ISO 27001 LI flashcards
ISO 27001 LI · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Confidentiality
- The property that information is not made available or disclosed to unauthorized individuals, entities, or processes; it is one leg of the CIA triad.
- Integrity
- The property of accuracy and completeness of information and systems; it ensures data has not been altered or destroyed in an unauthorized way.
- Availability
- The property of being accessible and usable on demand by an authorized entity; it supports timely access to information and systems when needed.
- Information security
- Preservation of confidentiality, integrity and availability of information; it may also involve other properties such as authenticity, accountability, non-repudiation and reliability.
- ISMS
- An information security management system is a set of interrelated policies, objectives, processes and controls used to manage information security risk and protect information.
- Interested party
- A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity related to the ISMS.
- Risk assessment
- The overall process of identifying, analyzing and evaluating information security risk against established risk criteria to determine which risks need treatment.
- Risk treatment
- The process of selecting and implementing measures to modify risk, including avoiding, modifying, sharing or retaining risk, and producing a risk treatment plan.
- Statement of Applicability
- A document listing the Annex A controls that are applicable, the justification for inclusion or exclusion, and the implementation status of each control.
- Risk treatment plan
- A plan that records selected risk treatment actions, resources, responsible owners, timelines and expected residual risk for identified information security risks.
- Residual risk
- The risk that remains after risk treatment has been applied; it must be compared with risk acceptance criteria and accepted by an accountable owner.
- Risk owner
- A person with the authority and accountability to manage a particular information security risk, including approving treatment and accepting residual risk.
- Documented information
- Information required to be controlled and maintained by the organization, plus the medium on which it is contained, including policies, records and evidence of results.
- Competence
- The ability to apply knowledge and skills to achieve intended results; the ISMS requires determining, ensuring and evidencing necessary competence for relevant roles.
- Awareness
- Persons doing work under the organization's control must know the information security policy, their contribution to the ISMS, and implications of not conforming.
- Operational planning and control
- Clause 8 requirement to plan, implement and control processes needed to meet ISMS requirements, including establishing criteria and controlling outsourced processes.
- Least privilege
- An access control principle that grants users only the minimum permissions necessary to perform their assigned tasks and no more.
- Segregation of duties
- A control principle that divides incompatible tasks among different people to reduce the risk of error, fraud or unauthorized actions.
- Internal audit
- A systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent of ISMS conformity and effectiveness.
- Audit programme
- A set of one or more audits planned for a specific time frame, including frequency, methods, responsibilities, planning and reporting, and should be risk-based.
- Management review
- A top management review of the ISMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness, with documented inputs and outputs.
- Monitoring
- The process of observing the state of an activity, system or control; it may be done continually or periodically and does not necessarily assign a numerical value.
- Corrective action
- Action taken to eliminate the cause of a nonconformity and prevent recurrence; it follows root cause analysis and must be reviewed for effectiveness.
- Nonconformity
- A failure to meet a requirement of ISO/IEC 27001 or of the organization's own ISMS requirements; it requires reaction, correction and where applicable corrective action.
- Continual improvement
- A recurring activity to enhance ISMS performance, using results from monitoring, audits, management review and nonconformities to identify and implement improvements.
- Correction
- Action to eliminate a detected nonconformity, such as fixing the immediate problem; unlike corrective action, it does not address the underlying cause.
- Root cause analysis
- A structured method to identify the underlying reason a nonconformity occurred so that corrective action can prevent recurrence rather than only fixing symptoms.
- Improvement opportunity
- A potential enhancement to ISMS effectiveness or efficiency identified from data analysis, audits, reviews or feedback; it is evaluated and implemented under Clause 10.1.
- Stage 1 audit
- The initial certification audit that evaluates documentation, scope, risk assessment, Statement of Applicability and readiness for Stage 2; it is not a full conformity audit.
- Stage 2 audit
- The certification audit that evaluates implementation and effectiveness of the ISMS against ISO/IEC 27001 requirements and applicable Annex A controls within the scope.
- Surveillance audit
- A periodic certification audit, typically at least annually, conducted after initial certification to confirm continuing conformity and effective operation of the ISMS.
- Major nonconformity
- A significant failure to meet a requirement, such as a systemic breakdown or absence of a required process, that can prevent certification until corrected and verified.