsibilities.

Internal audit and management review are required performance evaluation activities; nonconformities and corrective actions must be addressed.

Certification to ISO/IEC 27001 is granted by an accredited certification body after a Stage 1 (documentation review) and Stage 2 (implementation audit) audit.