Terminology

Access control is how an organization decides who may reach an asset, and what they may do once they are there.

It covers identity, proof of that identity, and the limit on what a person or system may open, change, or remove.

A normal user, an administrator, and a vendor should not all receive the same access.

An advanced persistent threat, often shortened to APT, is a long and targeted attack.

The intruder gets in and tries to stay hidden for a long time.

These attacks are usually patient and well resourced. The useful response is to notice unusual activity early and to know who owns the next step.

Annex A is the reference set of information security controls included within ISO/IEC 27001.

The current ISO/IEC 27001:2022 standard contains 93 Annex A controls organized into four themes:

Organizational

People

Physical

Technological

Annex A provides organizations with a structured reference for considering controls that may be necessary to address information security risks.

An asset is something of value to the organization that needs to be considered when managing information security.

Assets can include information, software, systems, equipment, services, business processes, and other resources the organization depends upon.

Understanding what matters is an important step toward understanding what needs protection.

The attack surface is every place an unauthorized person might try to get in or take information out.

That includes accounts, software, devices, network openings, vendors, and the ways people can be tricked.

A smaller attack surface means fewer places to watch and fewer places to defend.

Audit ready does not mean perfect.

It means the organization understands its management system, knows where its evidence is, has clear ownership, can explain how its processes operate, and has visibility into open issues.

An audit ready organization does not begin preparing when the auditor schedules the meeting.

It operates in a way that makes readiness part of normal business.

Authentication is how a system checks that a user, device, or service is who it claims to be.

A password, a token, a certificate, or a biometric check can be part of that proof.

Authentication answers the question of identity. It does not, by itself, decide what that identity is allowed to do.

Authorization is the decision about what an authenticated user or system may do.

It sets which records they can open, which settings they can change, and which actions they can take.

A person can be authenticated and still be unauthorized for a particular system.

Awareness helps people understand their part in protecting information.

Training builds the skill to do a specific job.

Both belong in the program. A reminder is not a substitute for training the person who administers access, and a technical course is not a substitute for every employee knowing how to report something that looks wrong.

Backup and recovery is how an organization keeps copies of information and systems, and how it restores them after loss, damage, or disruption.

A copy that has never been restored is only a hope.

The useful question is whether the organization can get the important work running again in the time the business can accept.

A baseline assessment is a first look at where the organization stands.

It compares current practices with a chosen set of expectations, without committing the organization to certification.

The result should tell leadership what is already in place, what is missing, and whether a larger program is worth pursuing.

Business continuity is the ability to keep delivering products or services at an acceptable level after a disruption.

It includes knowing which activities matter most, who decides, and how work continues when a system, a site, or a supplier is unavailable.

Backup and recovery is one part of that capability. It is not the whole of it.

A certification audit is performed by an independent certification body to evaluate whether the organization's ISMS conforms to the requirements of ISO/IEC 27001.

Trygg can help an organization implement its management system and prepare for the audit.

The independent certification body determines whether certification should be granted.

That independence is important.

Change management is the formal way an organization controls changes to systems, infrastructure, and settings.

The point is to make a change on purpose, with someone accountable, and with a way to tell whether the change did what was intended.

An unrecorded change is a common way for a control to stop matching the story the organization tells about it.

A clause is a requirement in the main body of ISO/IEC 27001.

Clauses 4 through 10 cover how the management system is run:

Context of the organization

Leadership

Planning

Support

Operation

Performance evaluation

Improvement

Annex A is the separate catalog of controls an organization considers.

The clauses say how the management system must operate. Annex A is the reference list of safeguards.

A clear desk and clear screen practice keeps sensitive information protected when a workspace is unattended.

Paper is put away. A screen is locked or logged off.

The practice is simple. It matters because a lot of exposure happens in ordinary rooms, not in a technical attack.

CMMC is the Cybersecurity Maturity Model Certification used in parts of U.S. defense contracting.

It is its own program, with its own levels and its own assessment rules.

A company usually needs CMMC because a contract requires it.

An ISO/IEC 27001 certificate does not replace CMMC, and CMMC does not replace an information security management system.

Competence is the ability to apply knowledge and skill and reach the intended result.

People whose work affects information security need to be competent for that work.

Education, training, and experience can all be part of showing that. A course completion, by itself, is not the same thing as competence.

An ISMS is expected to improve over time.

Continual improvement means using information from risks, incidents, audits, performance, changing technology, business decisions, corrective actions, and other sources to make the management system more effective.

The objective is not perfection.

It is becoming better informed and better prepared over time.

A control is a safeguard used to modify or reduce information security risk.

Controls can involve technology, people, physical protections, policies, procedures, or other organizational practices.

Multifactor authentication can be a control.

Security awareness training can be a control.

Backups can be a control.

Vendor reviews can be a control.

Physical access restrictions can be controls.

Controls turn security expectations into action.

A control owner is the person accountable for making sure a control operates as expected.

The owner may rely on other employees, technology providers, managed service providers, or systems to perform parts of the control.

Ownership means someone remains accountable for the result.

In Trygg, applicable controls are connected to named leaders so responsibility remains visible.

Corrective action addresses the cause of a nonconformity or other identified problem.

Fixing the immediate problem may be necessary.

Corrective action goes further by asking:

Why did this happen?

and:

What should change so it does not happen again?

That distinction is important to continual improvement.

A critical vendor is a third party whose failure, compromise, or disruption could have a meaningful impact on the organization.

Criticality may be influenced by the services the vendor provides, the information it can access, the systems it supports, or the organization's dependency on it.

Not every vendor creates the same level of risk.

Identifying critical vendors helps focus attention where it matters most.

Cryptography uses encryption and related methods to protect information.

Encryption turns readable information into a form that stays protected until someone with the right key can read it.

The keys need the same care as the information. A strong method does little good if the keys are easy to copy or never changed.

Data loss prevention, often shortened to DLP, is the set of tools and practices that notice sensitive information leaving the organization when it should not.

It can watch information in use, moving across a network, or stored in a place it does not belong.

The tool is only useful if the organization has already decided which information is sensitive.

Digital forensics is the work of collecting and interpreting electronic information for an investigation.

The aim is to preserve what happened so the organization can understand an incident, support a legal need, or learn from the event.

A specialist usually does this work. The organization needs to know how to preserve the information until that person arrives.

A disciplinary process is the formal way an organization responds when a person breaks an information security rule.

The process should be known in advance, applied consistently, and fair.

Its purpose is to reinforce the policy, not to surprise someone with a rule they were never told.

The employment lifecycle is the security work that follows a person from before they join until after they leave.

That includes screening before hiring, the rules that apply during the job, and the access and equipment that must be removed when the person changes roles or leaves.

Most of the risk sits at the handoffs, when access is added or should have been taken away.

Encryption key management is how an organization creates, shares, stores, changes, and retires the keys that protect encrypted information.

A key that is lost can make the information unreadable to the organization itself.

A key that is copied or never changed can make the encryption much weaker than it looks.

An endpoint is a device that connects to or interacts with an organization's systems and information.

Laptops, desktops, servers, and certain mobile devices are common examples.

Endpoint security helps protect those devices and provides visibility into their security condition.

Equipment security is the protection of devices and other equipment from physical damage, environmental harm, unauthorized access, and theft.

It includes where equipment sits, how it is maintained, and how it is disposed of when it is no longer used.

A laptop in a car and a server in a closet are both equipment security questions.

Evidence demonstrates that something happened or that a control is operating.

Evidence can come from many sources.

A completed review.

A system configuration.

A training record.

A ticket.

A report.

A meeting record.

A security platform.

A backup result.

An identity system.

Evidence connects what the organization says it does with something demonstrating that it actually happened.

A policy, a screenshot, and a live report from a connected system are not the same kind of proof.

The evidence that stays current is the evidence leadership can still trust.

A finding is something identified during an audit or assessment that deserves to be documented.

Findings can represent conformity, nonconformity, or other observations depending on the type of assessment and terminology being used.

A finding should provide useful information about what was examined and what was discovered.

A gap analysis compares what a standard asks for with what the organization already does.

Where a practice already works, it should be kept.

Where something is missing, the gap should be named in plain language.

The useful result is a prioritized list of what needs to be created, improved, connected, or demonstrated.

This one is not an ISO term.

It is how Trygg talks about the value of an insight.

Hard savings are money.

Insurance, downtime, a lost deal, or a paid scramble before an audit.

Soft savings are staff time.

Hours spent chasing evidence, owners, or follow-up.

An insight can involve one of those, or both.

Hardening is the work of making a system safer by shrinking what it can do beyond the job it has.

That usually means turning off services that are not needed, removing software that is not used, and applying the security settings the organization has chosen.

A hardened system is easier to keep on its security baseline.

Identity and access management, often shortened to IAM, is the set of policies and tools that give the right people the right access at the right time.

It includes creating and removing accounts, checking identity, and deciding what each identity may do.

When someone changes roles, IAM is the place that should show the access they gained and the access they should have lost.

Incident management is how the organization handles a security incident: notice it, report it, respond, and learn from it.

The aim is to limit the harm and to reduce the chance that the same thing happens again.

A security incident is the event. Incident management is the process around that event.

Information classification is the way an organization groups information by how sensitive it is and how much the business depends on it.

The label should drive how the information is stored, shared, and disposed of.

A classification scheme that nobody uses is only a poster.

Information security is the protection of information from inappropriate access, use, alteration, loss, destruction, or disruption.

ISO/IEC 27001 commonly considers three fundamental characteristics of information:

Confidentiality

Information is accessible only to the people or systems authorized to access it.

Integrity

Information remains accurate, complete, and protected from unauthorized or inappropriate changes.

Availability

Information and systems are available when authorized users need them.

Together, these are often referred to as the CIA Triad.

Usually shortened to ISMS.

The ISMS is the management system an organization uses to manage information security.

It includes the people, responsibilities, policies, processes, risks, objectives, controls, evidence, reviews, decisions, and improvement activities that work together to protect information.

Trygg provides a working environment for bringing those pieces together.

The ISMS is not one document.

It is the system behind how your organization manages information security.

The Information Security Management Team, or ISMT, is the group of people helping oversee and operate the information security management system.

The exact structure will differ by organization.

The team may include representatives from executive leadership, technology, security, operations, human resources, legal, finance, or other areas depending on the organization and its needs.

Information security should not depend on one person.

The ISMT helps make it an organizational responsibility.

An information security objective defines something the organization intends to accomplish through its security program.

Objectives should be meaningful to the business and measurable where practical.

An objective might involve improving employee awareness, increasing security coverage, reducing risk, improving recovery capability, strengthening identity security, or achieving another result important to the organization.

Objectives help answer:

Is our security program accomplishing what we intended it to accomplish?

The information security policy is the direction top management sets for information security.

It states what the organization intends and gives the frame for the other policies, processes, and controls.

Other policies can sit under it. This is the one that says what the organization is committed to.

Interested parties are people or organizations whose needs and expectations may be relevant to the information security management system.

These might include customers, employees, owners, regulators, insurers, business partners, vendors, or other stakeholders.

Understanding interested parties helps the organization understand why particular security requirements matter.

An internal audit evaluates whether the management system conforms to applicable requirements and whether it is effectively implemented and maintained.

It provides an opportunity to identify weaknesses and improvement opportunities before an independent certification audit.

The objective is not to prove that nothing is wrong.

The objective is to find what needs attention and improve it.

Intrusion detection watches network traffic and system activity for signs of malicious behavior or a broken rule, and it raises an alert.

Intrusion prevention does that watching and can also block the activity.

The short names are IDS for detection and IPS for prevention. An alert still needs a person who knows what to do with it.

ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System.

It provides a structured way for organizations to understand information security risk, establish appropriate safeguards, assign responsibility, measure performance, and continually improve.

Organizations can use ISO/IEC 27001 whether or not they ultimately pursue certification.

Logging is the record of events on systems and networks. Monitoring is the review of those records, in the moment or on a schedule.

Together they help the organization notice unusual activity, investigate an incident, and show that a control was operating.

A log nobody looks at is storage. Monitoring is what turns the record into a signal.

Malware protection is the set of controls that prevent, detect, and remove malicious software.

That can include software on endpoints, filtering on email, and people who know what a suspicious message looks like.

The tool and the habit both matter. A warning that everyone clicks through is not protection.

Management review is the formal process through which leadership evaluates the information security management system.

Leadership considers information such as risks, objectives, audit results, performance, changes, corrective actions, and opportunities for improvement.

It is an important part of making sure the ISMS remains connected to the direction and priorities of the business.

Management review is where security becomes a leadership conversation.

Media handling is how the organization manages removable media from the time it is used until it is destroyed or securely wiped.

That includes where it is stored, how it is carried, and who may take information away on it.

A USB drive and a stack of backup tapes are both media. The risk is the information leaving a controlled place.

Usually shortened to MFA. It is also written as multi-factor authentication.

Multifactor authentication requires more than one form of verification before access is granted.

Rather than relying only on a password, MFA adds another layer of protection to help reduce the risk created by stolen or compromised credentials.

Network security is the protection of information as it moves across a network or is reached through one.

Firewalls, network separation, and monitoring are common parts of that protection.

The goal is that a person or system can reach what they are allowed to reach, and cannot freely wander everywhere else.

A nonconformity occurs when a requirement has not been fulfilled.

The purpose of identifying a nonconformity is not simply to document something that went wrong.

It creates an opportunity to understand the issue, determine why it happened, correct it, and reduce the likelihood that it will happen again.

During an audit, an auditor needs more than an explanation that something is being done.

Objective evidence provides information that can be examined to support that conclusion.

Trygg helps connect controls and processes to the evidence supporting them so the organization can demonstrate how its management system operates.

A penetration test is an authorized attempt to find weaknesses by trying to get into systems the way an attacker would.

A specialist does the test. The organization uses the result to see which weaknesses matter and what to fix.

The test is planned and permitted. It is a controlled exercise, and the findings belong in the security program.

Physical access control is how an organization decides who may enter a building, a room, or another secure area.

Locks, badges, biometrics, and a visitor process are common parts of it.

It is the physical counterpart to access control on a system. Both ask who is allowed in.

A physical security perimeter is the boundary around a place the organization intends to protect.

Walls, doors, fences, and controlled entries can all be part of that boundary.

Some sites use more than one boundary, so a person who passes the front door still cannot walk into the room where sensitive work happens.

A policy establishes the organization's expectations and direction.

Policies describe what the organization expects to happen and provide guidance for the people responsible for making it happen.

Good policies should reflect the organization they govern.

A policy that looks impressive but does not reflect how the company actually operates creates little value.

Privilege escalation is an attack technique. Someone who already has a little access uses a weakness to gain more.

That can mean taking on administrator rights, or moving into another person's account with the same level of access.

Privileged access is the elevated access an organization grants on purpose. Privilege escalation is access an attacker takes without that grant.

Privileged access provides elevated capabilities beyond those available to a normal user.

Administrators and other privileged users may be able to change configurations, create accounts, access sensitive information, install software, or perform other powerful actions.

Because these accounts can have significant impact, they typically require additional protection and oversight.

A process describes how the organization performs an activity.

A policy might say access must be removed when an employee leaves.

The process explains who initiates the request, who removes the access, which systems are reviewed, when the work must occur, and how completion is demonstrated.

Processes turn expectations into repeatable action.

ISO/IEC 27001 certificates are issued for a limited period.

Recertification is the fuller audit at the end of that period, when the certification body decides whether the certificate should continue.

Surveillance audits are the scheduled checks between those points.

The organization's own internal audit is a separate review.

In this exercise, a red team plays the attacker and a blue team defends.

The practice tests whether the organization can detect the activity and follow its response steps.

The value is the learning. The exercise should be authorized, scoped, and followed by a clear record of what was found.

Controls may reduce risk, but they rarely eliminate it completely.

Residual risk is the risk that remains after controls and other treatment activities have been considered.

Leadership may determine that the remaining risk is acceptable or decide that additional action is needed.

Risk represents uncertainty that could affect what the organization is trying to protect or accomplish.

In information security, risk commonly considers a potential event or condition, the likelihood of it occurring, and the impact it could have on the organization.

Trygg uses risk to help connect security decisions to business priorities.

The question is not simply:

What could go wrong?

It is also:

How much does it matter, and what are we going to do about it?

A risk assessment is how the organization finds risks, looks at how likely they are and how much they would matter, and decides which ones need attention.

The result should be understandable to leadership, not only to a security specialist.

What the organization then chooses to do about a risk is risk treatment.

A risk owner is the person accountable for making sure a particular risk is appropriately understood and managed.

The risk owner does not necessarily perform every action associated with the risk.

They are responsible for making sure the risk receives appropriate attention and that decisions about it are made.

The risk register is the organization's working record of identified risks.

It provides a place to understand the risk, evaluate it, assign ownership, document decisions, track actions, and monitor what happens over time.

A useful risk register is not something created once and filed away.

It should help leadership understand where attention may be needed.

Risk treatment is what the organization decides to do about an identified risk.

That may involve reducing the risk through additional controls, avoiding the activity creating the risk, transferring some of the risk through mechanisms such as insurance, or accepting the remaining risk when leadership determines it is appropriate to do so.

The important part is that the decision is intentional, understood, and appropriately authorized.

Scope defines the boundaries of the management system.

It establishes which parts of the organization, locations, technologies, services, people, and business activities are included.

Clear scope is important because you cannot effectively manage a security program without understanding what it is intended to protect.

A simple way to think about scope is:

What are we protecting, and where are the boundaries?

A secure area is a place where sensitive information is handled or stored, with entry limited to the people who need to be there.

The limit can be a locked room, a badge reader, or a staffed desk. The point is that entry is a decision, not an open door.

Security architecture is the picture of how security processes, systems, and controls fit together.

It connects what the business needs to protect with the technical and organizational choices that do the protecting.

Without that picture, each control can be reasonable on its own and still leave a gap between them.

A security baseline is the minimum configuration a system is expected to meet.

It sets a consistent starting point, such as which services stay on, which settings are required, and which software is allowed.

A baseline assessment is a different idea. That is a first look at the whole program. A security baseline is a configuration standard for systems.

A security incident is an event or series of events that compromises or could compromise information security and requires a response.

Examples might involve unauthorized access, malware, information disclosure, compromised credentials, loss of equipment, or disruption of important systems.

An effective management system helps the organization prepare before an incident happens and learn after one occurs.

Security information and event management, often shortened to SIEM, collects log data from across the organization and helps people analyze security alerts.

It can support a live look at what is happening and a later look at what already happened.

The tool is valuable when someone is responsible for the alerts and the organization knows which events matter.

A security operations center is the team, and the tools that team uses, to watch for security events and respond to them.

People often shorten the name to SOC.

SOC 2 is a different thing. That name belongs to an assurance report, and it has its own entry on this page.

Security orchestration and automation connects security tools and handles repetitive response steps so a person does not have to do the same clicks every time.

The short name some teams use is SOAR.

Automation helps when the step is already understood. It does not replace the decision about what the organization is trying to protect.

Segregation of duties separates jobs that would be dangerous for one person to hold alone.

The person who requests a change, the person who approves it, and the person who makes it should not always be the same person.

The split reduces the chance of a mistake or a misuse going unnoticed.

SOC 2 is an assurance report.

Service companies often use it to describe controls related to security and, when they choose to, availability, processing integrity, confidentiality, and privacy.

It is a different kind of proof from an ISO/IEC 27001 certificate.

Some customers ask for SOC 2. Some ask for ISO/IEC 27001. Some ask for both.

Social engineering is a trick that pushes a person to make a security mistake or to give up information.

The attacker uses trust, urgency, or habit. The weakness is the conversation, not a flaw in the software.

Phishing is a common form. The protection is a habit of pausing, plus a clear way to report the attempt.

Stage 1 is generally the first part of the initial certification audit.

It focuses on understanding the organization and evaluating whether the management system is sufficiently developed and prepared to proceed to the next stage of certification assessment.

Think of it as an evaluation of whether the foundation is ready for deeper examination.

Stage 2 is the more detailed portion of the initial certification audit.

The auditor evaluates the implementation and operation of the management system and examines evidence supporting conformity with the requirements.

This is where policies, processes, responsibilities, controls, evidence, and the people performing the work come together.

Usually shortened to SoA.

The Statement of Applicability connects the organization's risk decisions to the controls it has determined are necessary.

It identifies the Annex A controls, whether they are applicable, and provides the organization's justification for inclusion or exclusion.

The Statement of Applicability is one of the most important documents within an ISO/IEC 27001 management system because it helps explain the control environment the organization has chosen to operate.

Supplier relationships are the way an organization chooses, reviews, and oversees outside parties that can affect its information.

That includes vendors that hold data, run systems, or provide a service the business depends on.

A critical vendor is one whose failure or compromise would matter a great deal. The relationship still needs an owner even when the vendor is not critical.

After certification, the certification body returns on a set schedule to check that the management system is still operating.

That visit is a surveillance audit.

It is a narrower look than the first certification audit, and a different review from the internal audit the organization runs itself.

When the certificate comes up for renewal, the fuller review is recertification.

A third party is an outside organization or individual that interacts with or provides services to your organization.

Vendors, cloud providers, contractors, consultants, technology providers, and other business partners can all be third parties.

Because organizations increasingly depend on outside providers, understanding third party risk is an important part of information security.

A threat is something capable of causing harm.

Cybercriminals, malicious software, human error, natural events, insiders, and other circumstances can create threats to information and systems.

Risk develops from understanding how threats, vulnerabilities, business impact, and existing controls relate to one another.

Threat intelligence is knowledge about threats that already exist or are starting to appear.

Useful intelligence says what the threat is, how it works, and what it could mean for this organization.

A list of threats with no tie to the business is just a list. The value is using it to decide what to watch and what to change.

Top management is the person or group that directs the organization at the highest level.

In an ISMS, top management is accountable for the program. That includes setting direction, providing what the program needs, and checking that it still fits the business.

This one is not an ISO term.

It is important to us anyway.

A trusted advisor understands where their expertise adds value and where someone else may be better qualified to help.

They ask questions before offering answers.

They tell you when something needs attention.

They tell you when something does not.

They care about the relationship beyond the immediate project or transaction.

That is the role we want Trygg to earn with every client.

A vulnerability is a weakness that could potentially be exploited.

Vulnerabilities can exist in software, configurations, processes, systems, or other parts of the environment.

Identifying a vulnerability does not automatically mean an attack has occurred.

It means the organization has discovered something that may require evaluation and action.

Vulnerability management is the ongoing work of finding weaknesses, deciding which ones matter, and fixing them.

A vulnerability is the weakness. Vulnerability management is the process that keeps looking for those weaknesses and tracking what was done about them.

The order matters. A weakness on a system the business depends on comes ahead of a weakness on a system nobody uses.

Zero trust is a security approach that does not assume a person or device is safe because it is already on the network.

Every request is checked. Identity, device, and the sensitivity of the resource all matter, whether the person is in the office or somewhere else.

The name describes the approach. It still needs the access, monitoring, and ownership that make the checks real.