ISO 27001 Internal Auditor flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Property that information is not made available or disclosed to unauthorized individuals, entities or processes. It is one of the three core properties of information security and applies to electronic and paper records alike.

Integrity

Property of accuracy and completeness. Integrity protects information against unauthorized modification or corruption, whether accidental or deliberate, and applies to data, systems and the processes that handle them.

Availability

Property of being accessible and usable on demand by an authorized entity. Availability depends on capacity, resilience, backup and recovery arrangements, and is assessed relative to agreed service levels.

Information security risk

Effect of uncertainty on information security objectives, commonly expressed as a combination of the consequences of an event and the likelihood of its occurrence. It is the basis for selecting controls.

Residual risk

Risk remaining after risk treatment has been applied. It must be compared against the organization's risk acceptance criteria and formally accepted by an authorized risk owner before treatment closes.

Threat and vulnerability

A threat is a potential cause of an unwanted incident; a vulnerability is a weakness that can be exploited by one or more threats. Risk arises where a threat can exploit a vulnerability and cause impact.

Defence in depth

Layering multiple preventive, detective and corrective controls so that failure or bypass of a single control does not compromise the whole protection scheme. It reduces the likelihood and impact of control failure.

Least privilege

Principle that users and processes receive only the access rights necessary to perform their assigned tasks, for only as long as needed. It limits the damage caused by error, misuse or compromised accounts.

CIA triad

Confidentiality, integrity and availability, the three core properties that information security aims to preserve. Additional properties such as authenticity, accountability, non-repudiation and reliability may also be relevant.

ISMS definition

An information security management system is a set of interrelated elements including policy, objectives, processes and documented information used to manage information security risk and protect information assets.

Clause 4 context

Requires the organization to determine external and internal issues, interested parties and their relevant requirements, and to define the scope and boundaries of the ISMS including interfaces and dependencies.

Clause 5 leadership

Requires top management to demonstrate leadership and commitment, establish an information security policy, ensure integration into business processes, provide resources and assign roles, responsibilities and authorities.

Statement of Applicability

Document listing all Annex A controls, stating whether each is included or excluded, with justification for exclusions and reference to the risk treatment decisions that selected the included controls.

Annex A 2022 structure

ISO/IEC 27001:2022 Annex A contains 93 controls organized into four themes: organizational with 37, people with 8, physical with 14, and technological with 34 controls.

Clause 6.1.2 risk assessment

Requires a defined and applied information security risk assessment process with criteria, consistent valid and comparable results, identification of risk owners, and documented information as evidence.

Clause 6.1.3 risk treatment

Requires a defined and applied risk treatment process that selects appropriate options, determines controls, produces a Statement of Applicability, and obtains risk owner approval of residual risk.

Clause 9 internal audit

Requires the organization to conduct internal audits at planned intervals to determine whether the ISMS conforms to its own requirements and to ISO/IEC 27001, and is effectively implemented and maintained.

Management review inputs

Clause 9.3 review considers status of prior actions, changes in context, feedback on performance including nonconformities and audit results, risk assessment results, and opportunities for improvement.

Audit definition

Systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. It produces findings and conclusions.

Audit criteria

Set of requirements used as a reference against which objective evidence is compared. For an ISMS audit these include ISO/IEC 27001, the organization's own documentation and applicable legal requirements.

Audit evidence

Records, statements of fact or other information relevant to the audit criteria and verifiable. Evidence is collected through interviews, observation, document review and technical checks, and supports findings.

Audit finding

Result of evaluating collected audit evidence against audit criteria. Findings are recorded as conforming or nonconforming, and nonconformities may be graded major or minor depending on severity.

Audit independence

Principle that auditors must be free from bias and conflict of interest and must not audit their own work. Independence supports impartial conclusions and is required for credible internal audits.

Audit programme

Set of one or more audits planned for a specific time frame and directed towards a specific purpose. It includes scheduling, resourcing, competence and monitoring of audit activities.

Evidence-based approach

Audit principle that evidence shall be verifiable and conclusions reached only on the basis of verified evidence. Hearsay, opinion or undocumented assertion alone does not constitute a finding.

Risk-based audit approach

Allocation of audit effort in proportion to information security risk and to the importance of processes and controls. Higher-risk areas receive more time, larger samples and deeper verification.

Audit trail technique

Following a transaction or process from input through processing to output, and tracing a risk from assessment through treatment to control evidence, to test consistency across the ISMS.

Sampling in audit

Selecting a subset of a population to draw conclusions about the whole. Sample size should be planned, justified, risk-directed and recorded so that findings can be reproduced and defended.

Audit objectives

Statement of what the audit is intended to accomplish, for example determining conformity and effectiveness of the ISMS. Objectives differ from scope, which defines boundaries of the audit.

Audit plan

Document describing audit objectives, scope, criteria, dates, locations, audit team, auditees and time allocation. It is agreed with the auditee and communicated before the audit begins.

Opening meeting

Meeting at the start of the audit that confirms the audit plan, scope, criteria, methods, communication channels, confidentiality arrangements and escalation routes, and clarifies any questions from auditees.

Nonconformity statement

A written finding stating the requirement not met, the objective evidence found, and why the evidence fails to meet the requirement. It enables the auditee to understand and correct the issue.

Closing meeting

Meeting at the end of the audit where findings and conclusions are presented to the auditee and client. The purpose is to agree the facts, not necessarily the audit conclusion or the corrective action.

Corrective action

Action to eliminate the cause of a nonconformity and prevent recurrence. It follows root cause analysis and is verified for effectiveness by the auditor before the finding is closed.

Audit conclusion

Audit team's judgement on the extent to which audit criteria are fulfilled, considering all findings. It is stated in the audit report and may include recommendations for improvement.

Follow-up audit

Audit scheduled to verify that corrective actions have been implemented and are effective. Unclosed nonconformities are escalated to management review and tracked in the audit programme.