^ Up a level ^      Next standard >

ISO/IEC 27000:2018 — Information technology — Security techniques — Information security management systems — Overview and vocabulary (fifth edition)

Abstract

“This document describes the overview and the vocabulary of information security management systems, which form the subject of the ISMS family of standards.”

[Source: ISO/IEC JTC 1/SC 27 SD11 July 2024]

Introduction and scope

ISO/IEC 27000 “provides an overview of information security management systems” (and hence the ISO27k standards), and “defines related terms” (i.e. a glossary that formally and explicitly defines many of the specialist terms as they are used and should be interpreted within the ISO27k standards).

ISMS/ISO27k vocabulary section

The vocabulary or glossary of carefully-worded formal definitions covers many of the specialist information security-related terms used in the ISO27k standards. Information security, like most technical subjects, uses a complex web of terminology that continues to evolve. Several core terms in information security (such as “risk” and “cyber”) have different meanings or interpretations according to the context, the author’s intention and the reader’s preconceptions. Few authors take the trouble to define precisely what they mean but such ambiguity is distinctly unhelpful in the standards arena as it leads to confusion. Apart from anything else, it would be awkward to assess and certify conformity with ISO/IEC 27001 if the specialist terms meant different things to the assessors and the assessed!

The vocabulary in ISO/IEC 27000 is applicable throughout the global information security profession although some individuals and groups differ, sometimes with good reason, creating occasional misunderstandings, clashes, and conceptual chasms. Even if you happen to disagree with the definitions here, it is worth becoming familiar with them as some of your professional contacts will implicitly expect the ISO/IEC versions.

ISO/IEC 27000 largely supersedes ISO/IEC Guide 2:1996 “Standardization and related activities – General vocabulary”, ISO Guide 73:2009 “Risk management – Vocabulary – Guidelines for use in standards”, and ISO/IEC 2382-8: “Information technology - Vocabulary Part 8: Security”. It also includes definitions taken from a few non-ISO27k ISO standards. Terms that are reproduced unchanged from other ISO standards such as ISO 9000 are not always entirely appropriate as such in the information security context. They are not necessarily used in the ISO27k standards in full accordance with the original definitions or intended meanings. However, as the definitions are gradually updated or superseded, the lexicon is evolving into a reasonably coherent and consistent state across the whole ISO27k suite - a remarkable achievement in its own right given the practical difficulties of coordinating the effort across a loose collection of separate committees, editing projects, editors and managers, developing the language and concepts as we go.

ISMS/ISO27k overview section

The overview of Information Security Management Systems introduces information security, risk and security management, and management systems. It is a reasonably clear if rather wordy description of the ISO27k approach and standards, from the perspective of the committee that wrote them. There is only one diagram, unfortunately, and all that does is group similar types of ISO27k standards together, but, hey, that leaves room for supplementary guidance ... such as this website!

Status of the standard

ISO/IEC 27000 was first published in 2009 and updated in 2012, 2014, 2016 and 2018.

The current 2018 fifth edition is available legitimately from ITTF as a free download (a single-user PDF) in English and French. This was a minor revision of the 2016 fourth edition with a section on abbreviations, and a rationalisation of the metrics-related definitions following the 2016 rewrite of ISO/IEC 27004.

The sixth edition of ‘27000 is a work-in-progress. The title may become “Information security, cybersecurity and privacy protection - the information security management systems - Overview”. In accordance with ISO directives, the current edition’s vocabulary will be moved to an annex  containing a “definition and explanation of commonly used terms in the ISO/IEC 27000 family of standards” - more specifically, the glossary will apply to ISO27k standards belonging to ISO/IEC JTC 1/SC 27/WG 1 (27001 to 27011, 27013, 27014, 27016, 27017, 27019, 27021 to 27024, 27028 and 27029). Terms will be grouped conceptually in the annex rather than alphabetically. However, specialist terms used in ISO/IEC 27000 are to be defined in clause 3 as usual.

 Publication of the sixth edition is anticipated by 2026. It is currently at Committee Draft stage.

Personal comments

A new clause 4 “Concepts and principles” in the sixth edition is intended to clarify the fundamentals underpinning information risk and security management.

Given the chance, I would replace “information security risk” throughout the ISO27k standards with the shorter, simpler and more appropriate term “information risk”.

“Information security risk” is not formally defined as a complete phrase and doesn’t even make sense: it is presumably trying to indicate that we are talking about risk in the context of information security, but it could be interpreted as “risk to information security” which I guess would including things such as failing to identify novel risks, and lack of management support for the function: those are risks, but they are not the focus of ISO27k.

“Information risk”, in contrast, is self-evident but, if the committee feels the desperate need for an explicit definition, I suggest something as simple as “risk relating to or involving information” or even “risk pertaining to information”, where both risk and information are adequately defined in dictionaries (whereas the current ISO27k definition of risk is unhelpful).

 Thus far, I have failed to persuade the committee to accept this terminological change, which admittedly would ripple through most of the ISO27k standards. However, clause 4.2.3 is likely to include these two paragraphs concerning information:

“Information is an asset that, like other important business assets, is essential to an organization’s business and, consequently, needs to be suitably protected. It does not matter whether the information is owned by the organization or is entrusted to its care by a third party, e.g., a customer.

Information can be stored in many forms, including digital form (e.g. data files stored on electronic or optical media), material form (e.g. on paper), as well as information in the form of knowledge. Information can be transmitted by various means including courier, electronic or verbal communication. Whatever form information takes, or how it is transmitted, it always needs appropriate protection.”

Those paragraphs partially counteract the general bias towards information technology although many users of the ISO27k standards do not appear to notice or care. While clearly it is true that IT and OT security controls play a very large part in protecting information, technology alone will never completely replace the need for humans to protect information as well, including the use of physical and organizational controls (such as policies, contracts and assurance measures).
 

^ Up a level ^      Next standard >