PECB ISO 28000 Lead Auditor flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security management system

A set of interrelated elements an organization uses to establish security policy, objectives, and processes to achieve those objectives, following the high-level structure of ISO 28000 clauses 4-10.

PDCA cycle

Plan-Do-Check-Act: the continual improvement loop that maps to ISO 28000 clauses 4-6 (Plan), 7-8 (Do), 9 (Check), and 10 (Act), used to classify findings.

Security risk

The combination of the likelihood of a security event and its consequences for people, assets, information, or supply continuity, assessed and treated by the organization.

High-level structure

The common clause framework (4-10) shared by ISO management-system standards, allowing integrated audits and one-to-one mapping of requirements across standards.

Top management commitment

The clause 5 requirement that top management establish policy, assign roles, provide resources, and integrate security into business processes, evidenced by actions not statements.

SMS scope

The documented boundary of the security management system, including functions, sites, and activities covered, which must be available as documented information under clause 4.

Security policy

Top management's documented statement of security intent, including commitment to satisfy applicable requirements and to continual improvement, communicated within the organization.

Risk assessment

The clause 6 process of identifying threats and vulnerabilities, evaluating consequences, and determining controls and objectives consistent with the security policy.

Documented information

Information required to be controlled and maintained by the organization, including creation, update, distribution, and retention, as specified in clauses 7 and 8.

Operational control

The clause 8 requirement to plan and control processes needed to meet security requirements, including outsourced processes and incident and emergency response.

Management review

A clause 9 activity where top management reviews the SMS at planned intervals for continuing suitability, adequacy, and effectiveness, with documented outputs.

Corrective action

Action to eliminate the root cause of a nonconformity so it does not recur, with retained evidence of the nature of the nonconformity and results of action.

Audit definition

A systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine conformity.

Audit principles

Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach, which guide auditor conduct and judgement.

Audit criteria

The set of policies, procedures, or requirements used as a reference against which objective evidence is compared to determine conformity.

Objective evidence

Records, statements of fact, or other information verified to be true and traceable to its source, used to support audit findings and conclusions.

Nonconformity

The failure to meet a specified requirement, graded as major or minor depending on whether the failure is systemic or isolated.

Audit programme

A set of one or more audits planned for a specific time frame and directed toward a specific purpose, managed under ISO 19011 clause 5.

Audit plan

A description of the activities and arrangements for a single audit, including objectives, scope, criteria, dates, sites, and team roles.

Opening meeting

The meeting at the start of an audit that confirms scope, criteria, methods, communication channels, and that findings are preliminary until the closing meeting.

Risk-based planning

Allocating audit time and depth according to the risk profile of processes, so high-risk areas such as access control and incident response receive more attention.

Checklist use

Checklists are aids derived from audit criteria and the process approach; they support but do not replace auditor judgement or sampling.

Evidence collection

Gathering information through interviews, observation, and document review, recording source, date, and location so findings are traceable and verifiable.

Process tracing

Following a shipment, visitor, or incident end-to-end to verify controls at each handoff and confirm that procedures are actually implemented.

Major nonconformity

A systemic failure or absence of a required SMS element that affects the capability of the management system to achieve its intended results.

Minor nonconformity

An isolated lapse or single observed departure from a requirement that does not indicate a systemic failure of the management system.

Observation

A finding that is not a nonconformity but indicates a potential improvement or risk that the organization may wish to address.

Closing meeting

The meeting at the end of an audit where findings and their grading are presented, questions are answered, and the auditee is informed of follow-up requirements.

Audit report

The documented output of an audit covering objectives, scope, criteria, team, findings with evidence, and conclusions on conformity and effectiveness.

Corrective action request

A record requiring the auditee to address a nonconformity through correction, root-cause analysis, and corrective action, verified for closure by the auditor.

Auditor competence

The education, training, experience, and personal attributes required to perform audits, maintained through records and used to assign auditors to audits.

Programme review

The planned evaluation of the audit programme's performance, using indicators such as on-time completion and repeat findings, to adjust frequency and resources.