PECB ISO 28000 LI key terms

A structured set of policies, objectives, processes and resources an organization uses to identify security risks and control them to acceptable levels, built on the plan-do-check-act cycle.

The effect of uncertainty on security objectives, usually expressed as a combination of the likelihood of a harmful event and the severity of its consequences for people, assets, operations or reputation.

The amount and type of security risk an organization is willing to accept in pursuit of its objectives, set by top management and used to judge whether treatment is needed.

The reference values used to decide whether a security risk matters and how it will be scored, covering scales for likelihood and consequence, thresholds for action and rules for combining them.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity related to security, such as customers, regulators, staff or neighbours.

The internal and external issues, interested parties and legal obligations that shape how an organization must design and operate its security management system.

The documented boundaries and applicability of the security management system, naming the sites, activities, assets and functions it covers and stating any exclusions with justification.

A top-level statement of intent and direction on security, signed by top management, that commits the organization to meeting requirements, controlling risk and improving performance.

Measurable targets the organization sets to reduce or control security risk, consistent with the security policy and assigned to functions, with deadlines and resources.

Visible leadership in which senior managers set security direction, provide resources, integrate security into business processes and are accountable for the effectiveness of the system.

The documented allocation of security duties and authorities across the organization, ensuring every process has an owner and staff know what they must do and decide.

The overall process of identifying security risks, analysing their likelihood and consequences, and evaluating them against risk criteria to decide which need treatment.

The step of finding, recognizing and describing security risks, including threats, vulnerabilities, assets at risk and the events that could harm them.

The step of understanding the nature of an identified security risk and determining its level by combining the likelihood of the event with the severity of its consequences.

The step of comparing analysed risk levels with risk criteria to decide whether the risk is acceptable or requires treatment, and to rank risks for action.

The process of selecting and applying measures to modify security risk, such as avoiding, reducing, transferring or accepting it, and recording the decision and residual risk.

The security risk that remains after treatment measures have been applied, which must be compared with risk criteria and accepted by an authorized person.

A living record of identified security risks, their owners, assessment results, chosen treatments, residual levels and review dates, used to track and report risk.

A potential cause of a security incident, such as an intruder, insider, cyber attacker, natural hazard or protest, whose intent or capability can exploit a vulnerability.

A weakness in physical protection, procedures, technology, people or organization that a threat could exploit to cause harm to assets or operations.

A measure that modifies security risk, whether physical, technical, procedural or organizational, selected during treatment and monitored for effectiveness.

Laws, regulations, contracts and voluntary commitments that apply to the organization's security activities and must be identified, accessed and complied with.

The arrangements that ensure people whose work affects security are trained and qualified for their tasks, and that all staff understand the policy, their role and the consequences of non-compliance.

The shared values, attitudes and behaviours of staff and contractors towards security, reflected in how readily they report concerns and follow procedures.

Information the organization must control, including the security policy, risk records and evidence of results, covering both documents and the media that hold them.

The planned arrangements used to run activities that affect security, such as access control, screening, patrols and contractor management, so they are performed consistently.

The management of external providers whose goods or services affect security, including selection, contractual security requirements and monitoring of their performance.

An event or situation that has caused or could cause harm to people, assets, information or operations, which must be reported, investigated and used to drive improvement.

Plans, resources and exercises that prepare the organization to respond to and recover from security incidents and disruptive events, reviewed and tested periodically.

The capability of the organization to keep delivering key services at acceptable levels during and after a disruption, supported by plans, backups and recovery arrangements.

The ongoing collection and analysis of data on whether security controls and the management system achieve planned results, using indicators, audits and inspections.

A measurable value chosen to show how well a security objective is being met, such as incident rates, response times or completion of training.

An independent, planned examination of the security management system against the standard and the organization's own requirements, producing findings for management action.

A periodic top-management examination of the security management system's suitability, adequacy and effectiveness, using defined inputs and producing decisions on improvement and resources.

A failure to meet a requirement of the standard or of the organization's own security management system arrangements, which must be recorded and addressed.

Action taken to remove the cause of a detected nonconformity or incident so it does not recur, including analysis of root cause and verification that the action worked.

A structured method for finding the underlying reason a security failure occurred, rather than only describing the symptom, so that corrective action addresses the real weakness.

The recurring activity of enhancing security performance and the management system over time, driven by monitoring results, audits, incidents and management review decisions.

An independent assessment by a certification body that checks whether the organization's security management system conforms to ISO 28000 and is effectively implemented.

The first certification audit phase, which reviews documentation and readiness to confirm the organization is prepared for the full assessment and to agree on stage 2 focus.

The second certification audit phase, which gathers evidence on site that the security management system is implemented and effective across the defined scope.

An independent organization accredited to audit and issue certificates confirming that a management system meets a standard, and to supervise continued compliance.

Formal recognition by a national authority that a certification body is competent to carry out certification audits in specific fields, giving credibility to the certificates it issues.

A periodic audit after certification, usually annual, that checks the organization still conforms and improves, and supports maintenance of the certificate.

A fuller audit carried out before a certificate expires, usually every three years, to decide whether certification should be renewed for another cycle.

Verifiable data, records, observations or statements of fact that an auditor can check to judge whether a requirement is met, rather than opinion or assertion.

The result of evaluating collected audit evidence against audit criteria, classified as conformity, nonconformity, observation or opportunity for improvement.