ISO/IEC 27000:2016
(Main)Information technology — Security techniques — Information security management systems — Overview and vocabulary
Information technology — Security techniques — Information security management systems — Overview and vocabulary
ISO/IEC 27000:2016 the overview of information security management systems, and terms and definitions commonly used in the ISMS family of standards. This International Standard is applicable to all types and sizes of organization (e.g. commercial enterprises, government agencies, not-for-profit organizations).
Technologies de l'information — Techniques de sécurité — Systèmes de gestion de sécurité de l'information — Vue d'ensemble et vocabulaire
ISO/IEC 27000:2016 offre une vue d'ensemble des systèmes de management de la sécurité de l'information, ainsi que des termes et définitions d'usage courant dans la famille de normes du SMSI. La présente Norme internationale est applicable à tous les types et à toutes les tailles d'organismes (par exemple: les entreprises commerciales, les organismes publics, les organismes à but non lucratif).
General Information
Relations
Buy Standard
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 27000
Redline version
compares Fourth edition to
Third edition
Information technology — Security
techniques — Information security
management systems — Overview
and vocabulary
Technologies de l’information — Techniques de sécurité — Systèmes de
gestion de sécurité de l’information — Vue d’ensemble et vocabulaire
Reference number
ISO/IEC 27000:redline:2016(E)
©
ISO/IEC 2016
---------------------- Page: 1 ----------------------
ISO/IEC 27000:redline:2016(E)
IMPORTANT — PLEASE NOTE
This is a mark-up copy and uses the following colour coding:
Text example 1 — indicates added text (in green)
— indicates removed text (in red)
Text example 2
— indicates added graphic figure
— indicates removed graphic figure
1.x . — Heading numbers containg modifications are highlighted in yellow in
the Table of Contents
All changes in this document have yet to reach concensus by vote and as such should only
be used internally for review purposes.
DISCLAIMER
This Redline version provides you with a quick and easy way to compare the main changes
between this edition of the standard and its previous edition. It doesn’t capture all single
changes such as punctuation but highlights the modifications providing customers with
the most valuable information. Therefore it is important to note that this Redline version is
not the official ISO standard and that the users must consult with the clean version of the
standard, which is the official standard, for implementation purposes.
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2016 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 27000:redline:2016(E)
Contents Page
Foreword .v
0 Introduction .vi
1 Scope . 1
2 Terms and definitions . 1
3 Information security management systems .12
3.1 Introduction General .12
3.2 What is an ISMS? .13
3.2.1 Overview and principles .13
3.2.2 Information.13
3.2.3 Information security .14
3.2.4 Management .14
3.2.5 Management system .14
3.3 Process approach .14
3.4 Why an ISMS is important .15
3.5 Establishing, monitoring, maintaining and improving an ISMS .16
3.5.1 Overview .16
3.5.2 Identifying information security requirements .16
3.5.3 Assessing information security risks .16
3.5.4 Treating information security risks . .17
3.5.5 Selecting and implementing controls .17
3.5.6 Monitor, maintain and improve the effectiveness of the ISMS .18
3.5.7 Continual improvement .18
3.6 ISMS critical success factors .18
3.7 Benefits of the ISMS family of standards .19
4 ISMS family of standards .19
4.1 General information .19
4.2 Standards describing an overview and terminology .21
4.2.1 ISO/IEC 27000 (this document International Standard) .21
4.3 Standards specifying requirements .21
4.3.1 ISO/IEC 27001 .21
4.3.2 ISO/IEC 27006 .21
4.4 Standards describing general guidelines .22
4.4.1 ISO/IEC 27002 .22
4.4.2 ISO/IEC 27003 .22
4.4.3 ISO/IEC 27004 .22
4.4.4 ISO/IEC 27005 .22
4.4.5 ISO/IEC 27007 .22
4.4.6 ISO/IEC TR 27008 .23
4.4.7 ISO/IEC 27013 .23
4.4.8 ISO/IEC 27014 .23
4.4.9 ISO/IEC TR 27016 .23
4.5 Standards describing sector-specific guidelines .24
4.5.1 ISO/IEC 27010 .24
4.5.2 ISO/IEC 27011 .24
4.5.3 ISO/IEC TR 27015 .24
4.5.4 ISO/IEC 27017 .25
4.5.5 ISO/IEC 27018 .25
4.5.6 ISO/IEC TR 27019 .25
4.5.4 4.5.7 ISO 27799 .26
Annex A (informative) Verbal forms for the expression of provisions.27
© ISO/IEC 2016 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 27000:redline:2016(E)
Annex B (informative) Term and term ownership .28
Bibliography .32
iv © ISO/IEC 2016 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 27000:redline:2016(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
International Standards areThe procedures used to develop this document and those intended for its
further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval
criteria needed for the different types of document should be noted. This document was drafted
in accordance with the rules given ineditorial rules of the ISO/IEC Directives, Part 2 (see www.iso.
org/directives).
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies
casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
Details of any patent rights identified during the development of the document will be in the Introduction
and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical Barriers
to Trade (TBT) see the following URL: Foreword - Supplementary information
ISO/IEC 27000 was prepared by Joint Technical CommitteeThe committee responsible for this document
is ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT Security techniques.
This thirdfourth edition cancels and replaces the secondthird edition (ISO/IEC 27000:20122014), which
has been technically revised.
© ISO/IEC 2016 – All rights reserved v
---------------------- Page: 5 ----------------------
ISO/IEC 27000:redline:2016(E)
0 Introduction
0.1 Overview
International Standards for management systems provide a model to follow in setting up and operating
a management system. This model incorporates the features on which experts in the field have reached a
consensus as being the international state of the art. ISO/IEC JTC 1/SC 27 maintains an expert committee
dedicated to the development of international management systems standards for information security,
otherwise known as the Information Security Management System (ISMS) family of standards.
Through the use of the ISMS family of standards, organizations can develop and implement a framework
for managing the security of their information assets including financial information, intellectual
property, and employee details, or information entrusted to them by customers or third parties. These
standards can also be used to prepare for an independent assessment of their ISMS applied to the
protection of information.
0.2 ISMS family of standards
The ISMS family of standards (see Clause 4) is intended to assist organizations of all types and sizes to
implement and operate an ISMS and consists of the following International Standards, under the general
title Information technology — Security techniques (given below in numerical order):
— ISO/IEC 27000, Information security management systems — Overview and vocabulary
— ISO/IEC 27001, Information security management systems — Requirements
— ISO/IEC 27002, Code of practice for information security controls
— ISO/IEC 27003, Information security management system implementation guidance
— ISO/IEC 27004, Information security management — Measurement
— ISO/IEC 27005, Information security risk management
— ISO/IEC 27006, Requirements for bodies providing audit and certification of information security
management systems
— ISO/IEC 27007, Guidelines for information security management systems auditing
— ISO/IEC TR 27008, Guidelines for auditors on information security controls
— ISO/IEC 27009, Sector-specific application of ISO/IEC 27001 — Requirements
— ISO/IEC 27010, Information security management for inter-sector and inter-organizational
communications
— ISO/IEC 27011, Information security management guidelines for telecommunications organizations
based on ISO/IEC 27002
— ISO/IEC 27013, Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1
— ISO/IEC 27014, Governance of information security
— ISO/IEC TR 27015, Information security management guidelines for financial services
— ISO/IEC TR 27016, Information security management — Organizational economics
— ISO/IEC 27017, Code of practice for information security controls based on ISO/IEC 27002 for cloud services
— ISO/IEC 27018, Code of practice for protection of personally identifiable information (PII) in public
clouds acting as PII processors
vi © ISO/IEC 2016 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC 27000:redline:2016(E)
— ISO/IEC 27019, Information security management guidelines based on ISO/IEC 27002 for process
control systems specific to the energy utility industry
NOTE The general title “Information technology — Security techniques” indicates that these
standardsInternational Standards were prepared by Joint Technical Committee ISO/IEC JTC 1, Information
technology, Subcommittee SC 27, IT Security techniques.
International Standards not under the same general title that are also part of the ISMS family of standards
are as follows:
— ISO 27799:2008, Health informatics — Information security management in health using ISO/IEC 27002
0.3 Purpose of this International Standard
This International Standard provides an overview of information security management systems and
defines related terms.
NOTE Annex A provides clarification on how verbal forms are used to express requirements and/or guidance
in the ISMS family of standards.
The ISMS family of standards includes standards that:
a) define requirements for an ISMS and for those certifying such systems;,
b) provide direct support, detailed guidance and/or interpretation for the overall process to establish,
implement, maintain, and improve an ISMS;,
c) address sector-specific guidelines for ISMS;, and
d) address conformity assessment for ISMS.
The terms and definitions provided in this International Standard:
— cover commonly used terms and definitions in the ISMS family of standards;,
— do not cover all terms and definitions applied within the ISMS family of standards;, and
— do not limit the ISMS family of standards in defining new terms for use.
© ISO/IEC 2016 – All rights reserved vii
---------------------- Page: 7 ----------------------
INTERNATIONAL STANDARD ISO/IEC 27000:redline:2016(E)
Information technology — Security techniques —
Information security management systems — Overview
and vocabulary
1 Scope
This International Standard provides the overview of information security management systems, and
terms and definitions commonly used in the ISMS family of standards. This International Standard is
applicable to all types and sizes of organization (e.g. commercial enterprises, government agencies, not-
for-profit organizations).
2 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
2.1
access control
means to ensure that access to assets is authorized and restricted based on business and security
requirements requirements (2.63)
2.2
analytical model
algorithm or calculation combining one or more base measures (2.10) and/or derived measures (2.22)
with associated decision criteria decision criteria (2.21)
2.3
attack
attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized
use of an asset
2.4
attribute
property or characteristic of an object (2.55) that can be distinguished quantitatively or qualitatively
by human or automated means
[SOURCE: ISO/IEC 15939:2007, modified – “entity” 2.2, modified — “entity” has been replaced by
“object” “object” in the definition.]
2.5
audit
systematic, independent and documented process (2.61) for obtaining audit evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),
and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011 ISO 19011.
2.6
audit scope
extent and boundaries of an audit (2.5)
[SOURCE: ISO 19011:2011, 3.14, modified — Note 1 to entry has been deleted.]
© ISO/IEC 2016 – All rights reserved 1
---------------------- Page: 8 ----------------------
ISO/IEC 27000:redline:2016(E)
2.7
authentication
provision of assurance that a claimed characteristic of an entity is correct
2.8
authenticity
property that an entity is what it is claims to be
2.9
availability
property of being accessible and usable upon demand by an authorized entity
2.10
base measure
measure (2.47) defined in terms of an attribute (2.4) and the method for quantifying it
[SOURCE: ISO/IEC 15939:2007, 2.3, modified — Note 2 to entry has been deleted.]
Note 1 to entry: A base measure is functionally independent of other measures measures (2.47).
2.11
competence
ability to apply knowledge and skills to achieve intended results
2.12
confidentiality
property that information is not made available or disclosed to unauthorized individuals, entities, or
processes (2.61)
2.13
conformity
fulfilment of a requirement (2.63)
Note 1 to entry: The term “conformance” is synonymous but deprecated.
2.14
consequence
outcome of an event (2.25) affecting objectives (2.56)
[SOURCE: ISO Guide 73:2009, 3.6.1.3, modified]
Note 1 to entry: An event event (2.25) can lead to a range of consequences.
Note 2 to entry: A consequence can be certain or uncertain and in the context of information security information
security (2.33) is usually negative.
Note 3 to entry: Consequences can be expressed qualitatively or quantitatively.
Note 4 to entry: Initial consequences can escalate through knock-on effects.
2.15
continual improvement
recurring activity to enhance performance (2.59)
2.16
control
measure that is modifying risk (2.68)
[SOURCE: ISO Guide 73:2009, 3.8.1.1]
Note 1 to entry: Controls include any process process (2.61), policy policy (2.60), device, practice, or other actions
which modify risk risk (2.68).
2 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/IEC 27000:redline:2016(E)
Note 2 to entry: Controls may not always exert the intended or assumed modifying effect.
2.17
control objective
statement describing what is to be achieved as a result of implementing controls (2.16)
2.18
correction
action to eliminate a detected nonconformity (2.53)
2.19
corrective action
action to eliminate the cause of a nonconformity (2.53) and to prevent recurrence
2.20
data
collection of values assigned to base measures (2.10), derived measures (2.22) and/or indicators (2.30)
[SOURCE: ISO/IEC 15939:2007, 2.4, modified — Note 1 to entry has been added.]
Note 1 to entry: This definition applies only within the context of ISO/IEC 27004:2009 ISO/IEC 27004.
2.21
decision criteria
thresholds, targets, or patterns used to determine the need for action or further investigation, or to
describe the level of confidence in a given result
[SOURCE: ISO/IEC 15939:2007, 2.7]
2.22
derived measure
measure (2.47) that is defined as a function of two or more values of base measures (2.10)
[SOURCE: ISO/IEC 15939:2007, 2.8, modified — Note 1 to entry has been deleted.]
2.23
documented information
information required to be controlled and maintained by an organization (2.57) and the medium on
which it is contained
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to
— the management system (2.46), including related processes (2.61);
— information created in order for the organizationorganization (2.57) to operate (documentation);
— evidence of results achieved (records).
2.24
effectiveness
extent to which planned activities are realized and planned results achieved
2.25
event
occurrence or change of a particular set of circumstances
[SOURCE: ISO Guide 73:2009, 3.5.1.3, modified — Note 4 to entry has been deleted.]
Note 1 to entry: An event can be one or more occurrences, and can have several causes.
Note 2 to entry: An event can consist of something not happening.
© ISO/IEC 2016 – All rights reserved 3
---------------------- Page: 10 ----------------------
ISO/IEC 27000:redline:2016(E)
Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”.
2.26
executive management
person or group of people who have delegated responsibility from the governing body (2.29) for
implementation of strategies and policies to accomplish the purpose of the organization (2.57)
Note 1 to entry: Executive management is sometimes called top management top management (2.84) and can
include Chief Executive Officers, Chief Financial Officers, Chief Information Officers, and similar roles.
2.27
external context
external environment in which the organization seeks to achieve its objectives objectives (2.56)
[SOURCE: ISO Guide 73:2009, 3.3.1.1]
Note 1 to entry: External context can include the following:
— the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive
environment, whether international, national, regional or local;
— key drivers and trends having impact on the objectives (2.56) of the organization (2.57); and
— relationships with, and perceptions and values of, external stakeholders (2.82).
2.28
governance of information security
system by which an organization’s (2.57)information security (2.33) information security activities are
directed and controlled
2.29
governing body
person or group of people who are accountable for the performance (2.59) and conformance of the
organization (2.57)
Note 1 to entry: Governing body can in some jurisdictions be a board of directors.
2.30
indicator
measure (2.47) that provides an estimate or evaluation of specified attributes (2.4) derived from an
analytical model (2.2) with respect to defined information needs (2.31)
2.31
information need
insight necessary to manage objectives objectives (2.56), goals, risks and problems
[SOURCE: ISO/IEC 15939:2007, 2.12]
2.32
information processing facilities
any information processing system, service or infrastructure, or the physical location housing it
2.33
information security
preservation of confidentiality (2.12), integrity (2.40) and availability (2.9) of information
Note 1 to entry: In addition, other properties, such as authenticity (2.8), accountability, non-repudiation (2.54),
and reliability (2.62) can also be involved.
2.34
information security continuity
processes (2.61) and procedures for ensuring continued information security (2.33) operations
4 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 11 ----------------------
ISO/IEC 27000:redline:2016(E)
2.35
information security event
identified occurrence of a system, service or network state indicating a possible breach of information
security policy (2.33) policy (2.60) or failure of controls controls (2.16), or a previously unknown
situation that may be security relevant
2.36
information security incident
single or a series of unwanted or unexpected information security events (2.35) that have a significant
probability of compromising business operations and threatening information security (2.33)
2.37
information security incident management
processes (2.61) for detecting, reporting, assessing, responding to, dealing with, and learning from
information security incidents (2.36)
2.38
information sharing community
group of organizations organizations (2.57) that agree to share information
Note 1 to entry: An organization organization (2.57) can be an individual.
2.39
information system
applications, services, information technology assets, or other information handling components
2.40
integrity
property of accuracy and completeness
2.41
interested party
person or organization (2.57) that can affect, be affected by, or perceive themselves to be affected by a
decision or activity
2.42
internal context
internal environment in which the organization organization (2.57) seeks to achieve its objectives
[SOURCE: ISO Guide 73:2009, 3.3.1.2]
Note 1 to entry: Internal context can include the following:
— governance, organizational structure, roles and accountabilities;
— policiespolicies (2.60), objectivesobjectives (2.56), and the strategies that are in place to achieve them;
— the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processesprocesses
(2.61), systems and technologies);
— information systemsinformation systems (2.39), information flows and decision-making processesprocesses
(2.61) (both formal and informal);
— relationships with, and perceptions and values of, internal stakeholdersstakeholders (2.82);
— the organization’sorganization’s (2.57) culture;
— standards, guidelines and models adopted by the organizationorganization (2.57); and
—
...
INTERNATIONAL ISO/IEC
STANDARD 27000
Fourth edition
2016-02-15
Information technology — Security
techniques — Information security
management systems — Overview
and vocabulary
Technologies de l’information — Techniques de sécurité — Systèmes de
gestion de sécurité de l’information — Vue d’ensemble et vocabulaire
Reference number
ISO/IEC 27000:2016(E)
©
ISO/IEC 2016
---------------------- Page: 1 ----------------------
ISO/IEC 27000:2016(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2016, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2016 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 27000:2016(E)
Contents Page
Foreword .v
0 Introduction . 1
0.1 Overview . 1
0.2 ISMS family of standards . 1
0.3 Purpose of this International Standard . 2
1 Scope . 2
2 Terms and definitions . 2
3 Information security management systems .14
3.1 General .14
3.2 What is an ISMS? .14
3.2.1 Overview and principles .14
3.2.2 Information.15
3.2.3 Information security .15
3.2.4 Management .15
3.2.5 Management system .16
3.3 Process approach .16
3.4 Why an ISMS is important .16
3.5 Establishing, monitoring, maintaining and improving an ISMS .17
3.5.1 Overview .17
3.5.2 Identifying information security requirements .17
3.5.3 Assessing information security risks .18
3.5.4 Treating information security risks . .18
3.5.5 Selecting and implementing controls .18
3.5.6 Monitor, maintain and improve the effectiveness of the ISMS .19
3.5.7 Continual improvement .19
3.6 ISMS critical success factors .20
3.7 Benefits of the ISMS family of standards .20
4 ISMS family of standards .21
4.1 General information .21
4.2 Standards describing an overview and terminology .22
4.2.1 ISO/IEC 27000 (this International Standard) .22
4.3 Standards specifying requirements .22
4.3.1 ISO/IEC 27001 .22
4.3.2 ISO/IEC 27006 .22
4.4 Standards describing general guidelines .22
4.4.1 ISO/IEC 27002 .22
4.4.2 ISO/IEC 27003 .23
4.4.3 ISO/IEC 27004 .23
4.4.4 ISO/IEC 27005 .23
4.4.5 ISO/IEC 27007 .23
4.4.6 ISO/IEC TR 27008 .23
4.4.7 ISO/IEC 27013 .24
4.4.8 ISO/IEC 27014 .24
4.4.9 ISO/IEC TR 27016 .24
4.5 Standards describing sector-specific guidelines .25
4.5.1 ISO/IEC 27010 .25
4.5.2 ISO/IEC 27011 .25
4.5.3 ISO/IEC TR 27015 .25
4.5.4 ISO/IEC 27017 .25
4.5.5 ISO/IEC 27018 .26
4.5.6 ISO/IEC TR 27019 .26
4.5.7 ISO 27799 .26
© ISO/IEC 2016 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 27000:2016(E)
Annex A (informative) Verbal forms for the expression of provisions.28
Annex B (informative) Term and term ownership .29
Bibliography .33
iv © ISO/IEC 2016 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 27000:2016(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical
Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information
The committee responsible for this document is ISO/IEC JTC 1, Information technology, SC 27, IT
Security techniques.
This fourth edition cancels and replaces the third edition (ISO/IEC 27000:2014), which has been
technically revised.
© ISO/IEC 2016 – All rights reserved v
---------------------- Page: 5 ----------------------
INTERNATIONAL STANDARD ISO/IEC 27000:2016(E)
Information technology — Security techniques —
Information security management systems — Overview
and vocabulary
0 Introduction
0.1 Overview
International Standards for management systems provide a model to follow in setting up and
operating a management system. This model incorporates the features on which experts in the field
have reached a consensus as being the international state of the art. ISO/IEC JTC 1/SC 27 maintains an
expert committee dedicated to the development of international management systems standards for
information security, otherwise known as the Information Security Management System (ISMS) family
of standards.
Through the use of the ISMS family of standards, organizations can develop and implement a framework
for managing the security of their information assets including financial information, intellectual
property, and employee details, or information entrusted to them by customers or third parties. These
standards can also be used to prepare for an independent assessment of their ISMS applied to the
protection of information.
0.2 ISMS family of standards
The ISMS family of standards (see Clause 4) is intended to assist organizations of all types and sizes
to implement and operate an ISMS and consists of the following International Standards, under the
general title Information technology — Security techniques (given below in numerical order):
— ISO/IEC 27000, Information security management systems — Overview and vocabulary
— ISO/IEC 27001, Information security management systems — Requirements
— ISO/IEC 27002, Code of practice for information security controls
— ISO/IEC 27003, Information security management system implementation guidance
— ISO/IEC 27004, Information security management — Measurement
— ISO/IEC 27005, Information security risk management
— ISO/IEC 27006, Requirements for bodies providing audit and certification of information security
management systems
— ISO/IEC 27007, Guidelines for information security management systems auditing
— ISO/IEC TR 27008, Guidelines for auditors on information security controls
— ISO/IEC 27009, Sector-specific application of ISO/IEC 27001 — Requirements
— ISO/IEC 27010, Information security management for inter-sector and inter-organizational
communications
— ISO/IEC 27011, Information security management guidelines for telecommunications organizations
based on ISO/IEC 27002
— ISO/IEC 27013, Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1
© ISO/IEC 2016 – All rights reserved 1
---------------------- Page: 6 ----------------------
ISO/IEC 27000:2016(E)
— ISO/IEC 27014, Governance of information security
— ISO/IEC TR 27015, Information security management guidelines for financial services
— ISO/IEC TR 27016, Information security management — Organizational economics
— ISO/IEC 27017, Code of practice for information security controls based on ISO/IEC 27002 for cloud
services
— ISO/IEC 27018, Code of practice for protection of personally identifiable information (PII) in public
clouds acting as PII processors
— ISO/IEC 27019, Information security management guidelines based on ISO/IEC 27002 for process
control systems specific to the energy utility industry
NOTE The general title “Information technology — Security techniques” indicates that these International
Standards were prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee
SC 27, IT Security techniques.
International Standards not under the same general title that are also part of the ISMS family of
standards are as follows:
— ISO 27799, Health informatics — Information security management in health using ISO/IEC 27002
0.3 Purpose of this International Standard
This International Standard provides an overview of information security management systems and
defines related terms.
NOTE Annex A provides clarification on how verbal forms are used to express requirements and/or guidance
in the ISMS family of standards.
The ISMS family of standards includes standards that
a) define requirements for an ISMS and for those certifying such systems,
b) provide direct support, detailed guidance and/or interpretation for the overall process to establish,
implement, maintain, and improve an ISMS,
c) address sector-specific guidelines for ISMS, and
d) address conformity assessment for ISMS.
The terms and definitions provided in this International Standard
— cover commonly used terms and definitions in the ISMS family of standards,
— do not cover all terms and definitions applied within the ISMS family of standards, and
— do not limit the ISMS family of standards in defining new terms for use.
1 Scope
This International Standard provides the overview of information security management systems, and
terms and definitions commonly used in the ISMS family of standards. This International Standard is
applicable to all types and sizes of organization (e.g. commercial enterprises, government agencies, not-
for-profit organizations).
2 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
2 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC 27000:2016(E)
2.1
access control
means to ensure that access to assets is authorized and restricted based on business and security
requirements (2.63)
2.2
analytical model
algorithm or calculation combining one or more base measures (2.10) and/or derived measures (2.22)
with associated decision criteria (2.21)
2.3
attack
attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized
use of an asset
2.4
attribute
property or characteristic of an object (2.55) that can be distinguished quantitatively or qualitatively
by human or automated means
[SOURCE: ISO/IEC 15939:2007, 2.2, modified — “entity” has been replaced by “object” in the definition.]
2.5
audit
systematic, independent and documented process (2.61) for obtaining audit evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),
and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.
2.6
audit scope
extent and boundaries of an audit (2.5)
[SOURCE: ISO 19011:2011, 3.14, modified — Note 1 to entry has been deleted.]
2.7
authentication
provision of assurance that a claimed characteristic of an entity is correct
2.8
authenticity
property that an entity is what it claims to be
2.9
availability
property of being accessible and usable upon demand by an authorized entity
2.10
base measure
measure (2.47) defined in terms of an attribute (2.4) and the method for quantifying it
[SOURCE: ISO/IEC 15939:2007, 2.3, modified — Note 2 to entry has been deleted.]
Note 1 to entry: A base measure is functionally independent of other measures (2.47).
2.11
competence
ability to apply knowledge and skills to achieve intended results
© ISO/IEC 2016 – All rights reserved 3
---------------------- Page: 8 ----------------------
ISO/IEC 27000:2016(E)
2.12
confidentiality
property that information is not made available or disclosed to unauthorized individuals, entities, or
processes (2.61)
2.13
conformity
fulfilment of a requirement (2.63)
Note 1 to entry: The term “conformance” is synonymous but deprecated.
2.14
consequence
outcome of an event (2.25) affecting objectives (2.56)
[SOURCE: ISO Guide 73:2009, 3.6.1.3, modified]
Note 1 to entry: An event (2.25) can lead to a range of consequences.
Note 2 to entry: A consequence can be certain or uncertain and in the context of information security (2.33) is
usually negative.
Note 3 to entry: Consequences can be expressed qualitatively or quantitatively.
Note 4 to entry: Initial consequences can escalate through knock-on effects.
2.15
continual improvement
recurring activity to enhance performance (2.59)
2.16
control
measure that is modifying risk (2.68)
[SOURCE: ISO Guide 73:2009, 3.8.1.1]
Note 1 to entry: Controls include any process (2.61), policy (2.60), device, practice, or other actions which
modify risk (2.68).
Note 2 to entry: Controls may not always exert the intended or assumed modifying effect.
2.17
control objective
statement describing what is to be achieved as a result of implementing controls (2.16)
2.18
correction
action to eliminate a detected nonconformity (2.53)
2.19
corrective action
action to eliminate the cause of a nonconformity (2.53) and to prevent recurrence
2.20
data
collection of values assigned to base measures (2.10), derived measures (2.22) and/or indicators (2.30)
[SOURCE: ISO/IEC 15939:2007, 2.4, modified — Note 1 to entry has been added.]
Note 1 to entry: This definition applies only within the context of ISO/IEC 27004.
4 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 9 ----------------------
ISO/IEC 27000:2016(E)
2.21
decision criteria
thresholds, targets, or patterns used to determine the need for action or further investigation, or to
describe the level of confidence in a given result
[SOURCE: ISO/IEC 15939:2007, 2.7]
2.22
derived measure
measure (2.47) that is defined as a function of two or more values of base measures (2.10)
[SOURCE: ISO/IEC 15939:2007, 2.8, modified — Note 1 to entry has been deleted.]
2.23
documented information
information required to be controlled and maintained by an organization (2.57) and the medium on
which it is contained
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to
— the management system (2.46), including related processes (2.61);
— information created in order for the organization (2.57) to operate (documentation);
— evidence of results achieved (records).
2.24
effectiveness
extent to which planned activities are realized and planned results achieved
2.25
event
occurrence or change of a particular set of circumstances
[SOURCE: ISO Guide 73:2009, 3.5.1.3, modified — Note 4 to entry has been deleted.]
Note 1 to entry: An event can be one or more occurrences, and can have several causes.
Note 2 to entry: An event can consist of something not happening.
Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”.
2.26
executive management
person or group of people who have delegated responsibility from the governing body (2.29) for
implementation of strategies and policies to accomplish the purpose of the organization (2.57)
Note 1 to entry: Executive management is sometimes called top management (2.84) and can include Chief
Executive Officers, Chief Financial Officers, Chief Information Officers, and similar roles.
2.27
external context
external environment in which the organization seeks to achieve its objectives (2.56)
[SOURCE: ISO Guide 73:2009, 3.3.1.1]
Note 1 to entry: External context can include the following:
— the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive
environment, whether international, national, regional or local;
— key drivers and trends having impact on the objectives (2.56) of the organization (2.57);
© ISO/IEC 2016 – All rights reserved 5
---------------------- Page: 10 ----------------------
ISO/IEC 27000:2016(E)
— relationships with, and perceptions and values of, external stakeholders (2.82).
2.28
governance of information security
system by which an organization’s (2.57) information security (2.33) activities are directed and controlled
2.29
governing body
person or group of people who are accountable for the performance (2.59) and conformance of the
organization (2.57)
Note 1 to entry: Governing body can in some jurisdictions be a board of directors.
2.30
indicator
measure (2.47) that provides an estimate or evaluation of specified attributes (2.4) derived from an
analytical model (2.2) with respect to defined information needs (2.31)
2.31
information need
insight necessary to manage objectives (2.56), goals, risks and problems
[SOURCE: ISO/IEC 15939:2007, 2.12]
2.32
information processing facilities
any information processing system, service or infrastructure, or the physical location housing it
2.33
information security
preservation of confidentiality (2.12), integrity (2.40) and availability (2.9) of information
Note 1 to entry: In addition, other properties, such as authenticity (2.8), accountability, non-repudiation (2.54),
and reliability (2.62) can also be involved.
2.34
information security continuity
processes (2.61) and procedures for ensuring continued information security (2.33) operations
2.35
information security event
identified occurrence of a system, service or network state indicating a possible breach of information
security (2.33) policy (2.60) or failure of controls (2.16), or a previously unknown situation that may be
security relevant
2.36
information security incident
single or a series of unwanted or unexpected information security events (2.35) that have a significant
probability of compromising business operations and threatening information security (2.33)
2.37
information security incident management
processes (2.61) for detecting, reporting, assessing, responding to, dealing with, and learning from
information security incidents (2.36)
2.38
information sharing community
group of organizations (2.57) that agree to share information
Note 1 to entry: An organization (2.57) can be an individual.
6 © ISO/IEC 2016 – All rights reserved
---------------------- Page: 11 ----------------------
ISO/IEC 27000:2016(E)
2.39
information system
applications, services, information technology assets, or other information handling components
2.40
integrity
property of accuracy and completeness
2.41
interested party
person or organization (2.57) that can affect, be affected by, or perceive themselves to be affected by a
decision or activity
2.42
internal context
internal environment in which the organization (2.57) seeks to achieve its objectives
[SOURCE: ISO Guide 73:2009, 3.3.1.2]
Note 1 to entry: Internal context can include the following:
— governance, organizational structure, roles and accountabilities;
— policies (2.60), objectives (2.56), and the strategies that are in place to achieve them;
— the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes (2.61),
systems and technologies);
— information systems (2.39), information flows and decision-making processes (2.61) (both formal and informal);
— relationships with, and perceptions and values of, internal stakeholders (2.82);
— the organization’s (2.57) culture;
— standards, guidelines and models adopted by the organization (2.57);
— form and extent of contractual relationships.
2.43
ISMS project
structured activities undertaken by an organization (2.57) to implement an ISMS
2.44
level of risk
magnitude of a risk (2.68) expressed in terms of the combination of consequences (2.14) and their
likelihood (2.45)
[SOURCE: ISO Guide 73:2009, 3.6.1.8, modified — “or combination of risks” has been deleted in the
definition.]
2.45
likelihood
chance of something happening
[SOURCE: ISO Guide 73:2009, 3.6.1.1, modified — Notes 1 and 2 to entry have been deleted.]
2.46
management system
set of interrelated or interacting elements of an organization (2.57) to establish policies (2.60) and
objectives (2.56) and processes (2.61) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
© ISO/IEC 2016 – All rights reserved 7
---------------------- Page: 12 ----------------------
ISO/IEC 27000:2016(E)
Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities,
planning, operation.
Note 3 to entry: The scope of a management system may include the whole of the organization (2.57), specific and
identified functions of the organization (2.57), specific and identified sections of the organization (2.57), or one
or more functions across a group of organizations (2.57).
2.47
measure
variable to which a value is assigned as the result of measurement (2.48)
[SOURCE: ISO/IE
...
DRAFT INTERNATIONAL STANDARD
ISO/IEC DIS 27000
ISO/IEC JTC 1/SC 27 Secretariat: DIN
Voting begins on: Voting terminates on:
2015-03-19 2015-06-19
Information technology — Security techniques —
Information security management systems — Overview
and vocabulary
Technologies de l’information — Techniques de sécurité — Systèmes de gestion de sécurité de l’information
— Vue d’ensemble et vocabulaire
ICS: 01.040.35; 35.040
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENT AND APPROVAL. IT IS
THEREFORE SUBJECT TO CHANGE AND MAY
NOT BE REFERRED TO AS AN INTERNATIONAL
STANDARD UNTIL PUBLISHED AS SUCH.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
Reference number
NATIONAL REGULATIONS.
ISO/IEC DIS 27000:2015(E)
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
©
PROVIDE SUPPORTING DOCUMENTATION. ISO/IEC 2015
---------------------- Page: 1 ----------------------
ISO/IEC DIS 27000:2015(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO/IEC 2015
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2015 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC DIS 27000:2015(E)
Contents Page
Foreword .iv
0 Introduction .v
1 Scope . 1
2 Terms and definitions . 1
3 Information security management systems .12
3.1 Introduction .12
3.2 What is an ISMS? .12
3.2.1 Overview and principles .12
3.2.2 Information.13
3.2.3 Information security .13
3.2.4 Management .13
3.2.5 Management system .14
3.3 Process approach .14
3.4 Why an ISMS is important .14
3.5 Establishing, monitoring, maintaining and improving an ISMS .15
3.5.1 Overview .15
3.5.2 Identifying information security requirements .15
3.5.3 Assessing information security risks .16
3.5.4 Treating information security risks . .16
3.5.5 Selecting and implementing controls .16
3.5.6 Monitor, maintain and improve the effectiveness of the ISMS .17
3.5.7 Continual improvement .17
3.6 ISMS critical success factors .18
3.7 Benefits of the ISMS family of standards .18
4 ISMS family of standards .19
4.1 General information .19
4.2 Standards describing an overview and terminology .20
4.2.1 ISO/IEC 27000 (this document) .20
4.3 Standards specifying requirements .20
4.3.1 ISO/IEC 27001 .20
4.3.2 ISO/IEC 27006 .21
4.4 Standards describing general guidelines .21
4.4.1 ISO/IEC 27002 .21
4.4.2 ISO/IEC 27003 .21
4.4.3 ISO/IEC 27004 .21
4.4.4 ISO/IEC 27005 .22
4.4.5 ISO/IEC 27007 .22
4.4.6 ISO/IEC/TR 27008 .22
4.4.7 ISO/IEC 27013 .22
4.4.8 ISO/IEC 27014 .23
4.4.9 ISO/IEC/TR 27016 .23
4.5 Standards describing sector-specific guidelines .23
4.5.1 ISO/IEC 27010 .23
4.5.2 ISO/IEC 27011 .24
4.5.3 ISO/IEC/TR 27015 .24
4.5.4 ISO/IEC 27017 .24
4.5.5 ISO/IEC 27018 .24
4.5.6 ISO/IEC/TR 27019 .25
4.5.7 ISO 27799 .25
Annex A (informative) Verbal forms for the expression of provisions.26
Annex B (informative) Term and Term ownership .27
Bibliography .32
© ISO/IEC 2015 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC DIS 27000:2015(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2. www.iso.org/directives
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any
patent rights identified during the development of the document will be in the Introduction and/or on
the ISO list of patent declarations received. www.iso.org/patents
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the meaning of ISO specific terms and expressions related to conformity
assessment, as well as information about ISO’s adherence to the WTO principles in the Technical Barriers
to Trade (TBT), see the following URL: Foreword - Supplementary information
ISO/IEC 27000 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This fourth edition cancels and replaces the third edition (ISO/IEC 27000:2014), which has been
technically revised.
iv © ISO/IEC 2015 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC DIS 27000:2015(E)
0 Introduction
0.1 Overview
International Standards for management systems provide a model to follow in setting up and operating
a management system. This model incorporates the features on which experts in the field have reached a
consensus as being the international state of the art. ISO/IEC JTC 1/SC 27 maintains an expert committee
dedicated to the development of international management systems standards for information security,
otherwise known as the Information Security Management System (ISMS) family of standards.
Through the use of the ISMS family of standards, organizations can develop and implement a framework
for managing the security of their information assets including financial information, intellectual
property, and employee details, or information entrusted to them by customers or third parties. These
standards can also be used to prepare for an independent assessment of their ISMS applied to the
protection of information.
0.2 ISMS family of standards
The ISMS family of standards (see Clause 4) is intended to assist organizations of all types and sizes to
implement and operate an ISMS and consists of the following International Standards, under the general
title Information technology — Security techniques (given below in numerical order):
— ISO/IEC 27000, Information security management systems — Overview and vocabulary
— ISO/IEC 27001, Information security management systems — Requirements
— ISO/IEC 27002, Code of practice for information security controls
— ISO/IEC 27003, Information security management system implementation guidance
— ISO/IEC 27004, Information security management — Measurement
— ISO/IEC 27005, Information security risk management
— ISO/IEC 27006, Requirements for bodies providing audit and certification of information security
management systems
— ISO/IEC 27007, Guidelines for information security management systems auditing
— ISO/IEC/TR 27008, Guidelines for auditors on information security controls
— ISO/IEC/DIS 27009, Sector-specific application of ISO/IEC 27001–Requirements
— ISO/IEC 27010, Information security management for inter-sector and inter-organizational
communications
— ISO/IEC 27011, Information security management guidelines for telecommunications organizations
based on ISO/IEC 27002
— ISO/IEC 27013, Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1
— ISO/IEC 27014, Governance of information security
— ISO/IEC/TR 27015, Information security management guidelines for financial services
— ISO/IEC/TR 27016, Information security management — Organizational economics
— ISO/IEC 27017, Code of practice for information security controls based on ISO/IEC 27002 for cloud services
— ISO/IEC 27018, Code of practice for PII protection in public clouds acting as PII processors
— ISO/IEC 27019, Information security management guidelines based on ISO/IEC 27002 for process
control systems specific to the energy utility industry
© ISO/IEC 2015 – All rights reserved v
---------------------- Page: 5 ----------------------
ISO/IEC DIS 27000:2015(E)
NOTE The general title “Information technology — Security techniques” indicates that these standards
were prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 27, IT
Security techniques.
International Standards not under the same general title that are also part of the ISMS family of standards
are as follows:
— ISO 27799:2008, Health informatics — Information security management in health using ISO/IEC 27002
0.3 Purpose of this International Standard
This International Standard provides an overview of information security management systems, and
defines related terms.
NOTE Annex A provides clarification on how verbal forms are used to express requirements and/or guidance
in the ISMS family of standards.
The ISMS family of standards includes standards that:
a) define requirements for an ISMS and for those certifying such systems;
b) provide direct support, detailed guidance and/or interpretation for the overall process to establish,
implement, maintain and improve an ISMS;
c) address sector-specific guidelines for ISMS; and
d) address conformity assessment for ISMS.
The terms and definitions provided in this International Standard:
— cover commonly used terms and definitions in the ISMS family of standards;
— do not cover all terms and definitions applied within the ISMS family of standards; and
— do not limit the ISMS family of standards in defining new terms for use.
vi © ISO/IEC 2015 – All rights reserved
---------------------- Page: 6 ----------------------
DRAFT INTERNATIONAL STANDARD ISO/IEC DIS 27000:2015(E)
Information technology — Security techniques —
Information security management systems — Overview
and vocabulary
1 Scope
This International Standard provides the overview of information security management systems, and
terms and definitions commonly used in the ISMS family of standards. This International Standard is
applicable to all types and sizes of organization (e.g. commercial enterprises, government agencies, not-
for-profit organizations).
2 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
2.1
access control
means to ensure that access to assets is authorized and restricted based on business and security
requirements
2.2
analytical model
algorithm or calculation combining one or more base measures (2.10) and/or derived measures (2.22)
with associated decision criteria
2.3
attack
attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized
use of an asset
2.4
attribute
property or characteristic of an object (2.55) that can be distinguished quantitatively or qualitatively
by human or automated means
[SOURCE: ISO/IEC 15939:2007, modified – “entity” has been replaced by “object” in the definition.]
2.5
audit
systematic, independent and documented process (2.61) for obtaining audit evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),
and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.
2.6
audit scope
extent and boundaries of an audit (2.5)
[SOURCE: ISO 19011:2011]
© ISO/IEC 2015 – All rights reserved 1
---------------------- Page: 7 ----------------------
ISO/IEC DIS 27000:2015(E)
2.7
authentication
provision of assurance that a claimed characteristic of an entity is correct
2.8
authenticity
property that an entity is what it is claims to be
2.9
availability
property of being accessible and usable upon demand by an authorized entity
2.10
base measure
measure (2.47) defined in terms of an attribute (2.4) and the method for quantifying it
[SOURCE: ISO/IEC 15939:2007]
Note 1 to entry: A base measure is functionally independent of other measures.
2.11
competence
ability to apply knowledge and skills to achieve intended results
2.12
confidentiality
property that information is not made available or disclosed to unauthorized individuals, entities, or
processes (2.61)
2.13
conformity
fulfilment of a requirement (2.63)
Note 1 to entry: The term “conformance” is synonymous but deprecated.
2.14
consequence
outcome of an event (2.25) affecting objectives (2.56)
[SOURCE: ISO Guide 73:2009]
Note 1 to entry: An event can lead to a range of consequences.
Note 2 to entry: A consequence can be certain or uncertain and in the context of information security is usually negative.
Note 3 to entry: Consequences can be expressed qualitatively or quantitatively.
Note 4 to entry: Initial consequences can escalate through knock-on effects.
2.15
continual improvement
recurring activity to enhance performance (2.59)
2.16
control
measure that is modifying risk (2.68)
[SOURCE: ISO Guide 73:2009]
Note 1 to entry: Controls include any process, policy, device, practice, or other actions which modify risk.
Note 2 to entry: Controls may not always exert the intended or assumed modifying effect.
2 © ISO/IEC 2015 – All rights reserved
---------------------- Page: 8 ----------------------
ISO/IEC DIS 27000:2015(E)
2.17
control objective
statement describing what is to be achieved as a result of implementing controls (2.16)
2.18
correction
action to eliminate a detected nonconformity (2.53)
2.19
corrective action
action to eliminate the cause of a nonconformity (2.53) and to prevent recurrence
2.20
data
collection of values assigned to base measures (2.10), derived measures (2.22) and/or indicators (2.30)
[SOURCE: ISO/IEC 15939:2007]
Note 1 to entry: This definition applies only within the context of ISO/IEC 27004:2009.
2.21
decision criteria
thresholds, targets, or patterns used to determine the need for action or further investigation, or to
describe the level of confidence in a given result
[SOURCE: ISO/IEC 15939:2007]
2.22
derived measure
measure (2.47) that is defined as a function of two or more values of base measures (2.10)
[SOURCE: ISO/IEC 15939:2007]
2.23
documented information
information required to be controlled and maintained by an organization (2.57) and the medium on
which it is contained
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to
— the management system (2.46), including related processes (2.61);
— information created in order for the organization to operate (documentation);
— evidence of results achieved (records).
2.24
effectiveness
extent to which planned activities are realized and planned results achieved
2.25
event
occurrence or change of a particular set of circumstances
[SOURCE: ISO Guide 73:2009]
Note 1 to entry: An event can be one or more occurrences, and can have several causes.
Note 2 to entry: An event can consist of something not happening.
Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”.
© ISO/IEC 2015 – All rights reserved 3
---------------------- Page: 9 ----------------------
ISO/IEC DIS 27000:2015(E)
2.26
executive management
person or group of people who have delegated responsibility from the governing body (2.29) for
implementation of strategies and policies to accomplish the purpose of the organization (2.57)
Note 1 to entry: Executive management is sometimes called top management and can include Chief Executive
Officers, Chief Financial Officers, Chief Information Officers, and similar roles
2.27
external context
external environment in which the organization seeks to achieve its objectives
[SOURCE: ISO Guide 73:2009]
Note 1 to entry: External context can include:
— the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive
environment, whether international, national, regional or local;
— key drivers and trends having impact on the objectives (2.56) of the organization (2.57); and
— relationships with, and perceptions and values of, external stakeholders (2.82).
2.28
governance of information security
system by which an organization’s (2.57) information security activities are directed and controlled
2.29
governing body
person or group of people who are accountable for the performance (2.59) and conformance of the
organization (2.57)
Note 1 to entry: Governing body can in some jurisdictions be a board of directors.
2.30
indicator
measure (2.47) that provides an estimate or evaluation of specified attributes (2.4) derived from an
analytical model (2.2) with respect to defined information needs (2.31)
2.31
information need
insight necessary to manage objectives, goals, risks and problems
[SOURCE: ISO/IEC 15939:2007]
2.32
information processing facilities
any information processing system, service or infrastructure, or the physical location housing it
2.33
information security
preservation of confidentiality (2.12), integrity (2.40) and availability (2.9) of information
Note 1 to entry: In addition, other properties, such as authenticity (2.8), accountability, non-repudiation (2.54),
and reliability (2.62) can also be involved.
2.34
information security continuity
processes (2.61) and procedures for ensuring continued information security (2.33) operations
4 © ISO/IEC 2015 – All rights reserved
---------------------- Page: 10 ----------------------
ISO/IEC DIS 27000:2015(E)
2.35
information security event
identified occurrence of a system, service or network state indicating a possible breach of information
security policy or failure of controls, or a previously unknown situation that may be security relevant
2.36
information security incident
single or a series of unwanted or unexpected information security events (2.35) that have a significant
probability of compromising business operations and threatening information security (2.33)
2.37
information security incident management
processes (2.61) for detecting, reporting, assessing, responding to, dealing with, and learning from
information security incidents (2.36)
2.38
information sharing community
group of organizations that agree to share information
Note 1 to entry: An organization can be an individual.
2.39
information system
applications, services, information technology assets, or other information handling components
2.40
integrity
property of accuracy and completeness
2.41
interested party
person or organization (2.57) that can affect, be affected by, or perceive themselves to be affected by a
decision or activity
2.42
internal context
internal environment in which the organization seeks to achieve its objectives
[SOURCE: ISO Guide 73:2009]
Note 1 to entry: Internal context can include:
— governance, organizational structure, roles and accountabilities;
— policies, objectives, and the strategies that are in place to achieve them;
— the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes,
systems and technologies);
— information systems, information flows and decision-making processes (both formal and informal);
— relationships with, and perceptions and values of, internal stakeholders;
— the organization’s culture;
— standards, guidelines and models adopted by the organization; and
— form and extent of contractual relationships.
2.43
ISMS project
structured activities undertaken by an organization (2.57) to implement an ISMS
© ISO/IEC 2015 – All rights reserved 5
---------------------- Page: 11 ----------------------
ISO/IEC DIS 27000:2015(E)
2.44
level of risk
magnitude of a risk (2.68) expressed in terms of the combination of consequences (2.14) and their
likelihood (2.45)
[SOURCE: ISO Guide 73:2009, modified — “or combination of risks,” has been deleted.]
2.45
likelihood
chance of something happening
[SOURCE: ISO Guide 73:2009]
2.46
management system
set of interrelated or interacting elements of an organization (2.57) to establish policies (2.60) and
objectives (2.56) and processes (2.61) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning,
operation, etc.
Note 3 to entry: The scope of a management system may include the whole of the organization, specific and
identified functions of the organization, specific and identified sections of the organization, or one or more
functions across a group of organizations.
2.47
measure
variable to which a value is assigned as the result of measurement (2.48)
[SOURCE: ISO/IEC 15939:2007]
Note 1 to entry: The term “measures” is used to refer collectively to base measures, derived measures, and indicators.
2.48
measurement
process (2.61) to determine a value
Note 1 to entry: In the context of information security (2.33) the process of determining a value requires
information about the effectiveness (2.24) of an information security management system (2.46) and its associated
controls (2.16) using a measurement method (2.50), a measurement function (2.49), an analytical model (2.2), and
decision criteria (2.21).
2.49
measurement function
algorithm or calculation performed to combine two or more base measur
...
NORME ISO/IEC
INTERNATIONALE 27000
Quatrième édition
2016-02-15
Technologies de l’information —
Techniques de sécurité — Systèmes de
gestion de sécurité de l’information —
Vue d’ensemble et vocabulaire
Information technology — Security techniques — Information
security management systems — Overview and vocabulary
Numéro de référence
ISO/IEC 27000:2016(F)
©
ISO/IEC 2016
---------------------- Page: 1 ----------------------
ISO/IEC 27000:2016(F)
DOCUMENT PROTÉGÉ PAR COPYRIGHT
© ISO/IEC 2016, Publié en Suisse
Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite ni utilisée
sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie, l’affichage sur
l’internet ou sur un Intranet, sans autorisation écrite préalable. Les demandes d’autorisation peuvent être adressées à l’ISO à
l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO/IEC 2016 – Tous droits réservés
---------------------- Page: 2 ----------------------
ISO/IEC 27000:2016(F)
Sommaire Page
Avant-propos .v
0 Introduction . 1
0.1 Vue d’ensemble . 1
0.2 La famille de normes du SMSI . 1
0.3 Objet de la présente Norme internationale . 2
1 Domaine d’application . 2
2 Termes et définitions . 3
3 Systèmes de management de la sécurité de l’information .15
3.1 Généralités .15
3.2 Qu’est-ce qu’un SMSI? .15
3.2.1 Vue d’ensemble et principes .15
3.2.2 L’information .16
3.2.3 Sécurité de l’information .16
3.2.4 Management .17
3.2.5 Système de management .17
3.3 Approche processus .17
3.4 Raisons expliquant pourquoi un SMSI est important .17
3.5 Établissement, surveillance, maintenance et amélioration d’un SMSI .18
3.5.1 Vue d’ensemble .18
3.5.2 Identifier les exigences liées à la sécurité de l’information .19
3.5.3 Apprécier les risques liés à la sécurité de l’information.19
3.5.4 Traiter les risques liés à la sécurité de l’information .20
3.5.5 Sélectionner et mettre en œuvre les mesures de sécurité .20
3.5.6 Surveiller, mettre à jour et améliorer l’efficacité du SMSI .21
3.5.7 Amélioration continue .21
3.6 Facteurs critiques de succès du SMSI .22
3.7 Avantages de la famille de normes du SMSI.22
4 La famille de normes du SMSI .23
4.1 Information générales .23
4.2 Normes donnant une vue d’ensemble et décrivant la terminologie .24
4.2.1 ISO/IEC 27000 (la présente Norme internationale) .24
4.3 Normes spécifiant des exigences .24
4.3.1 ISO/IEC 27001 .24
4.3.2 ISO/IEC 27006 .24
4.4 Normes décrivant des lignes directrices générales .25
4.4.1 ISO/IEC 27002 .25
4.4.2 ISO/IEC 27003 .25
4.4.3 ISO/IEC 27004 .25
4.4.4 ISO/IEC 27005 .25
4.4.5 ISO/IEC 27007 .25
4.4.6 ISO/IEC/TR 27008 .26
4.4.7 ISO/IEC 27013 .26
4.4.8 ISO/IEC 27014 .26
4.4.9 ISO/IEC/TR 27016 .27
4.5 Normes décrivant des lignes directrices propres à un secteur .27
4.5.1 ISO/IEC 27010 .27
4.5.2 ISO/IEC 27011 .27
4.5.3 ISO/IEC/TR 27015 .27
4.5.4 ISO/IEC 27017 .28
4.5.5 ISO/IEC 27018 .28
4.5.6 ISO/IEC/TR 27019 .28
4.5.7 ISO 27799 .29
© ISO/IEC 2016 – Tous droits réservés iii
---------------------- Page: 3 ----------------------
ISO/IEC 27000:2016(F)
Annexe A (informative) Formes verbales utilisées pour exprimer des dispositions .30
Annexe B (informative) Termes et propriété des termes .31
Bibliographie .35
iv © ISO/IEC 2016 – Tous droits réservés
---------------------- Page: 4 ----------------------
ISO/IEC 27000:2016(F)
Avant-propos
L’ISO (Organisation internationale de normalisation) et l’IEC (Commission électrotechnique
internationale) forment le système spécialisé de la normalisation mondiale. Les organismes nationaux
membres de l’ISO ou de l’IEC participent à l’élaboration de Normes internationales par l’intermédiaire de
comités techniques créés par l’organisme concerné pour traiter de domaines particuliers à une activité
technique. Les comités techniques de l’ISO et de l’IEC collaborent dans des domaines d’intérêt commun.
D’autres organismes internationaux, gouvernementaux et non gouvernementaux, en liaison avec l’ISO
et l’IEC participent également aux travaux. Dans le domaine des technologies de l’information, l’ISO et
l’IEC ont créé un comité technique mixte, l’ISO/IEC JTC 1.
Les procédures utilisées pour élaborer le présent document et celles destinées à sa mise à jour sont
décrites dans les Directives ISO/IEC, Partie 1. Il convient, en particulier, de prendre note des différents
critères d’approbation requis pour les différents types de document. Le présent document a été rédigé
conformément aux règles de rédaction données dans les Directives ISO/IEC, Partie 2 (voir http://www.
iso.org/directives).
L’attention est appelée sur le fait que certains des éléments du présent document peuvent faire l’objet de
droits de propriété intellectuelle ou de droits analogues. L’ISO ne saurait être tenue pour responsable
de ne pas avoir identifié de tels droits de propriété et averti de leur existence. Les détails concernant
les références aux droits de propriété intellectuelle ou autres droits analogues identifiés lors de
l’élaboration du document sont indiqués dans l’Introduction et/ou dans la liste des déclarations de
brevets reçues par l’ISO (voir www.iso.org/brevets).
Les appellations commerciales éventuellement mentionnées dans le présent document sont données
pour information, par souci de commodité, à l’intention des utilisateurs et ne sauraient constituer un
engagement.
Pour une explication de la signification des termes et expressions spécifiques de l’ISO liés à
l’évaluation de la conformité, ou pour toute information au sujet de l’adhésion de l’ISO aux principes
de l’OMC concernant les obstacles techniques au commerce (OTC), voir le lien suivant: Avant-propos —
Informations supplémentaires.
Le comité chargé de l’élaboration du présent document est l’ISO/IEC JTC 1, Technologies de l’information,
sous-comité SC 27, Techniques de sécurité des technologies de l’information.
Cette quatrième édition annule et remplace la troisième édition (ISO/IEC 27000:2014), qui a fait l’objet
d’une révision technique.
© ISO/IEC 2016 – Tous droits réservés v
---------------------- Page: 5 ----------------------
NORME INTERNATIONALE ISO/IEC 27000:2016(F)
Technologies de l’information — Techniques de sécurité
— Systèmes de gestion de sécurité de l’information — Vue
d’ensemble et vocabulaire
0 Introduction
0.1 Vue d’ensemble
Les Normes internationales relatives aux systèmes de management fournissent un modèle en matière
d’établissement et d’exploitation d’un système de management. Ce modèle comprend les caractéristiques
que les experts dans le domaine s’accordent à reconnaître comme reflétant l’état de l’art au niveau
international. Le sous-comité ISO/IEC JTC 1/SC 27 bénéficie de l’expérience d’un comité d’experts
qui se consacre à l’élaboration des Normes internationales sur les systèmes de management pour la
sécurité de l’information, connues également comme famille de normes du Système de Management de
la Sécurité de l’Information (SMSI).
Grâce à l’utilisation de la famille de normes du SMSI, les organismes peuvent élaborer et mettre en œuvre
un cadre de référence pour gérer la sécurité de leurs actifs informationnels, y compris les informations
financières, la propriété intellectuelle, les informations sur les employés, ou les informations qui leur
sont confiées par des clients ou des tiers. Ils peuvent également utiliser ces normes pour se préparer à
une évaluation indépendante de leurs SMSI en matière de protection de l’information.
0.2 La famille de normes du SMSI
La famille de normes du SMSI (voir Article 4) a pour objet d’aider les organismes de tous types et
de toutes tailles à déployer et à exploiter un SMSI. Elle se compose des Normes internationales
suivantes (indiquées ci-dessous par ordre numérique) regroupées sous le titre général Technologies de
l’information — Techniques de sécurité:
— ISO/IEC 27000, Systèmes de management de la sécurité de l’information — Vue d’ensemble et vocabulaire
— ISO/IEC 27001, Systèmes de management de la sécurité de l’information — Exigences
— ISO/IEC 27002, Code de bonnes pratiques pour le management de la sécurité de l’information
— ISO/IEC 27003, Lignes directrices pour la mise en œuvre du système de management de la sécurité de
l’information
— ISO/IEC 27004, Management de la sécurité de l’information — Mesurage
— ISO/IEC 27005, Gestion des risques liés à la sécurité de l’information
— ISO/IEC 27006, Exigences pour les organismes procédant à l’audit et à la certification des systèmes de
management de la sécurité de l’information
— ISO/IEC 27007, Lignes directrices pour l’audit des systèmes de management de la sécurité de l’information
— ISO/IEC/TR 27008, Lignes directrices pour les auditeurs des contrôles de sécurité de l’information
— ISO/IEC 27009, Application de l’ISO/IEC 27001 à un secteur spécifique — Exigences
— ISO/IEC 27010, Gestion de la sécurité de l’information des communications intersectorielles et
interorganisationnelles
© ISO 2016 – Tous droits réservés 1
---------------------- Page: 6 ----------------------
ISO/IEC 27000:2016(F)
— ISO/IEC 27011, Lignes directrices du management de la sécurité de l’information pour les organismes
de télécommunications sur la base de l’ISO/IEC 27002
— ISO/IEC 27013, Guide sur la mise en œuvre intégrée de l’ISO/IEC 27001 et ISO/IEC 20000-1
— ISO/IEC 27014, Gouvernance de la sécurité de l’information
— ISO/IEC/TR 27015, Lignes directrices pour le management de la sécurité de l’information pour les
services financiers
— ISO/IEC/TR 27016, Management de la sécurité de l’information — Économie organisationnelle
— ISO/IEC 27017, Code de bonnes pratiques pour les contrôles de sécurité de l’information fondés sur
l’ISO/IEC 27002 pour les services du nuage
— ISO/IEC 27018, Code de bonnes pratiques pour la protection des informations personnelles identifiables
(PII) dans l’informatique en nuage public agissant comme processeur de PII
— ISO/IEC 27019, Lignes directrices de management de la sécurité de l’information fondées sur
l’ISO/IEC 27002 pour les systèmes de contrôle des processus spécifiques à l’industrie de l’énergie
NOTE Le titre général « Technologies de l’information — Techniques de sécurité » indique que ces Normes
internationales ont été élaborées par le comité technique mixte ISO/IEC JTC 1, Technologies de l’information,
sous-comité SC 27, Techniques de sécurité des technologies de l’information.
Les Normes internationales qui font également partie de la famille de normes du SMSI, mais qui ne sont
pas regroupées sous le même titre général, sont les suivantes:
— ISO 27799, Informatique de santé — Management de la sécurité de l’information relative à la santé en
utilisant l’ISO/IEC 27002
0.3 Objet de la présente Norme internationale
La présente Norme internationale offre une vue d’ensemble des systèmes de management de la sécurité
de l’information et définit les termes qui s’y rapportent.
NOTE L’Annexe A fournit des éclaircissements sur la façon dont les formes verbales sont utilisées pour
exprimer des exigences et/ou des préconisations dans la famille de normes du SMSI.
La famille de normes du SMSI comporte des normes qui:
a) définissent les exigences relatives à un SMSI et à ceux qui certifient de tels systèmes;
b) apportent des informations directes, des préconisations et/ou une interprétation détaillées
concernant le processus général visant à établir, mettre en œuvre, maintenir et améliorer un SMSI;
c) présentent des lignes directrices propres à des secteurs particuliers en matière de SMSI;
d) traitent de l’évaluation de la conformité d’un SMSI.
Les termes et les définitions fournis dans la présente Norme internationale:
— couvrent les termes et les définitions d’usage courant dans la famille de normes du SMSI;
— ne couvrent pas l’ensemble des termes et des définitions utilisés dans la famille de normes du SMSI;
— ne limitent pas la famille de normes du SMSI en définissant de nouveaux termes à utiliser.
1 Domaine d’application
La présente Norme internationale offre une vue d’ensemble des systèmes de management de la sécurité
de l’information, ainsi que des termes et définitions d’usage courant dans la famille de normes du SMSI.
2 © ISO/IEC 2016 – Tous droits réservés
---------------------- Page: 7 ----------------------
ISO/IEC 27000:2016(F)
La présente Norme internationale est applicable à tous les types et à toutes les tailles d’organismes (par
exemple: les entreprises commerciales, les organismes publics, les organismes à but non lucratif).
2 Termes et définitions
Pour les besoins du présent document, les termes et définitions suivants s’appliquent:
2.1
contrôle d’accès
moyens mis en œuvre pour assurer que l’accès aux actifs est autorisé et limité selon les exigences (2.63)
propres à la sécurité et à l’activité métier
2.2
modèle analytique
algorithme ou calcul combinant une ou plusieurs mesures élémentaires (2.10) et/ou mesures
dérivées (2.22) avec les critères de décision associés (2.21)
2.3
attaque
tentative de détruire, de rendre public, de modifier, d’invalider, de voler ou d’utiliser sans autorisation
un actif, ou de faire un usage non autorisé de celui-ci
2.4
attribut
propriété ou caractéristique d’un objet (2.55) qui peut être distingué quantitativement ou
qualitativement par des moyens humains ou automatiques
[SOURCE: ISO/IEC 15939:2007, 2.2, modifiée — Le terme « entité » a été remplacé par « objet » dans la
définition.]
2.5
audit
processus (2.61) méthodique, indépendant et documenté permettant d’obtenir des preuves d’audit et de
les évaluer de manière objective pour déterminer dans quelle mesure les critères d’audit sont satisfaits
Note 1 à l’article: Un audit peut être interne (audit de première partie), externe (audit de seconde ou de tierce
partie) ou combiné (associant deux disciplines ou plus).
Note 2 à l’article: Les termes « preuves d’audit » et « critères d’audit » sont définis dans l’ISO 19011.
2.6
champ de l’audit
étendue et limites d’un audit (2.5)
[SOURCE: ISO 19011:2011, 3.14, modifiée — Suppression de la note 1 à l’article.]
2.7
authentification
méthode permettant de garantir qu’une caractéristique revendiquée pour une entité est correcte
2.8
authenticité
propriété selon laquelle une entité est ce qu’elle revendique être
2.9
disponibilité
propriété d’être accessible et utilisable à la demande par une entité autorisée
© ISO/IEC 2016 – Tous droits réservés 3
---------------------- Page: 8 ----------------------
ISO/IEC 27000:2016(F)
2.10
mesure élémentaire
mesure (2.47) définie en fonction d’un attribut (2.4) et de la méthode de mesurage spécifiée pour le
quantifier
[SOURCE: ISO/IEC 15939:2007, 2.3, modifiée — Suppression de la note 2 à l’article.]
Note 1 à l’article: Une mesure élémentaire est fonctionnellement indépendante des autres mesures (2.47).
2.11
compétence
capacité à appliquer des connaissances et des aptitudes pour obtenir les résultats escomptés
2.12
confidentialité
propriété selon laquelle l’information n’est pas diffusée ni divulguée à des personnes, des entités ou des
processus (2.61) non autorisés
2.13
conformité
satisfaction d’une exigence (2.63)
Note 1 à l’article: Le terme anglais « conformance » est un synonyme, mais il est déconseillé.
2.14
conséquence
effet d’un événement (2.25) affectant les objectifs (2.56)
[SOURCE: Guide ISO 73:2009, 3.6.1.3, modifié]
Note 1 à l’article: Un événement (2.25) peut entraîner une série de conséquences.
Note 2 à l’article: Une conséquence peut être certaine ou incertaine. Dans le contexte de la sécurité de l’information
(2.33), elle est généralement négative.
Note 3 à l’article: Les conséquences peuvent être exprimées de façon qualitative ou quantitative.
Note 4 à l’article: Des conséquences initiales peuvent déclencher des réactions en chaîne.
2.15
amélioration continue
activité régulière destinée à améliorer les performances (2.59)
2.16
mesure de sécurité
mesure qui modifie un risque (2.68)
[SOURCE: Guide ISO 73:2009, 3.8.1.1]
Note 1 à l’article: Les mesures de sécurité comprennent tous les processus (2.61), politiques (2.60), dispositifs,
pratiques ou autres actions qui modifient un risque (2.68).
Note 2 à l’article: Les mesures de sécurité ne peuvent pas toujours aboutir à la modification voulue ou supposée.
2.17
objectif d’une mesure de sécurité
déclaration décrivant ce qui est attendu de la mise en œuvre des mesures de sécurité (2.16)
2.18
correction
action visant à éliminer une non-conformité (2.53) détectée
4 © ISO/IEC 2016 – Tous droits réservés
---------------------- Page: 9 ----------------------
ISO/IEC 27000:2016(F)
2.19
action corrective
action visant à éliminer la cause d’une non-conformité (2.53) et à empêcher qu’elle ne se répète
2.20
données
ensemble des valeurs attribuées aux mesures élémentaires (2.10), mesures dérivées (2.22) et/ou aux
indicateurs (2.30)
[SOURCE: ISO/IEC 15939:2007, 2.4, modifiée — Ajout de la note 1 à l’article.]
Note 1 à l’article: Cette définition s’applique uniquement dans le contexte de l’ISO/IEC 27004.
2.21
critères de décision
seuils, cibles ou modèles utilisés pour déterminer la nécessité d’une action ou d’un complément
d’enquête, ou pour décrire le niveau de confiance dans un résultat donné
[SOURCE: ISO/IEC 15939:2007, 2.7]
2.22
mesure dérivée
mesure (2.47) définie en fonction d’au moins deux mesures élémentaires (2.10)
[SOURCE: ISO/IEC 15939:2007, 2.8, modifiée — Suppression de la note 1 à l’article.]
2.23
informations documentées
informations devant être contrôlées et mises à jour par un organisme (2.57) et le support sur lequel
elles sont stockées
Note 1 à l’article: Les informations documentées peuvent être dans n’importe quel format, sur n’importe quel
support et provenir de n’importe quelle source.
Note 2 à l’article: Les informations documentées peuvent se rapporter:
— au système de management (2.46) et aux processus (2.61) associés;
— aux informations créées pour permettre à l’organisme (2.57) de fonctionner (documentation);
— aux preuves des résultats obtenus (enregistrements).
2.24
efficacité
niveau de réalisation des activités planifiées et d’obtention des résultats escomptés
2.25
événement
occurrence ou changement d’un ensemble particulier de circonstances
[SOURCE: Guide ISO 73:2009, 3.5.1.3, modifié — Suppression de la note 4 à l’article.]
Note 1 à l’article: Un événement peut être unique ou se reproduire. Il peut avoir plusieurs causes.
Note 2 à l’article: Un événement peut consister en quelque chose qui ne se produit pas.
Note 3 à l’article: Un événement peut parfois être qualifié « d’incident » ou « d’accident ».
© ISO/IEC 2016 – Tous droits réservés 5
---------------------- Page: 10 ----------------------
ISO/IEC 27000:2016(F)
2.26
management exécutif
personne ou groupe de personnes ayant reçu des instances dirigeantes (2.29) la responsabilité de la
mise en œuvre des stratégies et politiques afin d’atteindre les objectifs de l’organisme (2.57)
Note 1 à l’article: Le management exécutif est parfois appelé la direction (2.84). Il peut comprendre les présidents
directeurs généraux, les directeurs financiers, les directeurs des systèmes d’information et autres fonctions
similaires.
2.27
contexte externe
environnement externe dans lequel l’organisme cherche à atteindre ses objectifs (2.56)
[SOURCE: Guide ISO 73:2009, 3.3.1.1]
Note 1 à l’article: Le contexte externe peut inclure les aspects suivants:
— l’environnement culturel, social, politique, légal, réglementaire, financier, technologique, économique,
naturel et concurrentiel, au niveau international, national, régional ou local;
— les facteurs clés et tendances ayant un impact déterminant sur les objectifs (2.56) de l’organisme (2.57);
— les relations avec les parties prenantes (2.82) externes, les perceptions et valeurs relatives à celles-ci.
2.28
gouvernance de la sécurité de l’information
système par lequel un organisme (2.57) conduit et supervise les activités liées à la sécurité de
l’information (2.33)
2.29
instances dirigeantes
personne ou groupe de personnes ayant la responsabilité des performances (2.59) et de la conformité de
l’organisme (2.57)
Note 1 à l’article: Dans certaines juridictions, les instances dirigeantes peuvent être constituées d’un conseil
d’administration.
2.30
indicateur
mesure (2.47) qui fournit une estimation ou une évaluation des attributs (2.4) spécifiés à partir d’un
modèle analytique (2.2) concernant les besoins d’information (2.31) définis
2.31
besoin d’information
information nécessaire pour gérer les objectifs (2.56), les buts, les risques et les problèmes
[SOURCE: ISO/IEC 15939:2007, 2.12]
2.32
moyens de traitement de l’information
tout système, service ou infrastructure de traitement de l’information, ou le local les abritant
2.33
sécurité de l’information
protection de la confidentialité (2.12), de l’intégrité (2.40) et de la disponibilité (2.9) de l’information
Note 1 à l’article: En outre, d’autres propriétés, telles que l’authenticité (2.8), l’imputabilité, la non-répudiation (2.54)
et la fiabilité (2.62) peuvent également être concernées.
2.34
continuité de la sécurité de l’information
processus (2.61) et procédures visant à assurer la continuité des opérations liées à la sécurité de
l’information (2.33)
6 © ISO/IEC 2016 – Tous droits réservés
---------------------- Page: 11 ----------------------
ISO/IEC 27000:2016(F)
2.35
événement lié à la sécurité de l’information
occurrence identifiée de l’état d’un système, d’un service ou d’un réseau indiquant une faille possible
dans la politique (2.60) de sécurité de l’information (2.33) ou un échec des mesures de sécurité (2.16), ou
encore une situation inconnue jusqu’alors et pouvant relever de la sécurité
2.36
incident lié à la sécurité de l’information
un ou plusieurs événements liés à la sécurité de l’information (2.35), indésirables ou inattendus,
présentant une probabilité forte de compromettre les opérations liées à l’activité de l’organisme et de
menacer la sécurité de l’information (2.33)
2.37
gestion des incidents liés à la sécurité de l’information
processus (2.61) visant à détecter, rapporter, apprécier, gérer et résoudre les incidents liés à la sécurité de
l’information (2.36), ainsi qu’à en tirer des enseignements
2.38
communauté de partage d’informations
groupe d’organismes (2.57) qui s’accorden
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.