PECB ISO 28000 LI flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security Management System (SeMS)

A set of interrelated or interacting elements of an organization used to establish security policy and security objectives and to achieve those objectives, including processes, roles and documented information.

Security risk

The effect of uncertainty on security objectives arising from threats and vulnerabilities, usually assessed as a combination of likelihood of an event and its consequences, including harm and disruption.

Annex SL high-level structure

The common clause framework (context, leadership, planning, support, operation, performance evaluation, improvement) used by ISO management system standards, allowing integrated management systems and consistent audit logic.

Documented information

Information required to be controlled and maintained, plus the medium on which it is contained; it replaces the older distinction between documents and records and includes both procedures and evidence.

Plan-Do-Check-Act

A recurring cycle in which planning sets objectives and processes, implementation executes them, checking monitors results against objectives, and action improves performance; it underpins ISO 28000 clauses 4 to 10.

Interested party

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity, such as customers, regulators, carriers, employees, insurers and communities.

SeMS scope definition

A documented statement of the products, services, supply-chain stages, organizational and physical boundaries covered by the SeMS, with justified exclusions that do not affect security performance.

Gap analysis

A structured comparison of current practices against each ISO 28000 requirement, rating maturity and identifying missing processes, documentation and controls to feed the implementation roadmap.

Context of the organization

The combination of external and internal issues relevant to the organization's purpose, including regulation, threat landscape, market conditions, culture, facilities and information systems.

Top management commitment

Demonstrated leadership through policy approval, provision of resources, assignment of security roles and participation in management review, which is the precondition for a credible SeMS implementation.

Implementation roadmap

A sequenced plan of activities, responsibilities, milestones and resources that moves the organization from gap-analysis findings to an operating, auditable SeMS within a defined timeframe.

Compliance obligations

Legal, regulatory, contractual and voluntary requirements applicable to the organization's security arrangements, which must be identified, accessed, understood and considered in planning.

Security risk assessment

A process that identifies threats and vulnerabilities, analyses likelihood and consequences, and evaluates risk levels against documented criteria to determine which risks need treatment.

Risk treatment options

Choices for addressing assessed risk: avoiding the activity, removing the risk source, changing likelihood or consequence, sharing the risk, or accepting it by informed decision.

Security objectives

Measurable, monitored and communicated targets consistent with the security policy, assigned to functions, levels and timeframes with plans stating what will be done, resources and evaluation.

Risk criteria

Documented scales for likelihood and consequence, thresholds in a risk matrix, and rules on who may accept residual risk, enabling consistent and auditable risk decisions.

Residual risk acceptance

A formal decision, taken by an authorized person against documented criteria, that remaining risk after treatment is tolerable and does not require further control.

Security policy

A documented top-management statement of the organization's security intentions, including commitment to satisfy applicable requirements and to continual improvement of the SeMS.

Operational control

Established criteria and implemented controls for processes needed to meet security requirements, including control of outsourced processes that affect supply-chain security performance.

Competence

The ability to apply knowledge and skills to achieve intended results, verified through education, training or experience, with records retained as documented information.

Emergency preparedness and response

Planned responses to potential security incidents and emergencies, tested periodically, with review and revision after tests or actual events to maintain effectiveness.

Outsourced process control

Requirements ensuring that externally provided processes affecting security, such as guarding or transport, are controlled and monitored; accountability remains with the organization.

Tamper-evident sealing

A control using seals or packaging that reveal unauthorized access, supporting cargo integrity checks and providing evidence of interference between defined points in the supply chain.

Security performance indicator

A measurable parameter used to evaluate SeMS performance, either leading (training, drills, supplier assessments) or lagging (incidents, losses, nonconformity closure time).

Internal audit

A planned, impartial examination of SeMS processes against defined criteria, conducted by auditors who do not audit their own work, with results reported to relevant management.

Nonconformity

Non-fulfilment of a requirement; it is addressed by correction for the immediate problem and corrective action for the underlying cause, with verification of effectiveness.

Management review

A top-management evaluation of SeMS suitability, adequacy and effectiveness using defined inputs such as audit results, risk status and performance data, producing decisions on improvement and resources.

Corrective action

Action to eliminate the cause of a nonconformity and prevent recurrence, proportionate to the effects, with root-cause analysis and verification that the action was effective.

Continual improvement

Recurring activity to enhance security performance and the SeMS itself, driven by audit findings, incidents, management review outputs, threat intelligence and lessons learned.

Lessons learned

Knowledge captured from incidents, near misses, drills and external events, analysed and fed back into risk assessment, training and operational controls to prevent recurrence.

Stage 1 certification audit

An initial readiness assessment reviewing scope, policy, objectives, risk assessment, internal audit and management review evidence to confirm the organization is prepared for Stage 2.

Major nonconformity

A significant failure that affects the capability of the management system or raises doubt about the delivery of conforming output; certification is normally withheld until correction and verification.