PECB ISO 28000 Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security Management System (SeMS)

A set of interrelated organizational elements, including policy, objectives, processes, and resources, used to identify and control security risks and to achieve defined security outcomes.

Scope of the SeMS

The documented boundary stating which activities, products, services, sites, and supply-chain interfaces the security management system covers, including justified exclusions.

Interested party (security)

A person or organization that can affect, be affected by, or perceive itself affected by a security decision, such as customers, regulators, insurers, employees, or partners.

Security risk

The combination of the likelihood of a security event occurring and the severity of its consequences for people, assets, operations, information, or reputation.

Risk-based thinking

The principle that security controls and resources are prioritized according to assessed risk rather than applied uniformly, so effort concentrates where exposure is highest.

Process approach

Managing security as a system of interrelated processes with defined inputs, outputs, owners, and performance measures, rather than as isolated controls or inspections.

Continual improvement

A recurring activity to enhance security performance, in which results of monitoring, audits, and reviews feed changes back into the security management system.

High-level structure (HLS)

The common clause structure and core text shared by ISO management system standards, enabling integrated implementation of quality, environmental, and security systems.

Plan-Do-Check-Act

A cyclical improvement model: establish objectives and processes, implement them, monitor results against requirements, and take action to improve performance.

Security policy

A top-management statement of the organization's security intentions and direction, including commitments to satisfy requirements and to continual improvement.

Supply-chain security

The protection of goods, information, people, and infrastructure across the end-to-end flow from suppliers through transport and storage to the final customer.

Documented information

Information required to be controlled and maintained by the organization, together with the medium on which it is held, such as procedures, records, and logs.

Asset-based security

An approach that identifies valuable or critical assets first and then designs protective controls around their value, vulnerability, and exposure to identified threats.

Threat

A potential cause of a security incident, such as theft, trespass, fraud, terrorism, or cyber intrusion, that could exploit a vulnerability and harm an asset.

Vulnerability

A weakness in physical protection, process, or information handling that a threat could exploit to cause a security incident with adverse consequences.

Clause 4 context

The requirement to determine external and internal issues, identify interested parties and their security requirements, define scope, and establish the SeMS processes.

Clause 5 leadership

The requirement that top management demonstrate leadership by establishing security policy, ensuring resources, assigning roles, and integrating security into business processes.

Clause 6 planning

The requirement to address risks and opportunities, determine controls, and set measurable security objectives with plans describing actions, resources, responsibilities, timing, and evaluation.

Security objectives

Measurable targets set for relevant functions and levels, consistent with the security policy, and supported by plans describing what will be done and by whom.

Clause 7 support

The requirement to provide resources, ensure competence and awareness, manage internal and external communication, and control the creation, use, and retention of documented information.

Competence

The ability to apply knowledge and skills to achieve intended results, verified through education, training, or experience and recorded as evidence.

Awareness

The state in which personnel understand the security policy, their contribution to its effectiveness, and the implications of not conforming to requirements.

Clause 8 operation

The requirement to plan, implement, and control security processes, manage outsourced activities, and prepare for and respond to incidents and emergency situations.

Outsourced process control

The requirement that externally provided security activities remain under the organization's control, with defined criteria, monitoring, and accountability for results.

Incident response

The planned process for detecting, reporting, containing, and recovering from security incidents, including defined roles, escalation paths, and communication with affected parties.

Clause 9 monitoring

The requirement to determine what to monitor and measure, define methods and criteria, and analyse and evaluate security performance at planned intervals.

Internal audit

A planned, independent, and documented examination of the SeMS against the organization's own requirements and the standard, used to identify nonconformities.

Management review

A top-management evaluation of the SeMS at planned intervals, using defined inputs and producing decisions on improvement, resources, and changes.

Nonconformity

A failure to meet a requirement of the standard or of the organization's own security management system, which must be controlled and corrected.

Corrective action

An action taken to eliminate the cause of a nonconformity so that it does not recur, including verification of effectiveness and update of risks.

Clause 10 improvement

The requirement to correct nonconformities, take corrective action, and continually improve the suitability, adequacy, and effectiveness of the security management system.

Certification audit

An independent third-party audit that evaluates the SeMS against ISO 28000 requirements and, if successful, results in formal certification.