ISO 27001 Transition flashcards
ISO 27001 Transition · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Context of the organization
- Clause 4 requirement to determine external and internal issues, interested party requirements, and the ISMS scope before planning risk treatment.
- Interested parties
- Persons or organizations that can affect, be affected by, or perceive themselves affected by a decision or activity; Clause 4.2 requires determining their relevant requirements.
- ISMS scope statement
- Documented information defining boundaries and applicability of the ISMS, including interfaces and dependencies with other organizations and parties.
- External and internal issues
- Issues relevant to the organization's purpose that affect the ISMS's ability to achieve intended outcomes; determined under Clause 4.1.
- ISMS and its processes
- Clause 4.4 requires establishing, implementing, maintaining and continually improving the ISMS together with the processes needed and their interactions.
- Scope exclusion justification
- Exclusions from ISMS scope are acceptable only when they do not undermine information security of in-scope activities, and must be documented in the Statement of Applicability.
- Top management commitment
- Clause 5.1 requires leadership to ensure the policy and objectives align with strategy and that ISMS requirements are integrated into business processes.
- Information security policy
- Documented statement appropriate to purpose that includes security objectives or a framework and commitments to satisfy applicable requirements and continual improvement.
- Policy communication
- The information security policy must be available as documented information, communicated within the organization, and available to relevant interested parties as appropriate.
- Roles and authorities
- Clause 5.3 requires assigning and communicating responsibilities and authorities for ISMS conformity and for reporting ISMS performance to top management.
- Integration requirement
- Clause 5.1 requires top management to ensure ISMS requirements are integrated into the organization's business processes, not run in parallel.
- Promotion of improvement
- Clause 5.1 requires top management to promote continual improvement and support other management roles contributing to ISMS effectiveness.
- Management representative removed
- The 2022 revision removed the 2013 requirement for a designated management representative; responsibility for reporting remains with assigned roles under 5.3.
- Risk assessment process
- Clause 6.1.2 requires a defined, repeatable process establishing risk criteria, identifying C-I-A risks and risk owners, then analyzing and evaluating them.
- Risk treatment process
- Clause 6.1.3 requires a process to select appropriate treatment options and determine all controls necessary to implement the treatment.
- Statement of Applicability
- Documented list of necessary controls with justification for inclusion or exclusion and status of implementation, required by Clause 6.1.3.
- Information security objectives
- Clause 6.2 requires objectives at relevant functions and levels, consistent with policy, measurable where practicable, monitored, communicated and updated.
- Planning of changes
- Clause 6.3 requires that changes to the ISMS be determined and carried out in a planned manner when the organization identifies a need.
- Risk criteria
- The organization's defined basis for evaluating the significance of information security risk, established within the risk assessment process under 6.1.2.
- Risk owner
- The person or entity with accountability and authority to manage a specific information security risk, identified during risk assessment.
- Resources for ISMS
- Clause 7.1 requires the organization to determine and provide people, infrastructure and environment needed to establish, implement and improve the ISMS.
- Competence
- Clause 7.2 requires determining necessary competence of persons affecting security performance and ensuring they are competent, retaining evidence as documented information.
- Awareness
- Clause 7.3 requires persons to know the security policy, their contribution to ISMS effectiveness, and implications of not conforming.
- Communication requirements
- Clause 7.4 requires determining what, when, with whom and how to communicate internally and externally regarding the ISMS.
- Documented information creation
- Clause 7.5.1 requires the ISMS to include documented information required by the standard and determined necessary for effectiveness.
- Control of documented information
- Clause 7.5.2 requires documented information to be available, suitable, protected, and controlled for distribution, access, retrieval, retention and disposition.
- Documented information of external origin
- Clause 7.5.3 requires the organization to identify and control documented information from external sources that is necessary for the ISMS.
- Operational planning and control
- Clause 8.1 requires planning, implementing and controlling the processes needed to meet ISMS requirements, including control of externally provided processes.
- Risk assessment execution
- Clause 8.2 requires performing risk assessments at planned intervals or after significant changes, retaining results as documented information.
- Risk treatment plan
- Clause 8.3 requires a plan describing implementation of selected controls and how treatment is integrated into the ISMS, retained as documented information.
- Residual risk acceptance
- Clause 8.3 requires risk owners to approve the risk treatment plan and accept the residual information security risks it leaves.
- Retained operational evidence
- Clause 8.1 requires documented information to the extent necessary to have confidence that the processes were carried out as planned.