ISO 27001 Transition key terms

The documented boundary of the information security management system, naming the organizational units, locations, processes, technologies, and interfaces that the system covers and those it excludes.

The combination of internal and external factors, including legal, regulatory, contractual, competitive, and cultural conditions, that shape how an organization manages information security.

Relevant matters arising outside or inside the organization that can affect the intended outcomes of the information security management system, identified through analysis of the organization's context.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity related to information security, such as customers, regulators, or employees.

Laws, regulations, and contractual obligations the organization must satisfy regarding information security, which are identified as part of understanding the organization's context.

The person or group at the highest level of the organization that directs and controls it, and which is accountable for the effectiveness of the information security management system.

Visible, active involvement of top management in establishing, resourcing, and continually improving the information security management system, rather than merely approving documents.

A documented statement of the organization's overall intentions and direction for information security, providing a framework for setting information security objectives.

The assigned duties and authorities for information security across the organization, which top management must define, communicate, and ensure are understood.

A planned, periodic evaluation by top management of the information security management system's suitability, adequacy, and effectiveness, with defined inputs, outputs, and resulting decisions.

The overall process of identifying, analyzing, and evaluating information security risks, producing results that inform which risks require treatment.

The process of selecting and applying measures to modify information security risk, such as mitigating, transferring, avoiding, or accepting it, and documenting the chosen options.

The organization's defined terms of reference for evaluating the significance of information security risk, including risk appetite, thresholds, and acceptance rules.

The person or entity with the accountability and authority to manage a particular information security risk, including deciding whether and how it is treated.

The information security risk that remains after risk treatment measures have been applied and their effect assessed.

A documented statement describing which Annex A controls are applicable to the organization, why each is included or excluded, and whether it is currently implemented.

One of the information security controls listed in the normative annex of the standard, organized by theme and selectable through the risk treatment process.

Measurable, monitored targets set for relevant functions and levels that support the information security policy and the organization's overall direction.

The requirement to carry out changes to the information security management system in a planned manner, considering their purpose, consequences, and resource implications.

The demonstrated ability of personnel to apply knowledge and skills needed for work affecting information security performance, ensured through education, training, or experience.

The state in which personnel understand the information security policy, their contribution to the management system's effectiveness, and the implications of not conforming.

The planned process of determining what, when, with whom, and how information security matters are communicated internally and externally.

Information that must be controlled and maintained, including the information security management system documentation and records, with requirements for creation, updating, and control.

The set of practices ensuring documented information is available where needed, protected from loss or misuse, and subject to appropriate distribution, access, and retention rules.

The processes used to plan, implement, and control the activities needed to meet information security requirements, including criteria for processes and management of outsourced functions.

The arrangement in which an external party performs part of an organization's functions or processes, requiring controls to ensure information security requirements are still met.

The managed connection with an external provider of products or services, including agreed information security expectations and monitoring of performance.

The monitoring, measurement, analysis, and evaluation of information security performance and the effectiveness of the management system against planned requirements.

A planned, independent, and documented examination of the information security management system to determine whether it conforms to the organization's own requirements and the standard.

The handling of a failure to meet a requirement, including reacting to it, determining its cause, and acting to prevent recurrence.

The ongoing process of enhancing the suitability, adequacy, and effectiveness of the information security management system to improve overall information security performance.

A statement of what a control or group of controls is intended to achieve, providing a rationale for selecting and evaluating information security measures.

A specific requirement the organization has committed to meet, arising from law, regulation, contract, or its own policies, which must be identified and evaluated.