ISO/IEC 27002 Foundation key terms

The preservation of confidentiality, integrity and availability of information, achieved through a set of coordinated policies, processes and controls that protect information from a wide range of threats.

The property that information is not made available or disclosed to unauthorized individuals, entities or processes, enforced through classification, access control, encryption and need-to-know rules.

The property of accuracy and completeness of information and of the processing methods used, protected by change control, logging, hashing and segregation of duties so that unauthorized modification is prevented or detected.

The property of being accessible and usable on demand by an authorized entity, supported by capacity management, redundancy, backup and resilience measures that reduce the impact of disruption.

The preservation of confidentiality, integrity and availability of information and services in cyberspace, focusing on protecting networks, systems and data from digital attacks rather than on physical assets alone.

The protection of an individual's right to control how their personal data is collected, used, stored, shared and deleted, closely linked to legal obligations such as data protection law.

Any information relating to an identified or identifiable natural person, including identifiers such as name, location data or an online identifier, which requires protection under privacy legislation.

The natural person to whom personal data relates, who holds rights such as access, correction, erasure and objection that an organization must be able to fulfil.

The effect of uncertainty on objectives, usually expressed as the combination of the likelihood of an event and its consequences, and used to prioritize which controls an organization should implement.

The overall process of identifying, analysing and evaluating risk, producing a ranked picture of exposures that informs which controls are needed and how urgent they are.

The process of selecting and implementing options to address assessed risk, such as mitigating it with controls, avoiding the activity, transferring it, or consciously retaining the remaining risk.

The risk that remains after controls have been applied and decisions taken, which must still be understood, monitored and accepted by the appropriate owner.

A documented set of high-level rules and direction issued by top management that defines how the organization protects information and sets expectations for subordinate policies and standards.

Measures that modify risk by maintaining or changing the probability or impact of an event, implemented as technical, organizational or physical safeguards and described in ISO/IEC 27002 as practices and guidance.

A statement of what a control area is intended to achieve, providing the rationale from which specific controls and their implementation guidance are derived.

A document listing the controls selected from the ISO/IEC 27001 Annex A, the reasons for their inclusion or exclusion, and their implementation status, used to demonstrate a risk-driven choice of controls.

The defined allocation of information security duties across the organization, ensuring that every control has an accountable owner and that conflicts of duty are identified and separated.

The practice of dividing tasks and privileges so that no single person can initiate, approve and record a critical transaction alone, reducing the risk of error and fraud.

Rules and mechanisms that determine who or what may use which information and system resources, and under what conditions, typically based on business need and least privilege.

The principle that a user, process or system is granted only the minimum access rights necessary to perform its authorized tasks, limiting the harm from misuse or compromise.

Elevated permissions that allow administrative control over systems, networks or data, requiring stricter allocation, monitoring and review because misuse causes disproportionate damage.

The process of verifying that a claimed identity is genuine, typically through knowledge, possession or biometric factors, and a prerequisite for granting access.

The lifecycle process of creating, maintaining and removing identities and their credentials, ensuring that access is granted, changed and revoked in step with a person's role.

The use of mathematical techniques to protect information, providing confidentiality through encryption and integrity or authenticity through hashes, message authentication codes and digital signatures.

The disciplined lifecycle handling of cryptographic keys, covering generation, distribution, storage, rotation, recovery, retirement and destruction so that encryption remains effective.

Software written to cause harm or unauthorized behaviour, such as viruses, worms, ransomware and spyware, detected and blocked by protective technical measures and user awareness.

A weakness in an asset, system or control that could be exploited by a threat, identified through scanning, testing, vendor notifications and configuration review so it can be remediated.

The ongoing process of identifying, evaluating, prioritizing and remediating technical weaknesses in systems and software, including patch management and tracking of exposure over time.

An identified occurrence indicating a possible breach of security policy or a failure of controls, which is recorded and assessed to decide whether it is an incident.

A single or series of unwanted or unexpected events that has a significant probability of compromising business operations and threatening information security, requiring a managed response.

The structured process of detecting, reporting, assessing, responding to and learning from security incidents, with defined responsibilities, escalation paths and communication plans.

The systematic recording of events and activities in systems and networks, producing evidence that supports detection, investigation and reconstruction of what happened and when.

The continuous or periodic surveillance of systems, networks and logs to detect anomalies, policy violations and signs of compromise, enabling a timely response.

The capability of an organization to continue delivering products or services at acceptable predefined levels during and after a disruptive event, supported by planning and tested arrangements.

Copies of information and software kept so they can be restored after loss, corruption or attack, with requirements for frequency, storage separation, protection and restoration testing.

The managed connection between an organization and an external provider of products or services, governed by agreed security requirements, monitoring and defined responsibilities.

The process of identifying information assets and associated resources, assigning owners, and maintaining records so that appropriate protection can be applied and reviewed.

The assignment of information to defined categories according to sensitivity, value and legal requirements, so that consistent handling, labelling and protection rules can be applied.

Planned activities that give personnel the security and privacy knowledge and skills their role requires, reducing human error and building a culture that supports controls.