ISO/IEC 27002 Manager key terms

The preservation of confidentiality, integrity, and availability of information, extended in current editions to include authenticity, accountability, non-repudiation, and reliability as properties worth protecting.

The property that information is not made available or disclosed to unauthorized individuals, entities, or processes. It is protected through classification, access control, encryption, and need-to-know rules.

The property of accuracy and completeness of information and of the systems that process it. It guards against unauthorized modification, whether accidental or deliberate, throughout the information lifecycle.

The property of being accessible and usable on demand by an authorized entity. It is supported by capacity management, redundancy, backup, and resilience arrangements against disruption.

Safeguarding of people, society, organizations, and states against cyber risk. It covers the protection of information and systems in cyberspace, including the networks and infrastructure on which services depend.

Freedom from intrusion into the private life or affairs of an individual, and the ability of individuals to control or influence what information about them is collected, stored, and shared.

Any information relating to an identified or identifiable natural person. Identifiability can arise from the data alone or from data combined with other information reasonably likely to be used.

Information that can be used to distinguish or trace an individual's identity, alone or when linked with other data. The term overlaps heavily with personal data and is used in many jurisdictions.

The individual to whom personal data relates. Privacy frameworks grant this person rights such as access, correction, and, in some jurisdictions, erasure or objection to processing.

High-level rules guiding how personal data should be handled, such as lawful and fair collection, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability of the controller.

A structured process that identifies and assesses privacy risks of a project, product, or process affecting personal data, and determines whether controls or design changes are needed before processing begins.

The combination of the likelihood of a cyber threat event and its consequences for the organization, its stakeholders, and possibly wider society. It is expressed and prioritized within the risk management framework.

A potential cause of an unwanted incident that may result in harm to a system or organization. Threats include adversarial actors, human error, and natural or environmental events.

A weakness in an asset or control that can be exploited by one or more threats. Vulnerabilities may be technical, procedural, or organizational in nature.

The potential for loss or harm to the organization when a threat exploits a vulnerability of an information asset, considering the likelihood of occurrence and the business impact.

The overall process of risk identification, risk analysis, and risk evaluation. It establishes the organization's information security risk profile and informs which controls are needed.

The process of selecting and implementing measures to modify risk, typically by avoiding, reducing, sharing, or retaining it, and then documenting the decision in a statement of applicability.

The risk remaining after risk treatment has been applied. It must be reviewed and formally accepted by the risk owner at a level consistent with the organization's risk criteria.

The person or entity with the accountability and authority to manage a particular risk, including approving treatment and accepting residual risk. Ownership should be explicit and recorded.

A measure that modifies risk, including any process, policy, device, practice, or organizational structure. Controls may be preventive, detective, corrective, or directive in nature.

A document describing the information security controls relevant to the organization's risk treatment, including the reasons for their inclusion or exclusion and their implementation status.

The statement of what a control or group of controls is intended to achieve. Objectives describe the desired outcome, while individual controls describe how that outcome is realized.

A property used to describe a control and support its selection and comparison, such as control type, information security properties, cybersecurity concepts, operational capabilities, and security domains.

The practice of layering multiple independent controls so that the failure of one does not immediately expose the asset. Layers may span governance, people, physical, and technological measures.

Assigning information to categories according to sensitivity, value, legal requirements, and criticality, so that appropriate handling, labeling, and protection rules can be applied consistently.

Rules and mechanisms that ensure access to information and systems is granted only to authorized entities and only to the extent needed. It includes both logical and physical access.

The principle that users and processes receive only the minimum access rights necessary to perform their tasks, reducing the damage that can result from error, misuse, or compromise.

Separating conflicting tasks and responsibilities among different people or roles so that no single person can carry out and conceal an error or fraud.

Access rights that allow a user to configure, manage, or bypass controls on systems and data. Such rights are restricted, allocated on a need-to-use basis, and closely monitored.

The lifecycle processes by which identities are created, verified, maintained, and removed, ensuring that accounts map reliably to real people and services and are revoked when no longer needed.

Verifying a claimed identity, commonly through knowledge, possession, or biometric factors. Multi-factor authentication combines factors from different categories to strengthen assurance.

The use of mathematical techniques to protect information, providing confidentiality, integrity, authentication, and non-repudiation. Its governance includes policy, key management, and legal considerations.

The lifecycle protection of cryptographic keys, covering generation, distribution, storage, use, rotation, recovery, and destruction, so that keys remain secret, correct, and available.

Transforming readable data into an unintelligible form using an algorithm and key, so that only parties holding the correct key can recover the original content.

Recording events and activities in systems and networks to create evidence for detection, investigation, and audit. Logs must be protected, retained, and reviewed in line with legal requirements.

Continuous or periodic observation of systems, networks, and behavior to detect anomalies, control failures, and security events, and to support timely response and decision-making.

The structured process for detecting, reporting, assessing, responding to, and learning from information security incidents, with defined roles, communication paths, and escalation criteria.

The capability of the organization to continue delivering products and services at acceptable levels during and after disruption, supported by continuity plans, resilience, and tested recovery arrangements.

Copies of information and software kept so that originals can be restored after loss, corruption, or attack. Backups should be tested, protected, and stored separately from the source.

The process of identifying, evaluating, and remediating weaknesses in systems and software, including patch management and configuration hardening, based on assessed risk and exposure.