EXIN ISMP key terms

The preservation of confidentiality, integrity and availability of information, plus whatever other properties such as authenticity, accountability, non-repudiation and reliability an organization decides matter to it.

The property that information is not made available or disclosed to unauthorized individuals, entities or processes. It is protected through access control, classification, encryption and need-to-know rules.

The property of accuracy and completeness, meaning data and processing methods have not been altered or destroyed in an unauthorized way, whether accidentally or deliberately.

The property of being accessible and usable on demand by an authorized entity. It covers resilience, redundancy, backup and recovery so that services continue when components fail.

A management system made of policies, objectives, processes and responsibilities that an organization uses to direct and control information security in a systematic, risk-based and continually improving way.

Anything that has value to the organization, including information, hardware, software, people, services, facilities and reputation. Assets are identified and valued so they can be protected in proportion to their importance.

The effect of uncertainty on objectives, usually expressed as the combination of the likelihood of an unwanted event and its consequences. In security terms it links threats, vulnerabilities and asset impact.

A potential cause of an unwanted incident that may harm a system or organization. Threats can be human, environmental or technical, and may be accidental or deliberate.

A weakness in an asset or control that a threat can exploit. Vulnerabilities are found through audits, scans, penetration tests and incident reviews, and are then treated or accepted.

The overall process of risk identification, risk analysis and risk evaluation. It establishes which risks exist, how significant they are and whether they need treatment.

The process of selecting and implementing measures that modify risk. Options include avoiding, reducing, transferring or accepting the risk, and the choice is documented and approved by risk owners.

The risk that remains after risk treatment has been applied. It must be compared with the organization's risk acceptance criteria and formally accepted by the appropriate owner.

The amount and type of risk an organization is willing to pursue or retain in order to meet its objectives. It guides decisions on which risks to treat and which to accept.

The person or entity with the accountability and authority to manage a particular risk. The owner approves treatment decisions and accepts residual risk on behalf of the organization.

A measure that modifies risk, such as a policy, procedure, technical setting or organizational arrangement. Controls can be preventive, detective or corrective in nature.

A document listing the controls an organization has selected, explaining why each is included or excluded and recording its implementation status. It links the risk assessment to the chosen controls.

A cyclical improvement model applied to management systems: plan objectives and processes, implement them, monitor results against targets, and act to improve performance continually.

The recurring activity of enhancing performance, for example by raising the effectiveness of controls, closing gaps found in audits and learning from incidents and measurements.

A top-management evaluation of the ISMS at planned intervals, covering its suitability, adequacy and effectiveness, and producing decisions on improvement and resource needs.

The documented boundaries of the management system: which business units, locations, systems, processes and interfaces are covered, and which are explicitly excluded.

A set of top-level rules and direction, approved by management, that states how the organization protects information and what objectives it commits to. It is the basis for lower-level standards and procedures.

Rules describing how users may and may not use organizational information systems and data, including email, internet, devices and removable media, together with the consequences of misuse.

The means of granting and restricting access to assets and information based on business and security requirements, typically combining identity, authentication, authorization and accountability.

The principle that users and processes receive only the minimum access rights needed to perform their tasks, and only for the time required.

Splitting sensitive tasks among different people so that no single person can both commit and conceal an error or fraud, for example separating payment approval from payment execution.

The act of verifying a claimed identity, typically using something the user knows, has or is. It must be distinguished from authorization, which decides what that identity may do.

Assigning information to defined categories, such as public, internal, confidential or secret, so that handling, labeling and protection rules are applied consistently.

A single or series of unwanted or unexpected information security events that has a significant probability of compromising business operations and threatening security.

An identified occurrence of a system, service or network state indicating a possible breach of policy or control, or a previously unknown situation that may be security relevant.

The structured process of detecting, reporting, assessing, responding to, escalating and learning from security incidents, including communication with stakeholders and evidence handling.

The capability of an organization to continue delivering products or services at acceptable predefined levels after a disruptive incident, supported by plans, backups and alternate arrangements.

The state in which users understand security risks and their own responsibilities. Awareness programs change behavior and support every other control, from phishing resistance to clean-desk rules.

A failure to meet a requirement, whether from the standard, the organization's own policy or a legal obligation. It is recorded, corrected and followed up to prevent recurrence.

Action taken to eliminate the cause of a detected nonconformity or other undesirable situation so that it does not recur. It goes beyond simply fixing the immediate symptom.

A systematic, independent and documented process for obtaining evidence and evaluating it objectively against agreed criteria, such as the ISMS standard or internal policies.

Recording events and activity in systems so that they can be reviewed, investigated and used as evidence. Logs support detection, accountability and incident response.