EXIN ISFS flashcards
EXIN ISFS · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Confidentiality
- The property that information is not made available or disclosed to unauthorized individuals, entities, or processes. It is one of the three core objectives in the CIA triad.
- Integrity
- The property of safeguarding the accuracy and completeness of assets. It ensures information has not been modified in an unauthorized or accidental manner.
- Availability
- The property of being accessible and usable upon demand by an authorized entity. It ensures systems and data are available when needed.
- Threat
- A potential cause of an unwanted incident that may result in harm to a system or organization. Examples include malware, hackers, and natural disasters.
- Vulnerability
- A weakness of an asset or control that can be exploited by one or more threats. Examples include unpatched software, weak passwords, and misconfigurations.
- Risk
- The potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization. Often expressed as likelihood times impact.
- Risk treatment
- The process of selecting and implementing measures to modify risk. Options include mitigation, acceptance, avoidance, and transfer.
- Defense in depth
- A layered security approach using multiple overlapping controls so that if one control fails, others continue to protect the asset. Layers include physical, technical, and administrative.
- Non-repudiation
- The assurance that a party cannot deny having performed an action, such as sending a message or authorizing a transaction. Often achieved using digital signatures.
- Asset
- Anything that has value to the organization, including information, hardware, software, people, and facilities. Assets require protection based on their value.
- Control
- A measure that modifies risk. Controls can be preventive, detective, or corrective, and may be administrative, technical, or physical in nature.
- Incident
- A single or series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security.
- Policy
- A set of management directives and commitments that guide an organization's information security efforts. It is approved by top management and sets overall direction.
- Access control
- The process of granting or denying specific requests to obtain and use information and related information processing services. It enforces confidentiality and integrity.
- Authentication
- The process of verifying the identity of a user, process, or device. It is often a prerequisite for granting access to resources.
- Malware
- Software designed to cause harm, such as viruses, worms, trojans, and ransomware. It is a common threat to confidentiality, integrity, and availability.
- ISO/IEC 27001
- An international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
- ISMS
- Information Security Management System: a systematic approach to managing sensitive information, including policies, procedures, and controls, based on risk assessment.
- PDCA cycle
- Plan-Do-Check-Act: a four-step management method used in ISO/IEC 27001 to continuously improve the ISMS. Plan establishes objectives, Do implements, Check monitors, Act improves.
- Annex A
- The section of ISO/IEC 27001 that lists information security controls. In the 2013 version, it contains 114 controls in 14 domains; the 2022 version has 93 controls in 4 themes.
- Statement of Applicability
- A mandatory document that lists the applicable Annex A controls, justifies their inclusion or exclusion, and records their implementation status. Abbreviated SoA.
- Risk assessment
- The overall process of risk identification, risk analysis, and risk evaluation. It is a mandatory planning activity in ISO/IEC 27001.
- Risk treatment plan
- A document that describes how the organization will treat identified risks, including the controls selected, resources required, and responsibilities. It is required by ISO/IEC 27001.
- Top management
- The person or group who directs and controls an organization at the highest level. ISO/IEC 27001 requires top management to demonstrate leadership and commitment to the ISMS.
- Information security policy
- A document that states the organization's commitment to information security, sets objectives, and establishes principles. It must be approved by top management.
- Internal audit
- A systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Required by ISO/IEC 27001.
- Management review
- A periodic review by top management of the ISMS to ensure its continuing suitability, adequacy, and effectiveness. It is a required activity in ISO/IEC 27001.
- Nonconformity
- The non-fulfillment of a requirement. ISO/IEC 27001 requires organizations to identify nonconformities, take corrective action, and review the effectiveness of actions taken.
- Corrective action
- Action taken to eliminate the cause of a nonconformity and prevent recurrence. It is a required element of the improvement clause in ISO/IEC 27001.
- Certification body
- An independent organization accredited to audit and certify an ISMS against ISO/IEC 27001. Certification involves a two-stage audit process.
- Scope of ISMS
- The boundaries and applicability of the ISMS, including the organizational units, locations, and assets covered. It must be defined and documented.
- Continual improvement
- The recurring activity to enhance performance, required by ISO/IEC 27001. It is achieved through the Act phase of the PDCA cycle and includes corrective actions and management review.