Isms Notes

PRE-COURSE MATERIAL
INFORMATION SECURITY
MANAGEMENT SYSTEM
ISO-27001:2013
PRE-COURSE MATERIAL
Scope:
ISO-27001 specifies the requirements for establishing, implementing, maintaining and
continually improving an information security management system within the context of the
organization. Information Security Management System covers various information assets
that are received, maintained, communicated, processed, stored by the organization.
Terms and Definitions:
For the implementation of ISMS, we need to understand the following Terms & Definitions:
Management system:
Set of interrelated or interacting elements of an organization to establish policies and

objectives and processes to achieve those objectives
Organization:
Person or group of people that has its own functions with responsibilities, authorities,
accountabilities and relationships to achieve its objectives
Top management:
Person or group of people who directs and controls an organization at the highest level
Interested party:
Person or organization that can affect, be affected by, or perceive itself to be affected by a
decision or activity
EXAMPLE Customers, communities, suppliers, regulators, non-governmental organizations, investors

and employees.
Objective:
Result to be achieved
Competence:
Ability to apply knowledge and skills to achieve intended results
Document:
Information and its supporting medium
NOTE The medium can be paper, magnetic, electronic or optical computer disc, photograph
or master sample, or a combination thereof.
Documented information:
Information required to be controlled and maintained by an organization and the medium

on which it is contained
Process:
Set of interrelated or interacting activities which transforms inputs into outputs
Audit:
PRE-COURSE MATERIAL
Systematic, independent and documented process for obtaining audit evidence and
evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Conformity:
Fulfillment of a requirement
Nonconformity:
Non-fulfillment of a requirement
Corrective action:
Action to eliminate the cause of a non-conformity and to prevent recurrence
Effectiveness:
Extent to which planned activities are realized and planned results achieved
Indicator:
Measurable representation of the condition or status of operations, management or
conditions
Performance:
Measurable result
The PDCA cycle:
Plan: establish the objectives of the system and its processes, and the resources needed
to deliver
results in accordance with customers requirements and the organizations policies, and
identify
and address risks and opportunities;
Do: implement what was planned;
Check: monitor and (where applicable) measure processes and the resulting products
and services
against policies, objectives, requirements and planned activities, and report the results;
Act: take actions to improve performance, as necessary.
Risk:
Effect of uncertainty
Continual Improvement:
Recurring process of enhancing the Management System in order to achieve

improvements in overall Organizational performance
Procedure:
Specified way to carry out an activity or a process
Record:
PRE-COURSE MATERIAL
Document stating results achieved or providing evidence of activities performed
Access control
means to ensure that access to assets is authorized and restricted based on business and
security requirements
Attack
attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make un
authorized use of an asset
Availability
property of being accessible and usable upon demand by an authorized entity
Competence
ability to apply knowledge and skills to achieve intended results
Confidentiality
property that information is not made available or disclosed to unauthorized individuals,

entities, or processes (2.61)
Conformity
fulfilment of a requirement (2.63)
Consequence
outcome of an event (2.25) affecting objectives (2.56)
Control
measure that is modifying risk (2.68)
Correction
action to eliminate a detected nonconformity (2.53)
Corrective action
action to eliminate the cause of a nonconformity (2.53) and to prevent recurrence
Data
collection of values assigned to base measures (2.10), derived measures (2.22) and/or
indicators (2.30)
External context
external environment in which the organization seeks to achieve its objectives
Information security
preservation of confidentiality (2.12), integrity (2.40) and availability (2.9) of information
Information security continuity
processes (2.61) and procedures for ensuring continued information security (2.33)
operations
Information security event
identified occurrence of a system, service or network state indicating a possible breach of

information security policy or failure of controls, or a previously unknown situation that may
be security relevant
Information security incident

PRE-COURSE MATERIAL
single or a series of unwanted or unexpected information security events (2.35) that have a
significant probability of compromising business operations and threatening information
security (2.33)
Information security incident management
processes (2.61) for detecting, reporting, assessing, responding to, dealing with, and learning
from information security incidents (2.36)
Integrity
property of accuracy and completeness
Interested party
person or organization (2.57) that can affect, be affected by, or perceive themselves to be
affected by a decision or activity
Level of risk
magnitude of a risk (2.68) expressed in terms of the combination of consequences (2.14) and
their likelihood (2.45)
Likelihood
chance of something happening
Monitoring
determining the status of a system, a process (2.61) or an activity
Nonconformity
non-fulfilment of a requirement (2.63)
Policy
intentions and direction of an organization (2.57) as formally expressed by its top

management (2.84)
Residual risk
risk (2.68) remaining after risk treatment (2.79)

Risk
effect of uncertainty on objectives
Risk acceptance
informed decision to take a particular risk (2.68)
Risk analysis
process to comprehend the nature of risk (2.68) and to determine the level of risk (2.44)
Risk assessment
overall process (2.61) of risk identification (2.75), risk analysis (2.70) and risk evaluation
(2.74)
Risk criteria
terms of reference against which the significance of risk (2.68) is evaluated
Risk evaluation
process (2.61) of comparing the results of risk analysis (2.70) with risk criteria (2.73) to
determine whether the risk (2.68) and/or its magnitude is acceptable or tolerable
PRE-COURSE MATERIAL
Risk identification
process of finding, recognizing and describing risks (2.68)
Risk management process
systematic application of management policies, procedures and practices to the activities of

communicating, consulting, establishing the context and identifying, analyzing, evaluating,
treating, monitoring and reviewing risk (2.68)
Risk owner
person or entity with the accountability and authority to manage a risk (2.68)
Risk treatment
process (2.61) to modify risk (2.68)
Stakeholder
person or organization that can affect, be affected by, or perceive themselves to be affected
by a decision or activity
Threat
potential cause of an unwanted incident, which may result in harm to a system or

organization
Vulnerability
weakness of an asset or control (2.16) that can be exploited by one or more threats (2.83)

Isms Notes

Uploaded by

Copyright:

Available Formats

Isms Notes

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Isms Notes

Uploaded by

Copyright:

Available Formats

PRE-COURSE MATERIAL

Terms and Definitions:

Set of interrelated or interacting elements of an organization to establish policies and

EXAMPLE Customers, communities, suppliers, regulators, non-governmental organizations, investors

Information and its supporting medium

Information required to be controlled and maintained by an organization and the medium

The PDCA cycle:

Do: implement what was planned;

Recurring process of enhancing the Management System in order to achieve

Specified way to carry out an activity or a process

property of being accessible and usable upon demand by an authorized entity

ability to apply knowledge and skills to achieve intended results

property that information is not made available or disclosed to unauthorized individuals,

fulfilment of a requirement (2.63)

outcome of an event (2.25) affecting objectives (2.56)

measure that is modifying risk (2.68)

action to eliminate a detected nonconformity (2.53)

action to eliminate the cause of a nonconformity (2.53) and to prevent recurrence

external environment in which the organization seeks to achieve its objectives

preservation of confidentiality (2.12), integrity (2.40) and availability (2.9) of information

Information security continuity

Information security event

identified occurrence of a system, service or network state indicating a possible breach of

Information security incident

Information security incident management

property of accuracy and completeness

chance of something happening

determining the status of a system, a process (2.61) or an activity

non-fulfilment of a requirement (2.63)

intentions and direction of an organization (2.57) as formally expressed by its top

risk (2.68) remaining after risk treatment (2.79)

effect of uncertainty on objectives

informed decision to take a particular risk (2.68)

terms of reference against which the significance of risk (2.68) is evaluated

process of finding, recognizing and describing risks (2.68)

Risk management process

systematic application of management policies, procedures and practices to the activities of

process (2.61) to modify risk (2.68)

potential cause of an unwanted incident, which may result in harm to a system or

You might also like