ISO 27032 LCM key terms

The interconnected digital environment of networks, systems, services, and users that people rely on to communicate, transact, and store information, distinct from but dependent on the physical world.

The preservation of confidentiality, integrity, and availability of information and services in cyberspace, together with the protection of the people and organizations that depend on them.

Protection of information regardless of format or medium, focused on confidentiality, integrity, and availability; in ISO 27032 it is treated as related to but narrower than cybersecurity.

The three core security properties: confidentiality (only authorized parties can access), integrity (data is accurate and unaltered), and availability (systems and data are accessible when needed).

The set of interdependent participants, technologies, and infrastructures whose combined interactions determine the security of cyberspace, including providers, users, and public authorities.

Any person or organization with an interest in, or influence over, the security of cyberspace, including operators, suppliers, regulators, users, and law enforcement.

Structured sharing of information, decisions, and actions among interested parties so that security measures across different organizations and sectors reinforce rather than conflict with each other.

Explicit assignment of security duties, decision rights, and accountability to named positions or functions so that every control and response activity has a clear owner.

Visible leadership support, including resources, policy approval, and participation in governance, that makes a cybersecurity program authoritative and sustainable across the organization.

A documented statement of management intent and direction for protecting cyberspace assets, providing the framework within which objectives and detailed controls are established.

Specific, measurable outcomes an organization sets for its security posture, derived from policy and risk assessment, and used to judge whether the program is effective.

Rules describing how users may employ organizational systems, networks, and data, including prohibited activities and consequences, reducing risk from everyday human behavior.

Timely exchange of threat, vulnerability, and incident data between organizations and authorities under agreed trust, privacy, and handling conditions.

The effect of uncertainty on objectives, usually expressed as the combination of the likelihood of a harmful event and the severity of its consequences.

A systematic process of identifying assets and threats, analyzing likelihood and impact, and evaluating which risks are acceptable relative to defined criteria.

Selecting and applying options to modify risk, such as avoiding, reducing, transferring, or accepting it, then documenting the chosen controls and remaining exposure.

The risk that remains after controls have been implemented, which must be compared with the organization's risk acceptance criteria and formally acknowledged by an accountable owner.

A documented management decision to retain a risk without further treatment, based on cost-benefit judgment and within the organization's stated tolerance.

A potential cause of an unwanted incident that could harm assets, arising from human actors, technical failures, or environmental events.

A weakness in a system, process, or control that a threat could exploit to cause harm; identified through scanning, testing, and review.

A measure that modifies risk, implemented as a technical, administrative, or physical safeguard and monitored to confirm it operates as intended.

Layering independent controls so that failure of one safeguard does not expose the whole environment, increasing the effort an attacker must expend.

Dividing networks and systems into zones with controlled traffic between them, limiting the spread of compromise and simplifying access rules.

Rules and mechanisms that decide which subjects may perform which actions on which resources, typically combining identification, authentication, authorization, and logging.

Granting each user, service, or process only the permissions needed for its current task, reducing the damage possible if an account is misused or compromised.

An account with elevated rights such as administrator or root access, requiring stronger authentication, tighter monitoring, and restricted allocation because of its high impact.

A repeatable process for identifying, testing, deploying, and verifying software updates that close known vulnerabilities within defined timeframes.

Maintaining known, approved, and documented settings for systems and applications, and detecting drift from those baselines.

Ongoing education that helps users recognize threats, follow policy, and report suspicious activity, addressing the human element of cyberspace risk.

Deceptive messages that impersonate a trusted party to trick recipients into revealing credentials, transferring funds, or running malicious content.

Manipulating people through psychological pressure or false context to obtain information or access, bypassing technical controls by targeting human trust.

Software written to disrupt operations, steal data, or gain unauthorized access, including viruses, worms, trojans, and ransomware.

Malicious software that encrypts or locks data and demands payment for restoration, often combined with data theft and extortion.

Analyzed information about current and emerging threats, actors, and techniques that informs defensive priorities and detection content.

A single or series of unwanted events that harm or threaten to harm information assets or services and requires a coordinated response.

Monitoring and analysis activities, such as log review, alerting, and user reports, that reveal potential incidents as early as possible.

A platform that collects and correlates logs and events from many sources to surface suspicious patterns and support investigation.

A documented process for preparing, detecting, containing, eradicating, recovering from, and learning from incidents in a controlled and repeatable way.

A structured post-incident review that identifies root causes and improvement actions, feeding them back into policy, controls, and response plans.

The capability to keep delivering essential services at acceptable levels during and after disruption, supported by recovery plans and tested arrangements.

A recurring cycle of measuring performance, identifying gaps, and implementing changes so that the management system and its controls become more effective over time.

A set of interrelated policies, objectives, processes, and responsibilities an organization uses to direct and control its activities toward defined outcomes.

An independent, systematic examination of whether the management system conforms to requirements and operates effectively, producing findings for management action.

A periodic top-management evaluation of the management system's suitability, adequacy, and effectiveness, resulting in decisions on improvement and resources.

A failure to meet a specified requirement, which must be recorded, corrected, and analyzed for cause so that recurrence is prevented.

Action taken to eliminate the cause of a detected nonconformity or incident so that it does not recur, distinct from immediate containment or correction.

The documented boundaries of what the management system covers, including organizational units, locations, services, and interfaces with third parties.

A document listing which controls are applied, why each is included or excluded, and how implementation status is tracked against the assessed risk.