PECB ISO 28000 Transition key terms

The common clause numbering and core text that ISO management system standards share, which ISO 28000:2022 adopted so its clauses align with other standards such as ISO 9001 and ISO 14001.

The ISO guidance document that defines the high-level structure, identical core text, and common terms for management system standards; it is the basis for the clause layout used in ISO 28000:2022.

The documented statement of the boundaries and applicability of the organization's security management system, considering internal and external issues and interested party requirements; Clause 4 of the 2022 edition requires it to be available as documented information.

The combination of internal and external issues, including legal, regulatory, supply chain, and threat environment factors, that the organization must determine because they affect the intended outcomes of its security management system.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity related to security; the 2022 edition requires determining relevant interested parties and their requirements.

The Clause 5 requirement that top management demonstrate active involvement in the security management system, including providing resources, integrating requirements into business processes, and promoting improvement.

A documented statement of top management's intentions and direction for security, including commitments to satisfy applicable requirements and to continual improvement; it must be communicated and available to interested parties as appropriate.

The Clause 5 requirement that top management assign and communicate responsibilities and authorities for the security management system, including reporting on performance and opportunities for improvement.

The overall process of identifying, analyzing, and evaluating security risk, including determining likelihood and consequence and comparing results against risk criteria to decide whether action is needed.

The process of selecting and implementing measures to modify security risk, such as avoiding, reducing, transferring, or accepting it, and documenting the results and the effectiveness of the chosen options.

The thresholds, levels, and factors the organization uses to evaluate the significance of security risk and to decide which risks require treatment, established as part of planning the risk process.

The effect of uncertainty on security objectives, usually expressed as a combination of the likelihood of a security event and its consequences for people, assets, information, operations, or reputation.

A potential cause of a security incident, such as an adversary, natural hazard, or failure mode, that could exploit a vulnerability and produce harm to the organization or its supply chain.

A weakness in controls, processes, physical assets, or organizational arrangements that a threat could exploit; identifying vulnerabilities is a core input to security risk assessment.

Measurable goals the organization sets for security performance, consistent with the security policy, relevant to conformity and enhancement of the management system, and monitored and updated as needed.

The Clause 6 requirement to carry out changes to the security management system in a planned manner, considering their purpose, consequences, integrity, resources, and allocation of responsibilities and authorities.

The Clause 7 requirements covering provision of resources, competence of persons whose work affects security performance, awareness of policy and contribution, and communication of relevant security information.

Information required to be controlled and maintained by the organization and the medium on which it is contained; the 2022 edition uses this single term instead of the older documents and records distinction.

The Clause 8 requirements to plan, implement, and control processes needed to meet security requirements, including establishing criteria, controlling outsourced processes, and managing planned changes.

A process needed for the security management system that the organization chooses to have performed by an external provider; the organization must retain control over it and define controls.

The Clause 9 activities of monitoring, measurement, analysis, evaluation, internal audit, and management review used to determine the effectiveness and conformity of the security management system.

A systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine whether the security management system conforms to the organization's own requirements and to ISO 28000.

Top management's periodic evaluation of the security management system's suitability, adequacy, and effectiveness, using defined inputs and producing decisions and actions related to improvement and resource needs.

The Clause 10 process for reacting to nonconformities, evaluating their causes, implementing corrective action, reviewing effectiveness, and updating risks where necessary.

The recurring activity of enhancing security performance and the security management system, required by Clause 10 and supported by objectives, audit results, and management review decisions.

The set of interrelated or interacting elements of an organization, including policy, objectives, processes, and resources, used to achieve security outcomes and satisfy applicable requirements.

The management of security risk across the flow of goods, information, and people from suppliers through the organization to customers, including interfaces with external providers and partners.

The shared values, attitudes, and behaviors within an organization that shape how security is perceived and practiced, supported by awareness, leadership, and communication requirements in the 2022 edition.

The planned migration of an existing ISO 28000:2007 management system to the 2022 edition, including gap analysis, updating documentation, revising risk processes, and completing certification audits within the transition period.

A structured comparison of the organization's current management system against ISO 28000:2022 requirements, used to identify missing or outdated elements and to plan transition actions and priorities.

The documented schedule of activities, responsibilities, resources, and milestones for moving from the 2007 edition to the 2022 edition, including communication and training for affected personnel.

A certification audit conducted to verify that the organization's security management system conforms to ISO 28000:2022 and that the transition from the 2007 edition has been effectively implemented.

An approach that integrates consideration of uncertainty and potential consequences into planning and decision-making, reflected in the 2022 edition's emphasis on determining risks and opportunities.

Potential adverse effects and potential beneficial possibilities the organization must determine and address to give assurance that the security management system can achieve its intended outcomes and prevent undesired effects.

The needs and expectations of relevant interested parties, including legal, regulatory, contractual, and customer security requirements, that the organization must determine and consider in its management system.

An independent organization that audits and certifies the security management system against ISO 28000, applying accreditation rules for the transition from the 2007 edition to the 2022 edition.

The requirements for creating, updating, and controlling documented information, including distribution, access, retrieval, retention, and protection, so that it is available and suitable where needed.