ISO 27002 Lead Manager key terms

The three core information security properties: information is accessible only to those authorised to have access, it is accurate and complete, and it is accessible when required by authorised users.

Preservation of confidentiality, integrity and availability of information, and may additionally involve other properties such as authenticity, accountability, non-repudiation and reliability.

Safeguarding of people, society, organisations and states against digital risk, covering the convergence of information security with the protection of networks, systems and the physical world they control.

Freedom from intrusion into the private life or affairs of an individual, and the ability of that individual to control information about themselves and how it is collected and used.

Any information that relates to an identified or identifiable natural person, or that can be linked to one, including identifiers, contact details, location data and online identifiers.

High-level rules that guide how personal data should be handled, such as lawful and fair collection, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

Anything that has value to an organisation, including information, physical items, services, people, software and intangible items such as reputation and brand image.

A potential cause of an unwanted incident that may result in harm to a system or organisation, such as a malicious actor, a natural event or an accidental error.

A weakness of an asset or control that can be exploited by one or more threats, for example an unpatched application, a weak password policy or an unlocked server room.

The effect of uncertainty on objectives, expressed in information security terms as the potential for loss or harm resulting from a threat exploiting a vulnerability.

A documented management system comprising policies, objectives, processes and resources that an organisation uses to protect its information assets and to manage information security risk systematically.

The documented boundaries of the management system, identifying the organisational units, locations, technologies, processes and interfaces that are included in and excluded from the ISMS.

A person or organisation that can affect, be affected by, or perceive itself to be affected by a decision or activity, such as customers, regulators, employees, suppliers or shareholders.

A documented statement describing which information security controls are relevant to the organisation, whether each is implemented, and the justification for inclusion or exclusion.

A measure that modifies risk, implemented as a policy, procedure, process, practice, organisational structure or technical mechanism, and often described by what it is intended to achieve.

A statement describing what an information security control, or group of controls, is intended to achieve, used to guide selection and to structure the control set in ISO/IEC 27002.

The overall process of risk identification, risk analysis and risk evaluation, used to understand how threats and vulnerabilities could affect assets and objectives.

The process of selecting and implementing measures to modify risk, choosing among options such as avoiding, reducing, sharing or retaining the risk and weighing costs and benefits.

The risk that remains after controls have been applied, which should be compared with the organisation's risk acceptance criteria and formally accepted by an accountable party.

The person or entity with the accountability and authority to manage a risk, including approving treatment options and accepting residual risk within defined tolerances.

A documented plan that records selected risk treatment options, the controls to be implemented, responsible parties, resources, deadlines and expected performance measures.

The ISO/IEC 27002 control theme covering governance, policies, roles, responsibilities, supplier relationships, incident management, business continuity and compliance obligations.

The ISO/IEC 27002 control theme covering the human side of security, including screening, terms of employment, awareness and training, disciplinary process and remote working.

A documented set of high-level rules and direction, approved by management, that defines how the organisation protects information and provides a framework for setting control objectives.

The practice of dividing tasks and privileges so that no single person can both commit and conceal an error or fraud, requiring collusion to bypass a control.

The defined allocation of information security duties across the organisation, ensuring that accountability for assets, risks and controls is assigned and communicated.

The accountable person, often a manager, who is responsible for a defined set of information and for decisions about its classification, use, access and protection requirements.

The process of assigning information to defined categories, such as public, internal, confidential or restricted, according to its sensitivity, value and legal or contractual requirements.

The practice of marking information and its carriers, in paper or electronic form, with their classification so that handling rules are visible to anyone who encounters them.

The managed relationship with a third party providing products or services, including agreed security requirements, monitoring, incident notification, change management and exit arrangements.

The network of organisations, processes and technologies involved in producing and delivering products or services, whose information security practices can affect the organisation's own risk.

A structured programme that gives personnel the knowledge and skills to recognise threats, follow policy and use information securely, refreshed periodically and tailored to roles.

Pre-employment and ongoing verification of a candidate's or employee's background, qualifications and trustworthiness, proportionate to the sensitivity of the role and applicable law.

The ISO/IEC 27002 control theme covering physical security perimeters, entry controls, protection against environmental threats, secure disposal and clear desk and clear screen rules.

The ISO/IEC 27002 control theme covering technical measures such as access control, cryptography, logging, malware protection, vulnerability management, backup and network security.

Controls that grant or deny access to information and systems based on defined rules, ensuring that only authorised entities can reach specific assets for approved purposes.

The principle that users and systems receive only the minimum access rights needed to perform their assigned tasks, and only for the period during which those tasks require it.

Access rights that allow a user to administer systems, change configurations or bypass controls, which require stricter allocation, review and monitoring than ordinary user access.

The process of verifying a claimed identity, ideally using multiple factors such as something known, something held and something inherent to the person.

The use of mathematical techniques to protect information, providing confidentiality through encryption and integrity or authenticity through hashing and digital signatures, governed by a key management policy.

The recording of events, such as user activity, exceptions and system changes, in protected logs that support detection, investigation, audit and legal evidence requirements.

A rule requiring that papers, removable media and devices are secured when unattended and that screens are locked, reducing exposure of information to unauthorised viewing or loss.

The controlled destruction or sanitisation of media and equipment at end of life so that information cannot be recovered by unauthorised parties.

An identified occurrence indicating a possible breach of security policy or a failure of controls, which must be logged, assessed and, where relevant, escalated as an incident.

A single or series of unwanted or unexpected events that could lead to harm, requiring a defined response, containment, recovery and learning process.

Continuous or periodic observation of systems, networks and controls to detect anomalies, verify that safeguards operate as intended and provide evidence for review.

The definition and use of metrics and indicators to determine whether information security controls and the management system achieve planned results and to support improvement decisions.

An independent, systematic examination of the ISMS and its controls against defined criteria, planned by risk and reported to management to drive corrective action.

A periodic, top-management evaluation of the ISMS's suitability, adequacy and effectiveness, using defined inputs and producing decisions on improvement and resource needs.

A failure to meet a requirement, whether from the standard, the organisation's own policy or a legal obligation, which must be corrected and analysed for its cause.

Action taken to eliminate the cause of a detected nonconformity or incident so that it does not recur, distinct from a correction that only fixes the immediate problem.

The recurring activity of enhancing the ISMS and its controls, using measurement, audit, incident learning and review results to increase the organisation's overall security performance.