Glossary
Jargon, decoded.
- Annex A
- The reference list of 93 information security controls in ISO/IEC 27001:2022.
- Asset
- Anything of value holding or processing information: data, devices, software, people, services.
- Audit (internal)
- Your own independent check that the ISMS meets requirements.
- Certification body
- An accredited organisation that audits and certifies your ISMS.
- CIA triad
- Confidentiality, integrity and availability — the three properties security protects.
- Control
- A measure that reduces risk.
- Corrective action
- Action to remove the cause of a nonconformity so it doesn't recur.
- Documented information
- Documents and records the ISMS must control and keep.
- Interested party
- A person or organisation that can affect or be affected by your security.
- ISMS
- Information Security Management System — the policies, processes and controls used to manage information risk.
- ISO/IEC 27002
- Companion guidance standard with more detail on implementing each control.
- Management review
- Top management's regular review of ISMS performance and direction.
- Nonconformity
- Failing to meet a requirement (major or minor).
- PDCA
- Plan-Do-Check-Act improvement cycle.
- Risk owner
- The person accountable for managing a particular risk.
- Risk treatment
- Choosing to modify, avoid, share or retain a risk.
- Scope
- The boundaries of the ISMS.
- Statement of Applicability (SoA)
- Document listing each Annex A control, whether it applies, why, and its implementation status.
- Stage 1 / Stage 2
- The two parts of an initial certification audit: documentation readiness, then effectiveness.
- Surveillance audit
- Yearly audit between certification and recertification.