ISO 27001 Lead Auditor key terms

Protection of information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction, so that confidentiality, integrity and availability are preserved in line with business needs and applicable requirements.

Property that information is not made available or disclosed to unauthorized individuals, entities or processes. It is one of the three core properties that an information security management system exists to protect.

Property of accuracy and completeness of information and of the systems that process it, meaning data has not been altered, deleted or corrupted in an unauthorized or undetected way.

Property of being accessible and usable on demand by an authorized entity. It covers uptime, resilience and timely restoration of information and systems after a disruption.

Effect of uncertainty on objectives. In information security it describes the potential for loss or harm when a threat exploits a vulnerability, combined with the likelihood and impact of that event.

Overall process of identifying, analysing and evaluating information security risk against defined criteria, producing a prioritized picture of risk that the organization must treat or accept.

Process of selecting and applying measures to modify risk, for example by avoiding, reducing, sharing or accepting it. Chosen controls are recorded in the Statement of Applicability.

Risk remaining after risk treatment has been applied. It is compared with the organization's acceptance criteria and formally accepted by the accountable risk owner.

Person or entity with the accountability and authority to manage a specific risk, including deciding whether residual risk is acceptable and ensuring that agreed treatments are carried out.

Documented statement listing the information security controls the organization considers relevant, explaining why each is included or excluded and recording its implementation status.

Set of interrelated or interacting elements of an organization, including policies, objectives and processes, used to protect information and to achieve the organization's information security objectives.

Combination of internal and external issues and interested party requirements that influence how the ISMS is designed, scoped and operated.

Documented boundaries and applicability of the information security management system, defining the organizational units, locations, processes, technologies and interfaces that the ISMS covers.

Documented statement of top management's overall intentions and direction for information security, providing a framework for setting objectives and committing to continual improvement.

Review of the ISMS by top management at planned intervals to judge its suitability, adequacy and effectiveness and to decide on improvements, resources and changes.

Recurring activity to enhance performance. In an ISMS it is achieved by evaluating results, addressing nonconformities and taking actions that improve the suitability, adequacy and effectiveness of the system.

Action to eliminate the cause of a nonconformity and prevent it from recurring. It follows analysis of the cause and differs from a correction, which only fixes the immediate problem.

Systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.

Set of requirements used as the reference against which audit evidence is compared, such as ISO/IEC 27001, the organization's own procedures, contracts or applicable legislation.

Records, statements of fact or other information relevant to the audit criteria that can be verified. Evidence is gathered through interviews, observation and document review and underpins findings.

Results of evaluating collected audit evidence against audit criteria. Findings show conformity or nonconformity and are recorded and reported to the auditee and the client.

Non-fulfilment of a requirement, whether the requirement comes from ISO/IEC 27001, the organization's own ISMS documentation, a contract or applicable legislation.

Outcome of an audit, reached after considering the audit objectives and all findings, stating the extent of conformity and any recommended follow-up or certification decision.

Organization, part of an organization or person being audited. The auditee provides access, evidence and personnel and is responsible for acting on the findings.

Auditor given overall responsibility for an audit, including planning, directing the audit team, managing communications, resolving difficulties and delivering the audit report.

Freedom from bias and conflicts of interest so that conclusions rest only on evidence. It requires auditors not to audit their own work or to be improperly influenced by others.

Selecting a subset of items from a larger population to obtain evidence and draw conclusions about the whole. Sample size and selection method should be justified and representative.

Description of the activities and arrangements for a single audit, covering objectives, criteria, scope, schedule, team roles, methods and allocation of resources.

Initial audit that reviews the documented ISMS and the organization's readiness for stage 2, identifying concerns that can be resolved before the certification audit proceeds.

Audit that evaluates whether the ISMS is implemented and effective, verifying conformity with ISO/IEC 27001 and with the organization's own policies and objectives.

Meeting at the start of the audit that confirms scope, objectives, criteria, schedule, communication arrangements and how findings will be reported and classified.

Nonconformity that affects the capability of the management system to achieve intended results, or a significant failure against a requirement, usually needing correction before certification is granted.

Isolated or single observed departure from a requirement that does not indicate a systemic failure of the ISMS, but which still requires correction and corrective action.

Meeting at the end of the audit where the team presents findings, conclusions and recommendations, and where follow-up arrangements and reporting timelines are agreed.

Document giving the results of an audit, including scope, criteria, findings, conclusions and any agreed follow-up, issued to the audit client and relevant parties.

Audit performed to verify that corrections and corrective actions taken in response to findings have been implemented and are effective.

Set of one or more audits planned for a specific time frame and purpose, including arrangements for scheduling, resourcing, conducting and monitoring those audits.

Person responsible for establishing, implementing, monitoring and improving the audit programme, including allocating resources, scheduling audits and evaluating auditor performance.

Combination of knowledge, skills and personal attributes needed to audit effectively, covering ISMS requirements, audit methods, sector understanding and the ability to communicate clearly.

Approach to planning the audit programme in which the frequency, depth and priority of audits are set according to risk levels, process importance and past performance.