ISO/IEC 27002 Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Property that information is not made available or disclosed to unauthorized individuals, entities or processes. It is one of the three core information security properties in ISO/IEC 27000.

Integrity

Property of accuracy and completeness. Information and processing methods remain complete and unaltered unless changed by authorized parties through an approved, recorded process.

Availability

Property of being accessible and usable on demand by an authorized entity. Loss of availability includes outages, denial-of-service attacks and destructive events affecting systems.

ISO/IEC 27002 scope

ISO/IEC 27002 provides guidance on a reference set of information security controls, including implementation guidance. It supports ISO/IEC 27001 but is not itself a certifiable management system standard.

Control themes in 27002:2022

The 2022 revision groups 93 controls into four themes: organizational with 37 controls, people with 8, physical with 14 and technological with 34. Earlier editions used 14 clauses.

Control attributes

Metadata attached to each ISO/IEC 27002:2022 control: control type, information security properties, cybersecurity concepts, operational capabilities and security domains. Attributes help organize, compare and map controls.

Control type attribute

Classifies a control as preventive, detective or corrective according to when and how it acts against an incident. A single control may carry more than one control type value.

Cybersecurity concept attribute

Maps controls to the NIST-derived functions identify, protect, detect, respond and recover. It links 27002 controls to an overall cybersecurity lifecycle view.

Information security risk

The effect of uncertainty on information security objectives, expressed as a combination of the likelihood of a threat event and its consequence. Controls are selected to treat assessed risk.

Statement of Applicability

Document listing the controls an organization has selected, with justification for inclusion or exclusion and implementation status. It is required by ISO/IEC 27001 and typically references 27002 guidance.

Privacy versus information security

Privacy concerns protection of personally identifiable information and lawful processing; information security protects all information assets. Privacy needs security but adds obligations such as consent and purpose limitation.

ISO/IEC 27701

Standard extending ISO/IEC 27001 and 27002 with requirements and guidance for a privacy information management system. It covers PII controller and PII processor roles and their specific controls.

Defence in depth

Layering multiple independent controls so failure of one does not expose the asset. Layers typically include organizational, people, physical and technological controls working together.

Non-repudiation

Ability to prove that an action or event occurred so that it cannot later be denied. Often supported by logging, digital signatures and evidence collection controls.

Information security policy (5.1)

Organizational control requiring a policy approved by management, published and communicated, and reviewed at planned intervals or when significant changes occur. It states objectives and principles.

Threat intelligence (5.7)

Control requiring collection and analysis of threat information and its sharing with relevant parties. It supports informed decisions on technical and organizational countermeasures.

Segregation of duties (5.3)

Control separating conflicting duties and areas of responsibility to reduce opportunities for unauthorized modification, misuse or concealment of errors. It complements least privilege and monitoring.

Access control (5.15)

Control limiting access to information and assets to what is needed, using rules based on need-to-know and least privilege. It covers both logical and physical access decisions.

Identity management (5.16)

Control requiring the lifecycle of identities to be managed: registration, provisioning, review, deactivation and removal. It underpins authentication, authorization and accountability.

Authentication information (5.17)

Control governing allocation and management of secrets such as passwords, keys and tokens. It covers secure distribution, storage, change procedures and user responsibilities.

Supplier relationship security (5.19-5.22)

Controls covering information security in supplier relationships, agreements, supply chain management and monitoring of supplier services. They address risks from third parties and their subcontractors.

Cloud services control (5.23)

Control requiring processes for acquiring, using, managing and exiting cloud services, aligned with the organization's information security requirements and supplier agreements.

Incident management controls (5.24-5.28)

Sequence covering planning and preparation, assessment and decision, response, learning from incidents, and collection of evidence. Together they form a consistent incident management capability.

ICT readiness (5.30)

Control requiring ICT readiness to be planned, implemented, maintained and tested based on business continuity objectives and recovery requirements. It covers redundancy and recovery capability.

Screening (6.1)

People control requiring background verification of candidates before joining and periodically for existing personnel, proportionate to legal requirements and the sensitivity of the role.

Awareness and training (6.3)

People control requiring information security awareness, education and training for personnel and relevant interested parties. It should be planned, delivered and evaluated for effectiveness.

Physical security perimeter (7.1)

Control requiring security perimeters to protect areas containing information and assets. Perimeter strength depends on the assets inside, and all entry points should be controlled.

Secure disposal of equipment (7.14)

Physical control requiring verification that equipment containing storage media is securely disposed of or reused, with data removed or destroyed. It includes checking media before disposal or reuse.

Malware protection (8.7)

Technological control requiring protection against malware, supported by appropriate user awareness. Implementation should detect, prevent and recover from malware, with regular updates and monitoring.

Technical vulnerability management (8.8)

Control requiring timely identification of technical vulnerabilities, assessment of exposure and appropriate treatment. It includes inventory, scanning, patch management and evaluation of effectiveness.

Logging (8.15)

Technological control requiring event logs to be produced, stored, protected and analysed. It supports detection, investigation and evidence, and logs should be protected against tampering.

Cryptographic controls (8.24)

Control requiring a policy on the use of cryptography, including key management across the key lifecycle. It covers selection of algorithms, protection of keys and handling of cryptographic failures.