ISO 27001 Foundation key terms

A documented set of policies, processes, roles and controls an organization uses to protect information and manage security risk in a coordinated, continually improving way.

The three core properties information security aims to preserve: information is only accessible to authorized parties, remains accurate and complete, and is available when needed.

Preservation of confidentiality, integrity and availability of information, achieved through policies, processes, technology and people, whether information is stored digitally, on paper or held in conversation.

The effect of uncertainty on objectives, usually expressed as a combination of how likely an event is and how serious its consequences would be for the organization.

The potential for loss or harm to information and related assets arising from a threat exploiting a vulnerability, measured in terms of likelihood and business impact.

A potential cause of an unwanted incident that could damage information or systems, such as a malicious actor, a natural event, or an accidental human error.

A weakness in an asset, control, process or configuration that a threat could exploit to cause harm, for example an unpatched server or an untrained employee.

Anything that has value to the organization and therefore needs protection, including information, hardware, software, services, people, facilities and the organization's reputation.

A measure that modifies risk, such as a policy, procedure, technical setting, organizational structure or physical barrier, intended to prevent, detect or reduce the impact of incidents.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity, such as customers, regulators, employees or suppliers.

The internal and external factors, including legal, regulatory, market, cultural and capability issues, that are relevant to the organization's purpose and affect its ability to achieve intended ISMS outcomes.

A documented statement defining which parts of the organization, locations, systems, processes and information the management system covers, including justified exclusions.

Active involvement of top management in the ISMS, including setting direction, providing resources, integrating security into business processes and being accountable for its effectiveness.

A high-level documented statement, approved by top management, that sets the organization's security objectives, principles and commitment to meeting applicable requirements.

Clearly assigned duties and authorities for security activities across the organization, ensuring people know what they are accountable for and to whom they report.

Measurable goals the organization sets for its security performance, consistent with the security policy, assigned to responsible owners and tracked over time.

The process of identifying risks, analyzing their likelihood and impact, and evaluating them against risk criteria to decide which need treatment.

Selecting and applying options to address assessed risks, such as modifying, avoiding, sharing or accepting them, and determining the controls needed.

The risk that remains after controls have been applied and treatment decisions made, which must be compared with the organization's risk acceptance criteria.

The organization's defined basis for evaluating the significance of risk, including thresholds, appetite and rules for deciding when treatment or escalation is required.

A document listing the security controls the organization has selected, justifying inclusion or exclusion of each, and recording their implementation status.

A maintained record of identified risks, their owners, assessments, treatment plans and current status, used to track and review security risk over time.

The resources, competence, awareness, communication and documented information the organization provides so the ISMS can operate effectively.

The education, training, experience or skills a person needs to perform security-related work effectively, determined by the organization and evidenced where required.

Ensuring people understand the security policy, how their work contributes to the ISMS, and the implications of not conforming with its requirements.

Information the organization must control and maintain, including policies, procedures and records, covering creation, approval, distribution, storage, version control and retention.

Planned internal and external exchange of security information, defining what is communicated, when, with whom and by what method.

Managing the processes needed to meet ISMS requirements by establishing criteria, implementing controls and keeping records that demonstrate the processes worked as planned.

Systematically observing and quantifying security performance and control effectiveness to determine whether the ISMS is achieving intended results.

An independent, planned review of the ISMS against the standard's requirements and the organization's own criteria, producing findings for management action.

Top management's periodic evaluation of the ISMS's suitability, adequacy and effectiveness, using defined inputs and producing decisions on improvement and resources.

The overall process of judging how well the ISMS is working, drawing on monitoring, measurement, audit results and management review to inform decisions.

A failure to meet a requirement of the standard or of the organization's own ISMS, which must be recorded, investigated and corrected.

Action taken to eliminate the cause of a detected nonconformity so it does not recur, including assessing similar issues and reviewing the effectiveness of the fix.

The ongoing process of enhancing the ISMS's performance and effectiveness, using results from monitoring, audits, reviews and corrective actions to drive change.

Records and observations that objectively demonstrate the ISMS is implemented and effective, used during internal audits and external certification assessments.

An independent assessment by an accredited body that verifies the ISMS conforms to ISO/IEC 27001, typically in two stages followed by periodic surveillance.

The state in which the ISMS is fully implemented, operating with records, reviewed and audited internally, so that an external certification assessment can proceed smoothly.