PECB ISO 28000 Foundation key terms

A structured set of policies, objectives, processes, and resources an organization uses to manage security risks and protect its assets, people, and operations in a consistent, documented, and continually improving way.

An international standard that specifies requirements for a security management system, applicable to organizations of any size that need to assure security throughout supply chains and related operations.

The combination of the likelihood that a threat exploits a vulnerability and the resulting consequences for the organization, its people, assets, or supply chain.

A potential source of harm such as theft, fraud, terrorism, cyber intrusion, or natural events that could damage assets or disrupt operations if not adequately addressed.

A weakness in controls, processes, infrastructure, or behavior that a threat could exploit to cause harm, loss, or disruption to the organization or its supply chain.

Anything of value to the organization, including people, information, equipment, facilities, and reputation, that requires protection through the security management system.

A measure such as a procedure, physical barrier, technology, or organizational arrangement implemented to reduce security risk to an acceptable level.

The coordinated management of security risks across the flow of goods, information, and people between suppliers, the organization, and customers to prevent disruption and loss.

The network of organizations, activities, and resources involved in delivering products or services, from sourcing of materials through to final delivery to the customer.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity related to security management.

The combination of internal and external factors, including legal, social, and supply chain conditions, that influence how the organization manages security.

The documented boundaries of the security management system, stating which activities, products, services, and locations the organization includes or excludes and why.

A top-level statement of the organization's security intentions and direction, providing a framework for setting security objectives and committing to legal and other requirements.

The person or group at the highest level of the organization that directs and controls the security management system and provides leadership and resources.

A measurable, time-bound target the organization sets to achieve a specific security outcome, consistent with the security policy and significant security risks.

The process of identifying threats and vulnerabilities, analyzing their likelihood and consequences, and evaluating whether the resulting security risk is acceptable.

The process of selecting and applying measures to reduce security risk, including avoiding, mitigating, transferring, or accepting risk according to the organization's risk criteria.

The organization's documented reference for evaluating the significance of security risk, including thresholds, scales, and the level above which treatment is required.

Laws, regulations, contracts, and voluntary commitments relating to security that the organization must comply with and consider in its security management system.

A specific requirement the organization must meet, arising from legislation, regulation, contractual terms, or its own commitments, and tracked within the security management system.

The clause of the standard requiring the organization to address risks and opportunities, set objectives, and plan the changes needed to achieve them.

The clause covering resources, competence, awareness, communication, and documented information needed to operate and maintain the security management system.

The combination of education, training, and experience that enables a person to perform security-related tasks effectively and consistently.

The state in which personnel understand the security policy, their contribution to the effectiveness of the system, and the implications of not conforming.

Information the organization must control and maintain, including policies, procedures, records, and evidence of results, in whatever format or medium it is held.

Records, data, or observations that demonstrate the security management system is operating as intended and that requirements are being met.

The clause requiring the organization to plan, implement, and control the processes needed to meet security requirements and address its significant risks.

A process or function performed by an external provider that the organization must control or influence to ensure it meets the security requirements of the system.

The arrangements for identifying potential security incidents and emergencies, planning responses to them, and testing and reviewing those responses periodically.

An event or situation that has caused or could cause harm, loss, or disruption to the organization's assets, operations, or supply chain security.

The systematic collection of data and observation of security performance against defined criteria to determine whether the system is achieving intended results.

The clause requiring the organization to monitor, measure, analyze, and evaluate security performance and the effectiveness of its security management system.

A systematic, independent examination of the security management system to determine whether it conforms to the organization's own requirements and to the standard.

A periodic review by top management of the security management system's suitability, adequacy, and effectiveness, leading to decisions on improvement and resources.

A failure to meet a requirement of the standard or of the organization's own security management system requirements.

Action taken to eliminate the cause of a detected nonconformity or incident so that it does not recur, including determining root cause and verifying effectiveness.

The ongoing process of enhancing the suitability, adequacy, and effectiveness of the security management system to improve overall security performance.

An independent organization that audits and certifies that an organization's security management system conforms to the requirements of ISO 28000.