ISO/IEC 27005 Foundation flashcards
ISO/IEC 27005 Foundation · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Information security risk
- The effect of uncertainty on information security objectives, often expressed as the potential for loss or harm from threats exploiting vulnerabilities, considering likelihood and impact.
- Asset
- Anything that has value to the organization, including information, systems, people, and infrastructure, which must be protected and considered in risk assessment.
- Threat
- A potential cause of an unwanted incident that may result in harm to a system or organization; threats can be intentional, accidental, or environmental.
- Vulnerability
- A weakness of an asset or control that can be exploited by one or more threats, increasing the likelihood or impact of an incident.
- Likelihood
- The chance that a threat will exploit a vulnerability, often expressed qualitatively or quantitatively, and used in risk analysis to estimate frequency or probability.
- Consequence
- The outcome or impact of an event affecting objectives, such as financial loss, reputational damage, or operational disruption, used in risk analysis to assess severity.
- Risk level
- The magnitude of a risk, expressed as a combination of likelihood and consequence; it is used to prioritize risks and determine treatment.
- Residual risk
- The risk remaining after risk treatment has been applied; it should be documented and accepted by the risk owner according to risk criteria.
- Risk appetite
- The amount and type of risk an organization is willing to pursue or retain to achieve its objectives, guiding risk treatment decisions.
- Risk tolerance
- The acceptable variation around risk appetite; it defines the limits within which the organization can operate while still achieving objectives.
- Risk capacity
- The maximum amount of risk an organization can bear or absorb without jeopardizing its viability or strategic objectives.
- Risk owner
- The person or entity accountable for managing a particular risk, including deciding on and implementing appropriate treatment and accepting residual risk.
- Risk treatment
- The process of selecting and implementing measures to modify risk, which can include risk modification, retention, avoidance, or sharing, according to ISO/IEC 27005.
- Risk modification
- A risk treatment option that involves applying controls to reduce the likelihood or impact of a risk, often through preventive or detective measures.
- Risk retention
- A risk treatment option where the organization accepts the risk and does not take further action, often because the risk is within appetite or treatment is not cost-effective.
- Risk avoidance
- A risk treatment option that involves deciding not to become involved in or to withdraw from an activity that gives rise to risk.
- Risk sharing
- A risk treatment option that involves transferring or sharing part of the risk with another party, such as through insurance or outsourcing, while retaining some responsibility.
- ISO/IEC 27005
- An international standard providing guidelines for information security risk management, supporting ISO/IEC 27001 and aligned with ISO 31000 risk management principles.
- Context establishment
- The first step in the risk management process that defines scope, risk criteria, objectives, and constraints to ensure the risk assessment is relevant and focused.
- Risk assessment
- The overall process of risk identification, risk analysis, and risk evaluation, used to understand risks and inform treatment decisions.
- Risk identification
- The process of finding, recognizing, and describing risks, including identifying assets, threats, vulnerabilities, and potential consequences.
- Risk analysis
- The process of determining the likelihood and consequences of identified risks, considering existing controls, to estimate risk levels.
- Risk evaluation
- The process of comparing risk analysis results with risk criteria to determine whether a risk is acceptable or requires treatment.
- Risk criteria
- The terms of reference against which the significance of a risk is evaluated, including risk appetite, tolerance levels, and legal or regulatory requirements.
- Qualitative risk analysis
- A risk analysis method that uses descriptive scales (e.g., high, medium, low) to assess likelihood and impact, often used when numerical data is limited.
- Quantitative risk analysis
- A risk analysis method that assigns numerical values, often monetary, to likelihood and impact, enabling cost-benefit analysis of risk treatment.
- Semi-quantitative risk analysis
- A risk analysis method that uses numeric scales but does not provide the precision of fully quantitative analysis, balancing simplicity and rigor.
- Asset-based risk assessment
- An approach that starts by identifying assets, then assesses threats and vulnerabilities associated with each asset to determine risk.
- Process-based risk assessment
- An approach that focuses on business processes and information flows to identify risks, rather than starting from individual assets.
- Statement of Applicability
- A document required by ISO/IEC 27001 that lists applicable controls, justifies their inclusion or exclusion, and supports risk treatment decisions.
- Communication and consultation
- A continuous process in risk management to share risk information with stakeholders, ensuring understanding and informed decision-making throughout the risk management process.
- Monitoring and review
- The ongoing process of tracking risks, controls, and the risk management framework to ensure effectiveness and continuous improvement, adapting to changes.