ISO 27001 Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

ISMS definition

A systematic approach to managing sensitive information, comprising policies, objectives, processes and controls that together protect confidentiality, integrity and availability of information.

ISO/IEC 27001 purpose

Specifies requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization.

Annex A control themes

Organizational, People, Physical and Technological. The 2022 edition has 93 controls in these four themes.

Statement of Applicability

Documented statement describing which Annex A controls are applicable, why they are included or excluded, and their implementation status.

Residual risk

The risk remaining after risk treatment has been applied and controls have been implemented; it must be accepted by the risk owner.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives.

PDCA in ISMS

Plan (establish), Do (implement and operate), Check (monitor and review), Act (maintain and improve) the information security management system.

Interested parties

Persons or organizations that can affect, be affected by, or perceive themselves to be affected by a decision or activity.

ISMS scope statement

Documented information defining the boundaries and applicability of the ISMS, considering internal and external issues and interested-party requirements.

Internal and external issues

Factors relevant to the organization's purpose that affect its ability to achieve intended ISMS outcomes, including legal, technological, cultural and governance factors.

Interfaces and dependencies

Relationships and reliance between activities performed by the organization and those performed by other parties, which must be considered when defining the ISMS scope.

Context of the organization

The combination of internal and external factors and conditions that can affect the organization's approach to information security and its ISMS.

Top management leadership

Requirement that top management demonstrate leadership by establishing policy and objectives, integrating ISMS requirements into processes and providing resources.

Information security policy

Documented statement of top management direction for information security, including objectives and commitment to satisfy applicable requirements and continual improvement.

Risk acceptance criteria

Criteria defining the level of risk the organization is willing to accept; used to evaluate risks and decide on treatment.

Information security objectives

Measurable objectives consistent with the information security policy, monitored, communicated and updated as needed.

Risk owner

Person or entity with the accountability and authority to manage a risk, including accepting residual risk.

Competence requirement

Determine necessary competence, ensure personnel are competent, take actions to acquire competence and retain documented evidence of competence.

Documented information control

Ensures documented information is available and suitable where and when needed, and protected from loss of confidentiality, integrity and availability.

Internal audit requirement

Conduct internal audits at planned intervals to determine whether the ISMS conforms to requirements and is effectively implemented and maintained.

Management review

Top management reviews the ISMS at planned intervals, considering defined inputs and producing decisions related to improvement and changes.

Operational planning and control

Processes needed to meet ISMS requirements must be planned, implemented and controlled, with documented information retained as evidence.

Monitoring and measurement

Determine what needs monitoring, the methods, when to monitor and measure, and when results are analyzed and evaluated.

Nonconformity and corrective action

React to a nonconformity, evaluate the need to eliminate its cause, implement action, review effectiveness and retain documented information.

Continual improvement

Ongoing activity to enhance the suitability, adequacy and effectiveness of the ISMS, including improving information security performance.

Stage 1 audit

Initial certification audit phase that reviews the organization's readiness, documented information and understanding of requirements before the Stage 2 audit.

Stage 2 audit

Certification audit phase evaluating implementation and effectiveness of the ISMS, including evidence of operation and conformity with requirements.

Surveillance audit

Periodic audit after certification, typically annual, to confirm the certified management system continues to conform and operate effectively.

Major nonconformity

A nonconformity that significantly affects the capability of the management system to achieve intended results, usually requiring correction before certification.

Effectiveness versus efficiency

Effectiveness is the extent to which planned results are achieved; efficiency is the relationship between results achieved and resources used.

Outsourcing responsibility

The organization remains accountable for externally provided processes, products or services within the ISMS scope and must control them.

Risk treatment options

Modify risk through controls, retain risk, avoid the activity or share the risk; the choice must align with risk acceptance criteria.