ISO 27400 Lead Manager key terms

A system of interconnected physical devices with embedded sensors, software, and network connectivity that collect, exchange, and act on data, often with limited human intervention and constrained computing resources.

A physical component with sensing, actuation, or processing capability and network connectivity, typically constrained in power, memory, and processing, that forms part of an IoT system.

The set of devices, gateways, networks, cloud services, applications, users, and stakeholders that interact to deliver an IoT-based service, spanning multiple trust boundaries and ownership domains.

An intermediary component that aggregates, translates, and forwards data between constrained devices and wider networks or cloud services, often enforcing security policy at the boundary between local and external networks.

A device whose power, memory, processing, or bandwidth is significantly limited, restricting which cryptographic algorithms, security protocols, and update mechanisms it can support.

Hardware and software that monitors and controls physical processes, equipment, and industrial operations, where security failures can cause safety incidents and physical damage rather than only data loss.

An engineered system in which computation and networking are tightly coupled with physical processes, so that digital security compromise can produce direct physical consequences.

Deployment of connected sensing and control devices within industrial, utility, or manufacturing environments, typically combining IT security concerns with OT availability and safety requirements.

The set of interfaces, services, protocols, and credentials through which an attacker could attempt to interact with or compromise a system.

A potential cause of an unwanted incident that may result in harm to a system, an organization, or its stakeholders.

A weakness in a device, software, configuration, process, or control that can be exploited by one or more threats.

The effect of uncertainty on objectives, commonly expressed as a combination of the likelihood of an event and the severity of its consequences.

The overall process of identifying, analysing, and evaluating risk, producing information used to decide which risks need treatment and at what priority.

The process of selecting and implementing measures to modify risk, such as avoiding, reducing, transferring, or accepting it, and then evaluating whether residual risk is acceptable.

The risk that remains after controls have been applied and evaluated, which the organization must compare against its risk acceptance criteria.

Predefined thresholds or conditions stating how much risk an organization is willing to retain for a given activity, system, or asset, used to judge whether treatment is sufficient.

The person or entity with the accountability and authority to manage a particular risk, including approving treatment decisions and accepting residual risk.

The person or role accountable for a specific information asset or IoT device, including its classification, correct use, and the accuracy of its inventory record.

A maintained, accurate record of an organization's devices, services, and data assets, including ownership, location, version, and configuration, forming the basis for many IoT security controls.

An architecture approach that layers multiple independent controls so that failure or bypass of one control does not by itself lead to compromise of the protected asset.

The principle that each user, process, or device is granted only the access rights strictly needed to perform its intended function, for no longer than necessary.

A documented set of management direction and rules stating how an organization intends to protect its IoT assets, including required controls, responsibilities, and acceptable use.

The structures, roles, responsibilities, and decision-making processes by which an organization directs and oversees its IoT security activities and holds people accountable.

Explicit statements of what security outcomes an IoT program must achieve, typically covering confidentiality, integrity, availability, safety, and privacy, used to guide control selection.

The documented boundary of an IoT security program or assessment, specifying which devices, systems, locations, suppliers, and processes are included and which are excluded.

Structured activities that give staff, operators, and users the knowledge and behaviour needed to recognize and reduce IoT security risks in their daily work.

An approach in which security requirements and protections are built into device and system architecture from the start, rather than added after deployment.

A design property whereby a product ships in its most secure usable configuration, with no shared default passwords and unnecessary services disabled unless deliberately enabled.

The processes and systems for creating, verifying, maintaining, and revoking identities for devices, users, and services, ensuring each is uniquely identifiable.

A unique, verifiable representation of a specific IoT device, often anchored in a hardware root of trust or cryptographic credential, used to authenticate it to networks and services.

A protected hardware component or area that stores keys and performs cryptographic operations, providing a trustworthy foundation on which device security functions are built.

A startup process that verifies the integrity and authenticity of firmware and software before execution, preventing unauthorized or tampered code from running on a device.

The controlled process of delivering, verifying, and installing new device software, ideally authenticated and encrypted, to remediate vulnerabilities and add functionality.

The disciplined process of identifying, prioritizing, testing, deploying, and verifying software fixes across an estate of devices within defined timeframes.

A continuous cycle of discovering, classifying, prioritizing, remediating, and verifying weaknesses in devices and supporting systems, including monitoring for newly disclosed issues.

Dividing a network into separate zones with controlled traffic between them, limiting the spread of compromise and isolating IoT devices from unrelated systems.

The process of verifying a claimed identity of a user, device, or service, typically using one or more factors such as credentials, certificates, or cryptographic keys.

An access control model in which permissions are assigned to roles rather than individuals, and subjects obtain permissions by being assigned to the appropriate roles.

The collection, storage, and analysis of event records from devices, networks, and services to detect anomalies, support investigations, and provide evidence of control operation.

A single or series of unwanted or unexpected information security events that have a significant probability of compromising operations and threatening security.

The organized approach for detecting, containing, eradicating, recovering from, and learning from security incidents, with defined roles, escalation paths, and communications.

Quantitative or qualitative measures used to track whether IoT security controls and processes are operating as intended and to inform management decisions.

The ongoing, repeating activity of measuring performance, identifying gaps, and adjusting controls and processes so that security effectiveness increases over time.

Structured review of incidents, audits, or exercises that identifies root causes and produces concrete changes to controls, procedures, or training.