ISO 27032 LCM flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Cyberspace definition

The complex environment resulting from the interaction of people, software and services on the Internet, supported by technology and connected devices; broader than the Internet alone.

Cybersecurity definition

Preservation of confidentiality, integrity and availability of information in cyberspace, achieved through coordinated action among the many participants who share that environment.

Information security vs cybersecurity

Information security protects information in any form; cybersecurity focuses specifically on information and interactions within cyberspace, including shared infrastructure and interdependence between parties.

Provider and consumer roles

Providers deliver cyberspace services such as connectivity and applications; consumers use them. Each has distinct security responsibilities that must be coordinated across the shared environment.

Extended security properties

Beyond confidentiality, integrity and availability, the framework references authenticity, accountability, non-repudiation and reliability as properties relevant to trust in cyberspace.

Stakeholder coordination gap

A named cybersecurity challenge: participants in cyberspace often lack shared coordination, clear roles and consistent policy, leaving gaps that attackers can exploit.

Policy hierarchy

Policy states direction and intent; standards give mandatory specifics; procedures describe step-by-step execution; guidelines are recommended practice. Lower documents must not contradict higher ones.

Cybersecurity policy content

Top-management direction covering scope, objectives, roles, risk approach, incident reporting expectations, and commitment to review, approved and communicated to relevant parties.

Role definition essentials

Each role needs named responsibilities and authority: policy owner, risk owner, security manager, asset owners, incident lead, and external provider contact points.

Information-sharing agreements

Arrangements defining what incident and threat information is exchanged with providers and partners, in what timeframe, under which confidentiality terms, and through which contact points.

Segregation of duties

An organizational control that separates conflicting responsibilities, such as requesting access versus approving it, to reduce the risk of error and misuse.

Third-party policy scope

Outsourced and cloud services extend the organization's cyberspace footprint; contracts should carry security requirements, notification duties and audit or assurance rights.

Risk treatment options

Modify by applying controls, retain by accepting, avoid by eliminating the activity, or share by transfer such as insurance or contractual allocation; residual risk needs formal owner acceptance.

Control categories

Preventive controls stop events; detective controls identify them; corrective controls limit damage; recovery controls restore service. Effective programmes combine all four categories.

Defence in depth

Layering controls across people, process and technology so that failure of any single control does not lead directly to compromise of critical assets.

Vulnerability management cycle

Inventory assets, scan for weaknesses, classify by severity, remediate within defined timeframes, verify the fix, and document exceptions with compensating controls and owners.

Risk register contents

A record of asset, threat, vulnerability, existing controls, likelihood, impact, rating, treatment plan, risk owner and review date, used as primary audit evidence.

Dependency mapping

Identifying interconnected systems and providers the organization relies on in cyberspace, so that risk assessment covers inherited and shared risks, not only internal assets.

Event versus incident

An event is any observable occurrence in a system or network; an incident is such an occurrence, or series, with actual or potential adverse security impact.

Incident response phases

Preparation; detection and reporting; assessment and classification; response through containment, eradication and recovery; then post-incident review with tracked corrective actions.

Escalation criteria

Pre-agreed severity levels, notification timelines, and internal and external reporting paths such as regulators, law enforcement and affected parties.

Chain of custody

Documented sequence of identification, collection, acquisition, preservation and handling of evidence, so that its integrity and reliability can be demonstrated later.

Continuity versus response

Incident response restores normal service operation after an incident; business continuity maintains critical functions during disruption. Both plans must be tested and aligned.

Lessons-learned review

A post-incident analysis producing corrective actions tracked to closure, which then feed back into risk assessment and control selection.

Improvement metrics

Measures such as time to detect, time to respond, incidents by type, repeat incidents, and percentage of corrective actions closed on time.

Guidance versus requirements

ISO/IEC 27032 offers guidelines and is not certifiable; ISO/IEC 27001 contains auditable requirements against which organizations can be certified.

PDCA mapping

Plan establishes policy, objectives and risk treatment; Do implements; Check monitors, measures and audits; Act corrects and improves the management system.

Nonconformity types

A nonconformity is a requirement not fulfilled. Major nonconformities indicate system failure or significant risk; minor ones are isolated lapses; observations flag improvement potential.

Competence evidence

Records of training, qualifications and experience, plus evaluation of whether actions taken to acquire competence actually achieved the needed ability.

Management review inputs

Audit results, risk status, incident and nonconformity status, performance against objectives, and feedback from interested parties, used to decide improvement actions.

Certification cycle

Certification is time-limited; surveillance audits occur periodically, and recertification requires a full reassessment completed before the certificate expires.