ISO 27001 Lead Auditor flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

The three core information security properties defined in ISO/IEC 27000: confidentiality (no unauthorized disclosure), integrity (accuracy and completeness) and availability (accessible and usable on demand by an authorized entity).

Information security risk

The effect of uncertainty on information security objectives, typically expressed as the combination of the likelihood of a threat exploiting a vulnerability and the resulting consequences for the organization.

Risk treatment options

Four generic options: avoid the activity producing the risk, modify the risk by applying controls, share or transfer the risk (insurance, outsourcing), or retain the risk by an informed decision.

PDCA in ISO/IEC 27001

Plan covers clause 6 (risk assessment, risk treatment and objectives); Do covers clauses 7 and 8 (support and operation); Check is clause 9 (performance evaluation); Act is clause 10 (improvement).

Residual risk

The risk remaining after risk treatment has been applied. It is compared with the organization's risk acceptance criteria defined by top management to decide whether further treatment is required.

Statement of Applicability

Document required by ISO/IEC 27001 clause 6.1.3 that lists the controls the organization considers necessary, justifies all inclusions and exclusions, and states whether each control is implemented.

ISMS scope

The documented boundaries and applicability of the information security management system (clause 4.3), considering external and internal issues, interested party requirements, interfaces and dependencies.

Information security policy

A documented policy (clause 5.2) that includes information security objectives or the framework for setting them, a commitment to satisfy applicable requirements, and a commitment to continual improvement.

Annex A control themes

ISO/IEC 27001:2022 Annex A lists 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). They are reference controls, not an exhaustive list.

Documented information control

Clause 7.5 requires information required by the standard, and information the organization determines as necessary, to be available, protected and controlled for distribution, access, retrieval, use and retention.

Audit criteria

The set of policies, procedures and requirements against which objective evidence is compared to determine conformity. In an ISO/IEC 27001 audit this includes the standard, ISMS documents and applicable requirements.

Audit evidence

Records, statements of fact or other information which are relevant to the audit criteria and verifiable. Findings can only be raised when evidence is objective and traceable to the criteria.

Audit findings

The results of evaluating collected audit evidence against the audit criteria. Findings may indicate conformity or nonconformity and are recorded in the audit report.

Seven audit principles

ISO 19011:2018 lists integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach as the principles guiding auditors and the conduct of audits.

Third-party audit

An audit performed by an external independent organization, such as an accredited certification body, typically to grant, maintain or renew certification of an ISMS against ISO/IEC 27001.

Audit plan

A description of the activities and arrangements for a specific audit, including objectives, scope, criteria, dates, sites, audit team, schedule and confidentiality arrangements. It is agreed with the auditee.

Stage 1 audit

The readiness assessment in initial certification. It reviews documented information, ISMS scope, Statement of Applicability, site conditions and evidence of internal audit and management review to judge readiness for Stage 2.

Auditor competence

The ability to apply knowledge and skills, comprising knowledge of ISO/IEC 27001 and audit principles, information security and sector knowledge, and skills such as interviewing, sampling and report writing.

Documented information review

A pre-audit examination of ISMS documentation such as policy, risk assessment and treatment records, Statement of Applicability and procedures, used to identify gaps and target audit activities.

Audit sampling plan

The design of how many and which records, sites or transactions will be examined, chosen to be representative and weighted towards higher-risk processes and previously problematic areas.

Nonconformity

Non-fulfilment of a requirement. It is recorded with the requirement (audit criteria), the objective evidence observed, and the location or process where the departure was found.

Major nonconformity

A nonconformity that affects the capability of the management system to achieve intended results, such as a systemic failure or the absence of a required process like risk assessment or internal audit.

Opening meeting

The meeting at the start of the audit where the lead auditor confirms the audit plan, scope, criteria, team, communication channels, confidentiality, safety arrangements and availability of evidence.

Audit trail

The sequence linking a requirement in the audit criteria through policies and procedures to records and observed practice. Following it verifies implementation and the traceability of evidence.

Vertical audit sampling

Tracing a sample from a top-level requirement or policy down to records and actual practice, rather than examining isolated documents, to test whether the process is implemented effectively.

Closing meeting

The meeting at the end of the audit where the lead auditor presents findings, conclusions and nonconformities, explains the follow-up process, and agrees reporting arrangements and corrective action deadlines.

Audit report

The documented output of an audit covering objectives, scope, criteria, dates and sites, audit team, findings, conclusions and distribution, serving as the formal record of the audit.

Corrective action verification

The follow-up step in which evidence is evaluated to confirm that correction was made, the root cause removed and the action effective, before the nonconformity is formally closed.

Certification decision

The decision to grant, maintain, suspend or withdraw certification, made by a competent person of the certification body who is independent of the audit team and reviews the audit report and related information.

Audit programme

Arrangements for a set of audits planned for a specific time frame, defining objectives, extent (number, duration, frequency), resources, risks and the processes for planning and evaluating those audits.

Surveillance audit

An on-site audit of a certified organization at least once a calendar year, excluding recertification years, to verify continued conformity and effective operation of the ISMS, including use of marks.

Recertification audit

A full audit performed before the end of the three-year certification cycle to evaluate continued fulfilment of all requirements and the overall effectiveness of the information security management system.