Fundamental Principles and Concepts of Information Security, Cybersecurity and Privacy
Domain 1 checks whether you can use ISO/IEC 27000-series vocabulary precisely and separate three concerns that overlap in practice: information security, cybersecurity and privacy. Questions here are definitional and comparative, so marks come from exact wording and from knowing which standard owns which term.
Core definitions
- Information security: preservation of confidentiality, integrity and availability of information (ISO/IEC 27000). CIA is the core triad, not a complete list: authenticity, accountability, non-repudiation and reliability are also named properties.
- Cybersecurity: safeguarding people, society, organizations and technology against cyber threats (ISO/IEC 27032). It overlaps with information security but emphasises threats of cyber origin rather than all information assets.
- Privacy: protection of personally identifiable information (PII) through principles such as purpose limitation, collection limitation, minimisation, accuracy, retention limits, openness and accountability (ISO/IEC 29100). ISO/IEC 27701 extends the ISMS into a privacy information management system.
Risk vocabulary
Risk is the effect of uncertainty on objectives; information security risk combines threat, vulnerability and consequence. Learn the distinct roles: risk owner (accountable for the risk), control owner (operates the control), risk criteria, risk appetite and residual risk.
Standards family
27001 states requirements and is certifiable; 27002 gives implementation guidance for 93 controls; 27003 covers implementation; 27004 covers measurement; 27005 covers risk management.
Worked example
A firm installs CCTV at a data-centre entrance to deter tailgating. Reasoning: the control is physical and both preventive and detective (A.7.4 physical security monitoring); it reduces the risk of unauthorised entry addressed by A.7.2. But CCTV captures personal data, so a privacy assessment is needed, with notice, retention limits and access restriction. Security and privacy are handled together, not traded off.
Traps
Equating security with privacy; claiming 27002 is certifiable; treating CIA as the full set of properties; confusing risk owner with control owner; assuming a 27032 cyber definition means 27002 excludes cyber threats.