>>
<<
ISO/IEC 27000:2018 (E)
GSO - Cover page
تقديم خليجي
Gulf Foreword
ISO - Cover page
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Information security management systems
 4.1 General
 4.2 What is an ISMS?
  4.2.1 Overview and principles
  4.2.2 Information
  4.2.3 Information security
  4.2.4 Management
  4.2.5 Management system
 4.3 Process approach
 4.4 Why an ISMS is important
 4.5 Establishing, monitoring, maintaining and improving an ISMS
  4.5.1 Overview
  4.5.2 Identifying information security requirements
  4.5.3 Assessing information security risks
  4.5.4 Treating information security risks
  4.5.5 Selecting and implementing controls
  4.5.6 Monitor, maintain and improve the effectiveness of the ISMS
  4.5.7 Continual improvement
 4.6 ISMS critical success factors
 4.7 Benefits of the ISMS family of standards
5 ISMS family of standards
 5.1 General information
 5.2 Standard describing an overview and terminology: ISO/IEC 27000 (this document)
 5.3 Standards specifying requirements
  5.3.1 ISO/IEC 27001
  5.3.2 ISO/IEC 27006
  5.3.3 ISO/IEC 27009
 5.4 Standards describing general guidelines
  5.4.1 ISO/IEC 27002
  5.4.2 ISO/IEC 27003
  5.4.3 ISO/IEC 27004
  5.4.4 ISO/IEC 27005
  5.4.5 ISO/IEC 27007
  5.4.6 ISO/IEC TR 27008
  5.4.7 ISO/IEC 27013
  5.4.8 ISO/IEC 27014
  5.4.9 ISO/IEC TR 27016
  5.4.10 ISO/IEC 27021
 5.5 Standards describing sector-specific guidelines
  5.5.1 ISO/IEC 27010
  5.5.2 ISO/IEC 27011
  5.5.3 ISO/IEC 27017
  5.5.4 ISO/IEC 27018
  5.5.5 ISO/IEC 27019
  5.5.6 ISO 27799
Bibliography
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
GSO ISO/IEC 27000:2023
ISO/IEC 27000:2018
مواصفة قياسية خليجية
تقنية المعلومات - تقنيات الأمن - نظم إدارة أمن المعلومات – نظرة عامة والمفردات
Gulf Standard
Information technology — Security techniques — Information security management systems — Overview and vocabulary
ICS:
01.040.35 ; 35.030


Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023

تقديم خليجي

هيئة التقييس لدول مجلس التعاون لدول الخليج العربية هيئة إقليمية تضم في عضويتها أجهزة التقييس الوطنية في الدول الأعضاء ، ومن مهام الهيئة إعداد المواصفات القياسية واللوائح الفنية الخليجية بواسطة لجان فنية متخصصة.
قرر المجلس الفني لهيئة التقييس لدول مجلس التعاون لدول الخليج العربية في الاجتماع الـ (55) بتاريخ 1444/10/12 هـ ،الموافق 2023/05/03م اعتماد تحديث المواصفة القياسية الخليجية رقم GSO ISO/IEC 27000:2023 وعنوانها "تقنية المعلومات - تقنيات الأمن - نظم إدارة أمن المعلومات – نظرة عامة والمفردات" باللغة الانجليزية التي تم دراستها وتبنيها عن المنظمة الدولية للتقييس رقم ISO/IEC 27000:2018 بدون إدخال تعديلات فنية عليها ضمن برنامج عمل اللجنة الفنية الخليجية لمواصفات المعلومات وتقنية المعلومات (TC08) المدرجة في خطة الإمارات العربية المتحدة . على أن تلغي وتحل محل المواصفة القياسية رقم GSO ISO/IEC 27000:2015 .

Gulf Foreword

GCC Standardization Organization (GSO) is a regional organization which consists of the national standardization bodies of GCC member states. One of GSO main functions is to issue gulf standards and technical regulations through specialized technical committees.
GSO Technical Council in its meeting number (55) held on 12/10/1444 H, which corresponds to 03/05/2023, has approved the update of Gulf Standard GSO ISO/IEC 27000:2023 titled "Information technology — Security techniques — Information security management systems — Overview and vocabulary" in English language which was studied and adopted from International Organization for Standardization Standard ISO/IEC 27000:2018 without any technical modifications through the technical program of GSO Technical Committee for Information and Information Technology (TC08) in UNITED ARAB EMIRATES schedule . This document will cancel and replace the Gulf Standard GSO ISO/IEC 27000:2015.
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
GSO ISO/IEC 27000:2023 Gulf Standard

INTERNATIONAL

STANDARD

ISO/IEC
27000
Fifth edition
2018-02



Information technology — Security techniques — Information security management systems — Overview and vocabulary
Technologies de l'information — Techniques de sécurité — Systèmes de management de la sécurité de l'information — Vue d'ensemble et vocabulaire



Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
GSO ISO/IEC 27000:2023 Gulf Standard

Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
GSO ISO/IEC 27000:2023 Gulf Standard
Contents Page

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following URL: www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/IEC JTC 1, Information technology, SC 27, IT Security techniques.
This fifth edition cancels and replaces the fourth edition (ISO/IEC 27000:2016), which has been technically revised. The main changes compared to the previous edition are as follows:
the Introduction has been reworded;
some terms and definitions have been removed;
Clause 3 has been aligned on the high-level structure for MSS;
Clause 5 has been updated to reflect the changes in the standards concerned;
Annexes A and B have been deleted.

Introduction

0.1   Overview
International Standards for management systems provide a model to follow in setting up and operating a management system. This model incorporates the features on which experts in the field have reached a consensus as being the international state of the art. ISO/IEC JTC 1/SC 27 maintains an expert committee dedicated to the development of international management systems standards for information security, otherwise known as the Information Security Management system (ISMS) family of standards.
Through the use of the ISMS family of standards, organizations can develop and implement a framework for managing the security of their information assets, including financial information, intellectual property, and employee details, or information entrusted to them by customers or third parties. These standards can also be used to prepare for an independent assessment of their ISMS applied to the protection of information.
0.2   Purpose of this document
The ISMS family of standards includes standards that:
a)
define requirements for an ISMS and for those certifying such systems;
b)
provide direct support, detailed guidance and/or interpretation for the overall process to establish, implement, maintain, and improve an ISMS;
c)
address sector-specific guidelines for ISMS; and
d)
address conformity assessment for ISMS.
0.3   Content of this document
In this document, the following verbal forms are used:
“shall” indicates a requirement;
“should” indicates a recommendation;
“may” indicates a permission;
“can” indicates a possibility or a capability.
Information marked as "NOTE" is for guidance in understanding or clarifying the associated requirement. “Notes to entry” used in Clause 3 provide additional information that supplements the terminological data and can contain provisions relating to the use of a term.

Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
GSO ISO/IEC 27000:2023 Gulf Standard
INTERNATIONAL STANDARD ISO/IEC 27000:2018 (E)
Information technology — Security techniques — Information security management systems — Overview and vocabulary

1 Scope

This document provides the overview of information security management systems (ISMS). It also provides terms and definitions commonly used in the ISMS family of standards. This document is applicable to all types and sizes of organization (e.g. commercial enterprises, government agencies, not-for-profit organizations).
The terms and definitions provided in this document
cover commonly used terms and definitions in the ISMS family of standards;
do not cover all terms and definitions applied within the ISMS family of standards; and
do not limit the ISMS family of standards in defining new terms for use.

2 Normative references

There are no normative references in this document.

3 Terms and definitions

ISO and IEC maintain terminological databases for use in standardization at the following addresses:
ISO Online browsing platform: available at https://www.iso.org/obp
IEC Electropedia: available at https://www.electropedia.org/
3.1
access control
means to ensure that access to assets is authorized and restricted based on business and security requirements (3.56)
3.2
attack
attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset
3.3
audit
systematic, independent and documented process (3.54) for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party), and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: An internal audit is conducted by the organization itself, or by an external party on its behalf.
Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.
3.4
audit scope
extent and boundaries of an audit (3.3)
[SOURCE: ISO 19011:2011, 3.14, modified — Note 1 to entry has been deleted.]
3.5
authentication
provision of assurance that a claimed characteristic of an entity is correct
3.6
authenticity
property that an entity is what it claims to be
3.7
availability
property of being accessible and usable on demand by an authorized entity
3.8
base measure
measure (3.42) defined in terms of an attribute and the method for quantifying it
Note 1 to entry: A base measure is functionally independent of other measures.
[SOURCE: ISO/IEC/IEEE 15939:2017, 3.3, modified — Note 2 to entry has been deleted.]
3.9
competence
ability to apply knowledge and skills to achieve intended results
3.10
confidentiality
property that information is not made available or disclosed to unauthorized individuals, entities, or processes (3.54)
3.11
conformity
fulfilment of a requirement (3.56)
3.12
consequence
outcome of an event (3.21) affecting objectives (3.49)
Note 1 to entry: An event can lead to a range of consequences.
Note 2 to entry: A consequence can be certain or uncertain and, in the context of information security, is usually negative.
Note 3 to entry: Consequences can be expressed qualitatively or quantitatively.
Note 4 to entry: Initial consequences can escalate through knock-on effects.
[SOURCE: ISO Guide 73:2009, 3.6.1.3, modified — Note 2 to entry has been changed after “and”.]
3.13
continual improvement
recurring activity to enhance performance (3.52)
3.14
control
measure that is modifying risk (3.61)
Note 1 to entry: Controls include any process (3.54), policy (3.53), device, practice, or other actions which modify risk (3.61).
Note 2 to entry: It is possible that controls not always exert the intended or assumed modifying effect.
[SOURCE: ISO Guide 73:2009, 3.8.1.1 — Note 2 to entry has been changed.]
3.15
control objective
statement describing what is to be achieved as a result of implementing controls (3.14)
3.16
correction
action to eliminate a detected nonconformity (3.47)
3.17
corrective action
action to eliminate the cause of a nonconformity (3.47) and to prevent recurrence
3.18
derived measure
measure (3.42) that is defined as a function of two or more values of base measures (3.8)
[SOURCE: ISO/IEC/IEEE 15939:2017, 3.8, modified — Note 1 to entry has been deleted.]
3.19
documented information
information required to be controlled and maintained by an organization (3.50) and the medium on which it is contained
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to
the management system (3.41), including related processes (3.54);
information created in order for the organization (3.50) to operate (documentation);
evidence of results achieved (records).
3.20
effectiveness
extent to which planned activities are realized and planned results achieved
3.21
event
occurrence or change of a particular set of circumstances
Note 1 to entry: An event can be one or more occurrences, and can have several causes.
Note 2 to entry: An event can consist of something not happening.
Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”.
[SOURCE: ISO Guide 73:2009, 3.5.1.3, modified — Note 4 to entry has been deleted.]
3.22
external context
external environment in which the organization seeks to achieve its objectives (3.49)
Note 1 to entry: External context can include the following:
the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive environment, whether international, national, regional or local;
key drivers and trends having impact on the objectives of the organization (3.50);
relationships with, and perceptions and values of, external stakeholders (3.37).
[SOURCE: ISO Guide 73:2009, 3.3.1.1]
3.23
governance of information security
system by which an organization’s (3.50) information security (3.28) activities are directed and controlled
3.24
governing body
person or group of people who are accountable for the performance (3.52) and conformity of the organization (3.50)
Note 1 to entry: The governing body can, in some jurisdictions, be a board of directors.
3.25
indicator
measure (3.42) that provides an estimate or evaluation
3.26
information need
insight necessary to manage objectives (3.49), goals, risks and problems
[SOURCE: ISO/IEC/IEEE 15939:2017, 3.12]
3.27
information processing facilities
any information processing system, service or infrastructure, or the physical location housing it
3.28
information security
preservation of confidentiality (3.10), integrity (3.36) and availability (3.7) of information
Note 1 to entry: In addition, other properties, such as authenticity (3.6), accountability, non-repudiation (3.48), and reliability (3.55) can also be involved.
3.29
information security continuity
processes (3.54) and procedures for ensuring continued information security (3.28) operations
3.30
information security event
identified occurrence of a system, service or network state indicating a possible breach of information security (3.28) policy (3.53) or failure of controls (3.14), or a previously unknown situation that can be security relevant
3.31
information security incident
single or a series of unwanted or unexpected information security events (3.30) that have a significant probability of compromising business operations and threatening information security (3.28)
3.32
information security incident management
set ofprocesses (3.54) for detecting, reporting, assessing, responding to, dealing with, and learning from information security incidents (3.31)
3.33
information security management system (ISMS) professional
person who establishes, implements, maintains and continuously improves one or more information security management system processes (3.54)
3.34
information sharing community
group of organizations (3.50) that agree to share information
Note 1 to entry: An organization can be an individual.
3.35
information system
set of applications, services, information technology assets, or other information-handling components
3.36
integrity
property of accuracy and completeness
3.37
interested party (preferred term)
stakeholder (admitted term)
person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision or activity
3.38
internal context
internal environment in which the organization (3.50) seeks to achieve its objectives
Note 1 to entry: Internal context can include:
governance, organizational structure, roles and accountabilities;
policies (3.53), objectives (3.49), and the strategies that are in place to achieve them;
the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes (3.54), systems and technologies);
information systems (3.35), information flows and decision-making processes (both formal and informal);
relationships with, and perceptions and values of, internal stakeholders (3.37);
the organization's culture;
standards, guidelines and models adopted by the organization;
form and extent of contractual relationships.
[SOURCE: ISO Guide 73:2009, 3.3.1.2]
3.39
level of risk
magnitude of a risk (3.61) expressed in terms of the combination of consequences (3.12) and their likelihood (3.40)
[SOURCE: ISO Guide 73:2009, 3.6.1.8, modified — “or combination of risks” has been deleted in the definition.]
3.40
likelihood
chance of something happening
[SOURCE: ISO Guide 73:2009, 3.6.1.1, modified — Notes 1 and 2 to entry have been deleted.]
3.41
management system
set of interrelated or interacting elements of an organization (3.50) to establish policies (3.53) and objectives (3.49) and processes (3.54) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning and operation.
Note 3 to entry: The scope of a management system may include the whole of the organization, specific and identified functions of the organization, specific and identified sections of the organization, or one or more functions across a group of organizations.
3.42
measure
variable to which a value is assigned as the result of measurement (3.43)
[SOURCE: ISO/IEC/IEEE 15939:2017, 3.15, modified — Note 2 to entry has been deleted.]
3.43
measurement
process (3.54) to determine a value
3.44
measurement function
algorithm or calculation performed to combine two or more base measures (3.8)
[SOURCE: ISO/IEC/IEEE 15939:2017, 3.20]
3.45
measurement method
logical sequence of operations, described generically, used in quantifying an attribute with respect to a specified scale
Note 1 to entry: The type of measurement method depends on the nature of the operations used to quantify an attribute (3.4). Two types can be distinguished:
subjective: quantification involving human judgment; and
objective: quantification based on numerical rules.
[SOURCE: ISO/IEC/IEEE 15939:2017, 3.21, modified — Note 2 to entry has been deleted.]
3.46
monitoring
determining the status of a system, a process (3.54) or an activity
Note 1 to entry: To determine the status, there may be a need to check, supervise or critically observe.
3.47
nonconformity
non-fulfilment of a requirement (3.56)
3.48
non-repudiation
ability to prove the occurrence of a claimed event (3.21) or action and its originating entities
3.49
objective
result to be achieved
Note 1 to entry: An objective can be strategic, tactical, or operational.
Note 2 to entry: Objectives can relate to different disciplines (such as financial, health and safety, and environmental goals) and can apply at different levels [such as strategic, organization-wide, project, product and process (3.54)].
Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an operational criterion, as an information security objective or by the use of other words with similar meaning (e.g. aim, goal, or target).
Note 4 to entry: In the context of information security management systems, information security objectives are set by the organization, consistent with the information security policy, to achieve specific results.
3.50
organization
person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives (3.49)
Note 1 to entry: The concept of organization includes but is not limited to sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.
3.51
outsource
make an arrangement where an external organization (3.50) performs part of an organization’s function or process (3.54)
Note 1 to entry: An external organization is outside the scope of the management system (3.41), although the outsourced function or process is within the scope.
3.52
performance
measurable result
Note 1 to entry: Performance can relate either to quantitative or qualitative findings.
Note 2 to entry: Performance can relate to the management of activities, processes (3.54), products (including services), systems or organizations (3.50).
3.53
policy
intentions and direction of an organization (3.50), as formally expressed by its top management (3.75)
3.54
process
set of interrelated or interacting activities which transforms inputs into outputs
3.55
reliability
property of consistent intended behaviour and results
3.56
requirement
need or expectation that is stated, generally implied or obligatory
Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization and interested parties that the need or expectation under consideration is implied.
Note 2 to entry: A specified requirement is one that is stated, for example in documented information.
3.57
residual risk
risk (3.61) remaining after risk treatment (3.72)
Note 1 to entry: Residual risk can contain unidentified risk.
Note 2 to entry: Residual risk can also be referred to as “retained risk”.
3.58
review
activity undertaken to determine the suitability, adequacy and effectiveness (3.20) of the subject matter to achieve established objectives (3.49)
[SOURCE: ISO Guide 73:2009, 3.8.2.2, modified — Note 1 to entry has been deleted.]
3.59
review object
specific item being reviewed
3.60
review objective
statement describing what is to be achieved as a result of a review (3.59)
3.61
risk
effect of uncertainty on objectives (3.49)
Note 1 to entry: An effect is a deviation from the expected — positive or negative.
Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood.
Note 3 to entry: Risk is often characterized by reference to potential “events” (as defined in ISO Guide 73:2009, 3.5.1.3) and “consequences” (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these.
Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated “likelihood” (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence.
Note 5 to entry: In the context of information security management systems, information security risks can be expressed as effect of uncertainty on information security objectives.
Note 6 to entry: Information security risk is associated with the potential that threats will exploit vulnerabilities of an information asset or group of information assets and thereby cause harm to an organization.
3.62
risk acceptance
informed decision to take a particular risk (3.61)
Note 1 to entry: Risk acceptance can occur without risk treatment (3.72) or during the process (3.54) of risk treatment.
Note 2 to entry: Accepted risks are subject to monitoring (3.46) and review (3.58).
[SOURCE: ISO Guide 73:2009, 3.7.1.6]
3.63
risk analysis
process (3.54) to comprehend the nature of risk (3.61) and to determine the level of risk (3.39)
Note 1 to entry: Risk analysis provides the basis for risk evaluation (3.67) and decisions about risk treatment (3.72).
Note 2 to entry: Risk analysis includes risk estimation.
[SOURCE: ISO Guide 73:2009, 3.6.1]
3.64
risk assessment
overall process (3.54) of risk identification (3.68), risk analysis (3.63) and risk evaluation (3.67)
[SOURCE: ISO Guide 73:2009, 3.4.1]
3.65
risk communication and consultation
set of continual and iterative processes (3.54) that an organization conducts to provide, share or obtain information, and to engage in dialogue with stakeholders (3.37) regarding the management of risk (3.61)
Note 1 to entry: The information can relate to the existence, nature, form, likelihood (3.41), significance, evaluation, acceptability and treatment of risk.
Note 2 to entry: Consultation is a two-way process of informed communication between an organization (3.50) and its stakeholders on an issue prior to making a decision or determining a direction on that issue. Consultation is
a process which impacts on a decision through influence rather than power; and
an input to decision making, not joint decision making.
3.66
risk criteria
terms of reference against which the significance of risk (3.61) is evaluated
Note 1 to entry: Risk criteria are based on organizational objectives, and external context (3.22) and internal context (3.38).
Note 2 to entry: Risk criteria can be derived from standards, laws, policies (3.53) and other requirements (3.56).
[SOURCE: ISO Guide 73:2009, 3.3.1.3]
3.67
risk evaluation
process (3.54) of comparing the results of risk analysis (3.63) with risk criteria (3.66) to determine whether the risk (3.61) and/or its magnitude is acceptable or tolerable
Note 1 to entry: Risk evaluation assists in the decision about risk treatment (3.72).
[SOURCE: ISO Guide 73:2009, 3.7.1]
3.68
risk identification
process (3.54) of finding, recognizing and describing risks (3.61)
Note 1 to entry: Risk identification involves the identification of risk sources, events (3.21), their causes and their potential consequences (3.12).
Note 2 to entry: Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and stakeholders’ (3.37) needs.
[SOURCE: ISO Guide 73:2009, 3.5.1]
3.69
risk management
coordinated activities to direct and control an organization (3.50) with regard to risk (3.61)
[SOURCE: ISO Guide 73:2009, 2.1]
3.70
risk management process
systematic application of management policies (3.53), procedures and practices to the activities of communicating, consulting, establishing the context and identifying, analysing, evaluating, treating, monitoring and reviewing risk (3.61)
Note 1 to entry: ISO/IEC 27005 uses the term “process” (3.54) to describe risk management overall. The elements within the risk management (3.69) process are referred to as “activities”.
[SOURCE: ISO Guide 73:2009, 3.1, modified — Note 1 to entry has been added.]
3.71
risk owner
person or entity with the accountability and authority to manage a risk (3.61)
[SOURCE: ISO Guide 73:2009, 3.5.1.5]
3.72
risk treatment
process (3.54) to modify risk (3.61)
Note 1 to entry: Risk treatment can involve:
avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
taking or increasing risk in order to pursue an opportunity;
removing the risk source;
changing the likelihood (3.40);
changing the consequences (3.12);
sharing the risk with another party or parties (including contracts and risk financing);
retaining the risk by informed choice.
Note 2 to entry: Risk treatments that deal with negative consequences are sometimes referred to as “risk mitigation”, “risk elimination”, “risk prevention” and “risk reduction”.
Note 3 to entry: Risk treatment can create new risks or modify existing risks.
[SOURCE: ISO Guide 73:2009, 3.8.1, modified — “decision” has been replaced by “choice” in Note 1 to entry.]
3.73
security implementation standard
document specifying authorized ways for realizing security
3.74
threat
potential cause of an unwanted incident, which can result in harm to a system or organization (3.50)
3.75
top management
person or group of people who directs and controls an organization (3.50) at the highest level
Note 1 to entry: Top management has the power to delegate authority and provide resources within the organization.
Note 2 to entry: If the scope of the management system (3.41) covers only part of an organization, then top management refers to those who direct and control that part of the organization.
Note 3 to entry: Top management is sometimes called executive management and can include Chief Executive Officers, Chief Financial Officers, Chief Information Officers, and similar roles.
3.76
trusted information communication entity
autonomous organization (3.50) supporting information exchange within an information sharing community (3.34)
3.77
vulnerability
weakness of an asset or control (3.14) that can be exploited by one or more threats (3.74)

Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
GSO ISO/IEC 27000:2023 Gulf Standard
Bibliography
[1]
ISO 9000:2015, Quality management systems — Fundamentals and vocabulary
[2]
ISO/IEC/IEEE 15939:2017, Systems and software engineering — Measurement process
[3]
ISO/IEC 17021, Conformity assessment — Requirements for bodies providing audit and certification of management systems
[4]
ISO 19011:2011, Guidelines for auditing management systems
[5]
ISO/IEC 20000-1:2011, Information technology — Service management — Part 1: Service management system requirements
[6]
ISO/IEC 27001, Information technology — Security techniques — Information security management systems — Requirements
[7]
ISO/IEC 27002, Information technology — Security techniques — Code of practice for information security controls
[8]
ISO/IEC 27003, Information technology — Security techniques — Information security management — Guidance
[9]
ISO/IEC 27004, Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation
[10]
ISO/IEC 27005, Information technology — Security techniques — Information security risk management
[11]
ISO/IEC 27006, Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems
[12]
ISO/IEC 27007, Information technology — Security techniques — Guidelines for information security management systems auditing
[13]
ISO/IEC TR 27008, Information technology — Security techniques — Guidelines for auditors on information security controls
[14]
ISO/IEC 27009, Information technology — Security techniques — Sector-specific application of ISO/IEC 27001 — Requirements
[15]
ISO/IEC 27010, Information technology — Security techniques — Information security management for inter-sector and inter-organizational communications
[16]
ISO/IEC 27011, Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for telecommunications organizations
[17]
ISO/IEC 27013, Information technology — Security techniques — Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000‑1
[18]
ISO/IEC 27014, Information technology — Security techniques — Governance of information security
[19]
ISO/IEC TR 27016, Information technology — Security techniques — Information security management — Organizational economics
[20]
ISO/IEC 27017, Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for cloud services
[21]
ISO/IEC 27018, Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
[22]
ISO/IEC 27019, Information technology — Security techniques — Information security controls for the energy utility industry
[23]
ISO/IEC 27021, Information technology — Security techniques — Competence requirements for information security management systems professionals
[24]
ISO 27799, Health informatics — Information security management in health using ISO/IEC 27002
[25]
ISO Guide 73:2009, Risk management — Vocabulary
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
Gulf Standard GSO ISO/IEC 27000:2023
GSO ISO/IEC 27000:2023 Gulf Standard



ICS 01.040.35; 03.100.70; 35.030
Price based on 27 pages



ICS 01.040.35; 03.100.70; 35.030
Price based on 27 pages