ISO 27032 LCM cheat sheet

ISO/IEC 27032 defines cyberspace as the complex environment resulting from the interaction of people, software and services on the Internet, supported by technology and connected devices; it is not a synonym for the Internet alone.

The standard distinguishes cybersecurity from information security (protection of information regardless of form), application security, network security, and Internet security; cybersecurity is the preservation of confidentiality, integrity and availability of information in cyberspace.

Cybersecurity is framed as a multi-stakeholder activity: it depends on coordination among participants in cyberspace rather than on the actions of a single organization.

Core cybersecurity properties in the framework are confidentiality, integrity and availability, extended by related properties such as authenticity, accountability, non-repudiation and reliability.

The framework identifies provider and consumer roles: providers of cyberspace services (telecommunications, ISPs, application providers) and consumers/end users, each with distinct security responsibilities.

Key cybersecurity challenges named in the framework include lack of coordination among stakeholders, unclear roles and responsibilities, and gaps between technical and policy measures.

The framework's structure follows a plan-do-check-act style: understand the environment, define a cybersecurity policy, implement controls, and improve through monitoring and review.

Cybersecurity risk differs from information security risk in scope: it includes threats arising from shared cyberspace infrastructure and interdependence between organizations.

A cybersecurity policy states top-management direction on protecting information in cyberspace; it is the parent document from which standards, procedures and guidelines derive.

Policy hierarchy rule: policy (what and why) → standards (mandatory specifics) → procedures (how, step by step) → guidelines (recommended practice).

Stakeholder categories in the ISO/IEC 27032 framework include providers, consumers, and other parties such as governments, regulators and law enforcement; coordination mechanisms must be defined for each.

Roles to define explicitly: policy owner, risk owner, security manager/CSO, system and asset owners, incident response lead, and contact points with external providers.

The framework emphasizes trust and information-sharing arrangements between organizations, including agreements on incident notification, escalation and joint response.

Segregation of duties and least privilege are organizational controls that must be reflected in role definitions, not only in technical configuration.

Policy documents require management approval, publication, communication to relevant staff, and scheduled review; version and ownership metadata are typical audit evidence.

Cross-border and third-party dependencies belong in policy scope: outsourced services and cloud providers extend the organization's cyberspace footprint and must be addressed in agreements.

Risk = likelihood of an event × its consequence; treatment options are modify (mitigate), retain (accept), avoid, and share (transfer), with residual risk requiring formal acceptance by the risk owner.

Cybersecurity risk assessment starts from asset identification and dependency mapping in cyberspace, including interconnected systems the organization does not directly control.

Control categories to select from: preventive, detective, corrective, and recovery; a balanced set is expected rather than prevention-only.

Technical control families relevant to cyberspace include identity and authentication, network segmentation and perimeter protection, malware protection, patch and vulnerability management, logging and monitoring, and cryptography.

Defence in depth: layered controls across people, process and technology, so a single control failure does not lead directly to compromise.

Vulnerability management cycle: inventory, scan, classify by severity, remediate within defined timeframes, verify, and record exceptions with compensating controls.

Third-party and supply-chain risk controls include security requirements in contracts, right-to-audit clauses, and monitoring of provider security performance.

Risk registers record asset, threat, vulnerability, existing controls, likelihood, impact, risk rating, treatment plan, owner and review date; they are the primary audit artefact for risk management.

Incident management phases: preparation, detection and reporting, assessment and classification, response (contain, eradicate, recover), and post-incident review.

Incident and event are distinct: an event is any observable occurrence in a system or network; an incident is an event (or series) with actual or potential adverse security impact.

Escalation criteria must be defined in advance, including severity levels, notification timelines, and internal and external reporting paths (regulator, law enforcement, affected parties).

Evidence handling follows chain-of-custody principles: identification, collection, acquisition, preservation, and documentation, to keep evidence admissible and reliable.

Business continuity and disaster recovery plans are the recovery backbone; incident response restores normal service operation, while continuity maintains critical functions during disruption.

Lessons-learned reviews after incidents should produce corrective actions tracked to closure, feeding back into risk assessment and control selection.

Metrics for continuous improvement include time to detect, time to respond, number of incidents by type, repeat incidents, and percentage of corrective actions closed on time.

Monitoring and review (the check and act phases) include internal audit, management review, performance measurement, and updating policies and risk assessments when the environment changes.

Know the difference between certifiable management system standards (e.g. ISO/IEC 27001) and guidance standards such as ISO/IEC 27032, which provides guidelines rather than auditable requirements.

Mandatory documentation concepts to recall: scope, policy, risk assessment and treatment, statement of applicability, competence records, and documented information control.

PDCA mapping: Plan = establish policy, objectives and risk treatment; Do = implement; Check = monitor, measure, audit; Act = correct and improve.

Audit terminology: nonconformity (requirement not fulfilled), major vs minor nonconformity, observation/opportunity for improvement, corrective action, and root-cause analysis.

Competence evidence includes training records, qualifications, experience, and evaluation of the effectiveness of actions taken to acquire competence.

Exam technique: eliminate options that are absolute or that substitute advice for a defined requirement; prefer answers that name the responsible role and the documented process.

Management review inputs typically include audit results, risk status, incident and nonconformity status, performance against objectives, and feedback from interested parties.

Certification cycle facts: certification is time-limited, surveillance audits occur periodically, and recertification requires a full reassessment before expiry.