EXIN ISMP flashcards
EXIN ISMP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Confidentiality
- Property that information is not made available or disclosed to unauthorized individuals, entities, or processes. It is protected by classification, access control, encryption, and need-to-know rules.
- Integrity
- Property of accuracy and completeness of information and its processing. It is safeguarded by change control, hashing, checksums, segregation of duties, and logging of modifications.
- Availability
- Property of being accessible and usable on demand by an authorized entity. It relies on redundancy, backups, capacity planning, and protection against denial-of-service and physical disruption.
- Risk
- The effect of uncertainty on objectives, expressed as a combination of the likelihood of an event and its consequence. In security terms it is the potential for loss from a threat exploiting a vulnerability.
- Residual risk
- The risk that remains after risk treatment controls have been applied. Management formally accepts residual risk when it falls within the organization's defined risk appetite and criteria.
- Risk treatment options
- Four choices for handling risk: modify (apply controls to reduce it), retain (accept it), avoid (stop the activity), and share (transfer part of it, for example via insurance or contracts).
- Statement of Applicability
- Documented statement describing which information security controls are relevant and applicable to the ISMS, whether each is implemented, and the justification for inclusion or exclusion.
- ISO/IEC 27001
- International standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system. Organizations can be certified against it by accredited auditors.
- ISO/IEC 27002
- International standard providing guidance and best-practice implementation advice for information security controls. It is a reference for selecting controls but is not itself a certifiable requirements standard.
- Annex A control themes
- In ISO/IEC 27001:2022 the 93 controls are grouped into four themes: organizational, people, physical, and technological. The earlier 2013 edition instead used 114 controls in 14 clauses.
- PDCA cycle
- Plan-Do-Check-Act is the continual improvement model underpinning the ISMS: plan the policy and risk treatment, implement it, monitor and audit results, then correct and improve.
- Defence in depth
- Layering multiple independent controls across physical, network, host, application, data, and human domains so that the failure of any single control does not expose the whole organization.
- Least privilege
- Principle that users and processes receive only the minimum access rights needed to perform their tasks, and only for the time required, reducing the impact of error or compromise.
- Role-based access control
- Access model where permissions are assigned to roles rather than individuals, and users are granted roles. It simplifies administration and supports consistent enforcement of least privilege.
- Multi-factor authentication
- Authentication using two or more factors from different categories: something you know, something you have, and something you are. Two passwords from the same category do not qualify.
- Digital signature
- Cryptographic value created with a sender's private key and verified with the public key. It provides authenticity, integrity, and non-repudiation, but does not by itself provide confidentiality.
- Symmetric encryption
- Encryption using one shared secret key for both encryption and decryption. It is fast and suited to bulk data, but key distribution and key management are the main challenges.
- Asymmetric encryption
- Encryption using a mathematically related public and private key pair. It solves key distribution and enables digital signatures, but is slower and typically used to protect symmetric keys.
- Hashing
- One-way transformation producing a fixed-length value from input. It supports integrity checking and, when salted and iterated, password storage; it does not provide confidentiality.
- Business impact analysis
- Process identifying critical business processes and the consequences of their disruption, used to set recovery priorities, recovery time objectives, and recovery point objectives for continuity planning.
- Recovery time objective
- The maximum acceptable time that a business process or system may be unavailable after a disruption before unacceptable consequences arise. It drives continuity and disaster recovery design.
- Recovery point objective
- The maximum acceptable amount of data loss measured in time, determining how frequently backups or replication must occur to meet continuity requirements.
- Security incident
- A single or series of unwanted or unexpected information security events with a significant probability of compromising business operations and threatening information security.
- Incident response phases
- Typical sequence: preparation; detection and reporting; assessment and decision; response including containment, eradication, and recovery; and post-incident learning with lessons applied.
- Nonconformity
- A failure to meet a requirement of the standard or the organization's own ISMS. It requires documented correction plus root-cause analysis and corrective action to prevent recurrence.
- Internal audit
- Independent, planned examination of the ISMS against requirements and the organization's own criteria. Results feed management review and corrective action for continual improvement.
- Management review
- Top management's periodic evaluation of the ISMS, considering audit results, incidents, risk status, and performance, and deciding on resources and improvement actions.
- Asset owner
- Role accountable for a specific information asset, including its classification, its handling requirements, and decisions on who may access it. Custodians implement those decisions.
- Information classification
- Assigning labels such as public, internal, confidential, or secret to information so that proportionate handling, access, and protection rules can be applied consistently.
- Awareness versus training
- Awareness changes attitude by explaining what and why; training builds the skills to do something; education develops deeper understanding. Awareness is continuous, not a one-off annual event.
- Key performance indicator
- A metric showing how effectively a security process is performing, such as percentage of patches applied on time. It differs from a key risk indicator, which warns of rising risk.
- Supplier security management
- Due diligence before contracting, security requirements written into agreements, and ongoing monitoring of third parties. Cloud providers may operate controls but accountability for data stays with the organization.