ISO 27002 Lead Manager flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Confidentiality

Property that information is not made available or disclosed to unauthorised individuals, entities or processes. It is one of the three core properties preserved by information security, alongside integrity and availability.

Integrity

Property of accuracy and completeness of information and of systems. It covers protection against unauthorised modification and includes the correctness of processing, so it applies to data and to system behaviour.

Availability

Property of being accessible and usable on demand by an authorised entity. Availability depends on capacity, redundancy, resilience and recovery planning, and is measured through service continuity and uptime objectives.

Cybersecurity definition

Protection of networks, systems, applications and data against digital attack, including measures to detect, respond to and recover from incidents. It extends information security to the digital environment and emphasises resilience.

Privacy principle: purpose limitation

Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. This constrains reuse of PII and requires documented purposes.

Risk definition

Effect of uncertainty on objectives, usually expressed as a combination of the likelihood of an event and its consequence. Information security risk considers threats exploiting vulnerabilities with impact on confidentiality, integrity or availability.

Control attributes

In ISO/IEC 27002:2022, five attributes classify each control: control type, information security properties, cybersecurity concepts, operational capabilities, and security domains. They support filtering and comparison of the control set.

Defence in depth

Layering multiple preventive, detective and corrective controls so that failure of one control does not expose the asset. Compensating controls address residual risk where a primary control is not practicable.

Statement of Applicability

Document required by ISO/IEC 27001 clause 6.1.3 listing the necessary controls, justification for inclusion or exclusion, and implementation status. It must reference all 93 Annex A controls.

ISMS scope

Defined boundary and applicability of the information security management system, considering internal and external issues, interested parties, interfaces and dependencies. Exclusions must be justified and must not affect the obligation to provide security.

PDCA cycle

Plan-Do-Check-Act model underlying continual improvement: establish objectives and processes, implement them, monitor and measure against policy, then take action to improve. It maps to the clause structure of ISO/IEC 27001.

Risk treatment options

Four options: modify the risk by applying controls, retain the risk with acceptance, avoid the activity causing the risk, or share it through insurance or contracts. Selection must be documented and approved by risk owners.

Gap analysis purpose

Comparison of current controls against the ISO/IEC 27002:2022 control set to identify missing or partial controls. Outputs feed a prioritised remediation roadmap based on risk, cost and dependency.

Annex A structure

ISO/IEC 27001:2022 Annex A contains 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. It is derived from and aligned with ISO/IEC 27002:2022.

Segregation of duties

Organizational control 5.3 requiring separation of conflicting duties and areas of responsibility to reduce opportunities for unauthorised modification, misuse or fraud. Where separation is impractical, compensating monitoring is applied.

Information classification scheme

Control 5.12 requires a scheme defining classification levels, criteria and handling rules. Classification should be proportionate, assigned by the information owner, and supported by labelling and handling procedures.

Access control policy

Control 5.15 requires a policy establishing business and security requirements for access. It defines rules for granting, reviewing and revoking access based on need-to-know and least privilege.

Supplier due diligence

Control 5.19 requires assessing supplier security before contracting, proportionate to the information and service involved. It considers reputation, certification, incident history and the supplier's own supply chain.

Incident response phases

Controls 5.24 to 5.28 cover planning and preparation, reporting, assessment and decision, response, and learning from incidents. Evidence handling must preserve integrity and chain of custody.

Business impact analysis

Process identifying critical business activities and their dependencies, used to set recovery time and recovery point objectives. It underpins ICT readiness planning for business continuity controls 5.29 and 5.30.

Screening of personnel

Control 6.1 requires background verification of candidates proportionate to role sensitivity and applicable law. Verification may be repeated for sensitive roles and results must be handled confidentially.

Remote working control

Control 6.7 requires a policy and supporting measures for remote working, covering physical security at the remote location, device protection, network access, and prohibition of unauthorised access by third parties.

Physical perimeter security

Control 7.1 requires barriers and entry points protecting areas containing information and information processing facilities. Perimeter strength should match the value of the assets and the assessed threat environment.

Clear desk and clear screen

Control 7.7 requires rules for leaving desks clear of papers and removable media and for locking screens when unattended. Rules should apply to printers, copiers and storage media as well as workstations.

Secure disposal of equipment

Control 7.14 requires verified destruction or secure erasure of storage media before equipment is disposed of or reused, with records retained. The method must match the classification of the data held.

Privileged access rights

Control 8.2 requires restriction and management of administrative accounts, use of separate accounts for privileged tasks, and logging of privileged activity. Privileged access should be time-bound and reviewed frequently.

Cryptographic key management

Control 8.24 requires a policy for cryptographic controls and a key lifecycle covering generation, distribution, storage, rotation, revocation and destruction. Keys must be protected throughout their life.

Logging and monitoring

Controls 8.15 and 8.16 require recording activities, exceptions and faults with synchronised clocks, and defining monitoring activities to detect anomalous behaviour. Logs must be protected against tampering and retained per policy.

Secure development principles

Controls 8.25 to 8.31 cover secure coding, security requirements analysis, environment separation, protection of test data, and outsourced development. Test information should not contain production personal data.

Monitoring and measurement

ISO/IEC 27001 clause 9.1 requires determining what to monitor, the methods, timing, responsible parties, and when results are analysed. Results feed management review and corrective action.

Internal audit independence

ISO/IEC 27001 clause 9.2 requires auditors to be objective and impartial, so they should not audit their own work. The audit programme considers process importance and prior audit results.

Control effectiveness testing

Evidence-based verification that a control operates as designed, using walkthrough, observation, inspection, re-performance or sampling. Results support conclusions on whether the control meets its stated objective.