EXIN ISFS key terms

Protecting information and the systems that hold it from loss of confidentiality, integrity and availability, whether the threat is deliberate, accidental, or caused by natural events such as fire or flood.

Ensuring information is readable only by people who are authorized to see it. Loss of confidentiality means data has been disclosed to someone who should not have had access to it.

Ensuring information and processing are accurate, complete and protected against unauthorized change. Loss of integrity means data has been altered, deleted or corrupted, whether by an attacker, a mistake or a system fault.

Ensuring information and systems are accessible to authorized users when they need them. Loss of availability means services are down, data is unreachable, or access is so slow that work cannot be done.

The combination of the chance that a threat will exploit a weakness and the harm that would result. In security work, risk is usually expressed as a product of likelihood and impact on the organization.

Any potential cause of an unwanted incident that could harm information or systems. Threats may be human, such as hackers or insiders, or non-human, such as fire, power failure or malware.

A weakness in a system, process or building that a threat can use to cause damage. Missing patches, weak passwords, unlocked server rooms and untrained staff are all examples of vulnerabilities.

Anything of value to the organization that needs protection. Assets include data, software, hardware, buildings, people and the organization's reputation, and each should have a clear owner.

Assigning information to defined categories, such as public, internal, confidential or secret, based on its sensitivity and the harm that disclosure would cause. Classification determines which protection measures apply.

The set of rules and mechanisms that decide who may use which systems, data and facilities, and for what purpose. It includes identification, authentication, authorization and logging of access attempts.

Proving that a user or system is who it claims to be. This is typically done with something you know, something you have, or something you are, and stronger logins combine more than one of these.

Deciding what an authenticated user is allowed to do. Authentication confirms identity, while authorization determines which files, applications and actions that identity may access.

Giving people only the access they need to do their job, and no more. This limits the damage an insider, a compromised account or a mistaken action can cause.

A principle stating that access to specific information is granted only to people who require it for their current task. It is narrower than role-based access because it follows the job, not the job title.

Software written to do harm, such as viruses, worms, trojans, spyware and ransomware. It may steal data, encrypt files, spy on users or give attackers remote control of a device.

Malware that encrypts or steals data and demands payment for its release. Good backups, patching and user awareness are the main defenses, and paying does not guarantee recovery.

A social engineering attack that tricks people into revealing credentials or clicking harmful links by pretending to be a trusted party. It usually arrives by email, but also by SMS, phone or social media.

Manipulating people into breaking security procedures or giving away information. Attackers exploit trust, authority, urgency or curiosity rather than technical weaknesses in systems.

Activities that help employees recognize threats and follow security rules, such as training sessions, simulated phishing tests and clear communication of policies. It reduces risk that technology alone cannot address.

An event, or a series of events, that has harmed or could harm information security. Examples include a lost laptop, a malware infection, a data breach or a serious outage.

The process of detecting, reporting, containing and recovering from security incidents, and of learning from them afterwards. Clear roles and reporting lines make response faster and limit damage.

Planning and arrangements that keep critical business processes running, or restore them quickly, after a serious disruption. It covers people, premises, systems and suppliers, not only information technology.

Documented procedures for restoring IT systems and data after a major failure or disaster. It defines recovery priorities, responsibilities and the target time within which services must be working again.

A copy of data kept separately so it can be restored if the original is lost, corrupted or encrypted. Backups should be tested regularly and stored where malware or fire cannot reach both copies.

The routine of tracking, testing and installing software updates that fix known weaknesses. Unpatched systems are a common entry point for attackers, so delays should be controlled and documented.

An employee, contractor or partner who misuses legitimate access to harm the organization or steal from it. Controls such as least privilege, logging and separation of duties reduce this risk.

Splitting a sensitive task between two or more people so that no single person can complete it alone. This makes fraud and serious error harder, because collusion would be needed.

A top-level document in which management states its intentions and direction for protecting information. It sets principles and responsibilities and is the basis for more detailed standards and procedures.

The international standard that specifies requirements for establishing, operating, monitoring and continually improving an information security management system. Organizations can be audited and certified against it.

An information security management system: the combined policies, processes, roles and records an organization uses to manage information security in a systematic, risk-based and continually improving way.

The part of ISO/IEC 27001 that lists the information security control objectives and controls an organization can select from. Its numbering changed in the 2022 edition, which reorganized the controls into four themes.

A document listing every control from Annex A and stating whether it is applied, and why. It records the justification for inclusion or exclusion and links each decision to the risk assessment.

The structured process of identifying risks, analyzing them and evaluating whether they are acceptable. Its results drive which controls the organization chooses to apply.

Choosing and applying measures to deal with assessed risks. Options include reducing the risk with controls, accepting it, avoiding the activity, or transferring it, for example through insurance.

The risk that remains after controls have been applied. Management must decide whether this remaining level is acceptable, and it should be recorded and reviewed as part of the ISMS.

The continual improvement cycle on which ISO management standards are built: plan what is needed, implement it, check results against expectations, and act to correct and improve.

A planned, periodic review by top management of the ISMS, its performance and its alignment with business goals. Its inputs and outputs are defined in ISO/IEC 27001 and must be documented.

An independent assessment by an accredited body that checks whether an organization's ISMS meets the requirements of ISO/IEC 27001. A successful outcome leads to a certificate valid for a limited period, subject to surveillance audits.