12 << 5555
- 17 hours ago
- 2 min read
In part, the current (fifth, 2018) edition of ISO/IEC 27000 defines key terms of art used throughout the ISO27k standards. The standard is available as a legitimate free download from ISO. If you haven't already seen it, go ahead - download the standard for a good look at these 77 terms defined in clause 3:
access control
attack
audit
audit scope
authentication
authenticity
availability
base measure
competence
confidentiality
conformity
consequence
continual improvement
control
control objective
correction
corrective action
derived measure
documented information
effectiveness
event
external context
governance of information security
governing body
indicator
information need
information processing facilities
information security
information security continuity
information security event
information security incident
information security incident management
information security management system (ISMS) professional
information sharing community
information system
integrity
interested party (preferred term) or stakeholder (admitted term)
internal context
level of risk
likelihood
management system
measure
measurement
measurement function
measurement method
monitoring
nonconformity
non-repudiation
objective
organization
outsource
performance
policy
process
reliability
requirement
residual risk
review
review object
review objective
risk
risk acceptance
risk analysis
risk assessment
risk communication and consultation
risk criteria
risk evaluation
risk identification
risk management
risk management process
risk owner
risk treatment
security implementation standard
threat
top management
trusted information communication entity
vulnerability
Due to a change of policy within ISO, the forthcoming sixth edition of ISO/IEC 27000 (currently at FDIS stage) is expected to define just a dozen (12) terms i.e. the 10 orange ones from the fifth edition plus two additions - specified requirement and conformity assesment.
The remaining 67 terms from the fifth edition, plus various other terms introduced into ISO27k since 2018, are (presumably) all defined within the current or forthcoming editions of various ISO27k standards. I don't have the patience to list and count them all, but I believe the grand total would be less than 200 definitions, some of which are variants to suit the particular context of a given standard. Generally the variations modify the supplementary notes or make trivial changes to the definitions - no surprise, given that this is all about standardisation.
So, that's <200 formally-defined ISO27k terms.
Oh boy!
Tomorrow sees the release of the Cybersecurity Hyperglossary defining five thousand, five hundred and fifty-five terms of art in this area. Admittedly not all 5.555 terms are used in ISO27k, but even so I'm struck by the marked disparity here.
How can we possibly standardise such a highly technical and specialised field without defining our terms?
Comments