ISO 27001 LI key terms

Preservation of confidentiality, integrity and availability of information, with other properties such as authenticity, accountability, non-repudiation and reliability also considered where relevant.

Property that information is not made available or disclosed to unauthorized individuals, entities or processes, so access is limited to those with a legitimate need.

Property of accuracy and completeness, meaning information and processing methods are protected from unauthorized modification, loss or corruption.

Property of being accessible and usable on demand by an authorized entity, supported by reliable systems and timely restoration after disruption.

A systematic set of policies, processes, responsibilities and controls an organization uses to manage information security risks and protect its information assets.

Effect of uncertainty on objectives, often expressed as a combination of the likelihood of an event and its consequences.

A potential cause of an unwanted incident that may result in harm to a system, organization or individual.

A weakness in an asset, control or process that a threat could exploit to cause an information security incident.

Anything that has value to the organization and therefore requires protection, such as information, systems, people, facilities and reputation.

External and internal factors, including legal, regulatory, market and cultural issues, that affect how an organization establishes and operates its ISMS.

Person or organization that can affect, be affected by, or perceive itself affected by a decision or activity related to information security.

The amount and type of information security risk an organization is willing to accept in pursuit of its objectives.

Terms of reference for evaluating the significance of risk, including likelihood, impact, risk levels and acceptance thresholds.

Defined boundaries and applicability of the ISMS, including interfaces and dependencies, documented to clarify what is covered.

Top-level documented direction stating the organization's commitment to information security, including objectives and principles for managing risk.

Process of identifying, analyzing and evaluating information security risks against defined criteria to determine which need treatment.

Process of selecting and applying controls to modify risk, including avoiding, reducing, sharing or accepting it.

Documented statement listing relevant Annex A controls, whether they are applicable, justification for inclusion or exclusion, and implementation status.

Person with accountability and authority to manage a particular information security risk, including approving treatment and accepting residual risk.

Measure that modifies risk, such as a policy, procedure, technical safeguard or organizational practice, intended to prevent, detect or reduce impact.

The information security risk remaining after controls have been implemented and existing risk treatment has been applied; it must be compared with risk acceptance criteria.

Documented plan specifying controls to implement, resources, responsibilities, timelines and expected outcomes for treating identified risks.

Ability to apply knowledge and skills to achieve intended results, gained through education, training or experience and verified where necessary.

The state in which people understand the information security policy, their contribution to the ISMS and the implications of not conforming.

Information that must be controlled and maintained, including policies, records and evidence, in whatever format and medium it exists.

Determining the status of a system, process or control by collecting data over time, often using defined metrics and methods.

Process of determining a value using a defined scale or method to assess performance against information security objectives or criteria.

Systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine whether the ISMS conforms to planned arrangements.

Top management's periodic evaluation of the ISMS's suitability, adequacy and effectiveness, leading to decisions on improvement and resource needs.

Records, statements, facts or other information that is verifiable and relevant to audit criteria, used by auditors to reach findings.

Failure to meet a requirement, whether in the ISMS, a control or a process, which requires correction and investigation of its cause.

Action taken to eliminate the cause of a nonconformity and prevent recurrence, proportionate to the effect of the problem.

Recurring activity to enhance performance, including improving the ISMS, controls and processes, often driven by audit results, reviews and corrective actions.

Independent audit by a certification body to evaluate whether an organization's ISMS conforms to ISO/IEC 27001 and is effectively implemented.

Initial certification audit phase that reviews documentation and readiness to determine whether the organization is prepared for the stage 2 audit.

Certification audit phase that evaluates implementation and effectiveness of the ISMS through sampling, interviews and evidence review.

Periodic audit after certification to confirm continued conformity and effectiveness, typically conducted at least annually during the certification cycle.

Audit conducted before a certificate expires to determine whether certification should be renewed for another cycle, reviewing the whole ISMS and sustained effectiveness.