ARK Cybersecurity Terminology
type: Ontology
type: NamedIndividual
abstract: This taxonomy defines cybersecurity terms, taken from ISO and NIST documents, that are used to model this domain on the ARK Platform. Due to copyright restrictions, no definitions are provided for ISO terms.
access rights: PUBLIC
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
format: text/turtle
license: https://creativecommons.org/licenses/by/4.0/
modified: 2024-05-29
rights: ©2024 ARK
status: draft
preferred namespace prefix: arkcyt
code repository: ARKControlOntology
type: ConceptScheme
type: Distribution
version info: 0.1
status: unstable
access URL: https://openark.adaptcentre.ie/Ontologies/ARKControlOntology/ontology.ttl
byte size: 250KB
download URL: https://openark.adaptcentre.ie/Ontologies/ARKControlOntology/ontology.ttl
introduction: This taxonomy defines cybersecurity terms, taken from ISO and NIST documents, that are used to model this domain on the ARK Platform. Due to copyright restrictions, no definitions are provided for ISO terms.
rdfxml serialization: ontology.ttl

Access control
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: means to ensure that access to assets is authorized and restricted based on business and security requirements
broader: Information security
in scheme: ARK Cybersecurity Terminology

Application security
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications.
in scheme: ARK Cybersecurity Terminology

Asset management
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: An ISCM capability that identifies unauthorized software or unmanaged devices that are likely to be used by attackers as a platform from which to extend compromise of the network to be mitigated.
in scheme: ARK Cybersecurity Terminology

Attack
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset.
broader: Information security incident
in scheme: ARK Cybersecurity Terminology

Audit
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: systematic, independent and documented process (3.54) for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party), and it can be a combined audit (combining two or more disciplines). Note 2 to entry: An internal audit is conducted by the organization itself, or by an external party on its behalf. Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.
in scheme: ARK Cybersecurity Terminology
narrower: Combined audit
narrower: External audit
narrower: Internal audit

Audit scope
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: extent and boundaries of an audit (3.3)
broader: Audit
in scheme: ARK Cybersecurity Terminology

Authentication
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: provision of assurance that a claimed characteristic of an entity is correct.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Authenticity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: property that an entity is what it claims to be.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Availability
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
created: 2024-04-08
source: ISO/IEC 27002:2022(E)
source: ISO27000:2018
type: Concept
comment: Ensuring timely and reliable access to and use of information.
comment: property of being accessible and usable on demand by an authorized entity.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Base measure
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: measure (3.42) defined in terms of an attribute and the method for quantifying it Note 1 to entry: A base measure is functionally independent of other measures.
broader: Measure
in scheme: ARK Cybersecurity Terminology

Capabilities context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2030
type: Concept
comment: Context capabilities are essential capabilities to get things done for a company. The context capabilities constitute the transactional services that typically are under the radar but surface when they do not work well. For example, Finance and Accounting are context capabilities for most companies.
in scheme: ARK Cybersecurity Terminology

Combined audit
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2021
type: Concept
comment: A combined audit is an efficient and cost-effective approach for organizations seeking to comply with multiple standards or regulatory requirements.
in scheme: ARK Cybersecurity Terminology

Competence
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: ability to apply knowledge and skills to achieve intended results.
in scheme: ARK Cybersecurity Terminology

Competitive environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2024
type: Concept
comment: landscape in which various organizations, service providers, and technology developers operate, compete, and collaborate to offer cybersecurity solutions and services.
in scheme: ARK Cybersecurity Terminology

Confidentiality
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
created: 2024-04-08
source: ISO/IEC 27002:2022(E)
source: ISO27000:2018
type: Concept
comment: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
comment: property that information is not made available or disclosed to unauthorized individuals, entities, or processes (3.54)
broader: Information security
in scheme: ARK Cybersecurity Terminology

Conformity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: fulfilment of a requirement (3.56)
broader: Requirement
in scheme: ARK Cybersecurity Terminology

Consequence
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: outcome of an event (3.21) affecting objectives (3.49) Note 1 to entry: An event can lead to a range of consequences. Note 2 to entry: A consequence can be certain or uncertain and, in the context of information security, is usually negative. Note 3 to entry: Consequences can be expressed qualitatively or quantitatively. Note 4 to entry: Initial consequences can escalate through knock-on effects.
broader: Event
in scheme: ARK Cybersecurity Terminology

Continual improvement
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: recurring activity to enhance performance (3.52)
broader: Performance
in scheme: ARK Cybersecurity Terminology

Continuity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: The probability that the specified PNT system performance will be maintained for the duration of a phase of operation, presuming that the PNT system was available at the beginning of that phase of operation.
in scheme: ARK Cybersecurity Terminology

Contractual Context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2037
type: Concept
comment: A contextual theory of contract law also recognizes a number of phenomena. First, contract interpretation, through the lens of context, should be used to regulate influences that question the purity of the freedom of contract upon which most agreements are based.
in scheme: ARK Cybersecurity Terminology

Control
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: measure that is modifying risk (3.61) Note 1 to entry: Controls include any process (3.54), policy (3.53), device, practice, or other actions which modify risk (3.61). Note 2 to entry: It is possible that controls not always exert the intended or assumed modifying effect.
broader: Risk
in scheme: ARK Cybersecurity Terminology

Control objective
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: statement describing what is to be achieved as a result of implementing controls (3.14)
broader: Control
in scheme: ARK Cybersecurity Terminology

Correction
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: action to eliminate a detected nonconformity (3.47)
broader: Nonconformity
in scheme: ARK Cybersecurity Terminology

Corrective action
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: action to eliminate the cause of a nonconformity (3.47) and to prevent recurrence.
broader: Nonconformity
in scheme: ARK Cybersecurity Terminology

Cultural environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2048
type: Concept
comment: Cultural environment in cybersecurity
in scheme: ARK Cybersecurity Terminology

Culture context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2053
type: Concept
comment: Culture context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Decision making process context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2033
type: Concept
comment: The decision-making process in cybersecurity is a critical aspect of organizational governance, risk management, and resilience. By following a systematic approach to identify objectives, assess risks, evaluate options, and implement effective measures, organizations can make informed decisions that mitigate cyber threats, protect assets, and support business objectives.
in scheme: ARK Cybersecurity Terminology

Defence
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: is a layered approach to cyber security that covers five important elements: detection, protection, management, response and recovery.
in scheme: ARK Cybersecurity Terminology

Derived measure
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: measure (3.42) that is defined as a function of two or more values of base measures (3.8)
broader: Measure
in scheme: ARK Cybersecurity Terminology

Detect
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Develop and implement appropriate activities to identify the occurrence of a cyber security event.
in scheme: ARK Cybersecurity Terminology

Documented information
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: information required to be controlled and maintained by an organization (3.50) and the medium on which it is contained Note 1 to entry: Documented information can be in any format and media and from any source. Note 2 to entry: Documented information can refer to — the management system (3.41), including related processes (3.54); — information created in order for the organization (3.50) to operate (documentation); — evidence of results achieved (records).
in scheme: ARK Cybersecurity Terminology

Economic environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2052
type: Concept
comment: Economic environment in cybersecurity
in scheme: ARK Cybersecurity Terminology

Effectiveness
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: extent to which planned activities are realized and planned results achieved.
in scheme: ARK Cybersecurity Terminology

Event
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: occurrence or change of a particular set of circumstances Note 1 to entry: An event can be one or more occurrences, and can have several causes. Note 2 to entry: An event can consist of something not happening. Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”.
in scheme: ARK Cybersecurity Terminology

External audit
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2020
type: Concept
comment: An external audit is performed by an independent auditor or auditing firm not affiliated with the organization being audited.
in scheme: ARK Cybersecurity Terminology

External context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: external environment in which the organization seeks to achieve its objectives (3.49) Note 1 to entry: External context can include the following: — the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive environment, whether international, national, regional or local; — key drivers and trends having impact on the objectives of the organization (3.50); — relationships with, and perceptions and values of, external stakeholders (3.37).
in scheme: ARK Cybersecurity Terminology
narrower: External envrionment
narrower: External stakeholder
narrower: Key drivers and trends

External Environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-28
source: ISO27000:2018
type: Concept
comment: External Environment in cybersecurity
in scheme: ARK Cybersecurity Terminology
narrower: Competitive environment
narrower: Cultural environment
narrower: Economic environment
narrower: Financial environment
narrower: Legal environment
narrower: Natural environment
narrower: Political environment
narrower: Regulatory environment
narrower: Social environment
narrower: Technological environment

External envrionment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2046
type: Concept
comment: External envrionment in cybersecurity
in scheme: ARK Cybersecurity Terminology

External stakeholder
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2023
type: Concept
comment: person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision or activity
in scheme: ARK Cybersecurity Terminology

Financial environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2022
type: Concept
comment: The financial environment encompasses all external and internal factors that influence financial decision-making within an economy or organization.
in scheme: ARK Cybersecurity Terminology

Governance
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: A set of processes that ensures that data assets are formally managed throughout the enterprise. A data governance model establishes authority and management and decision making parameters related to the data produced or managed by the enterprise.
in scheme: ARK Cybersecurity Terminology

Governance context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2051
type: Concept
comment: Governance context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Governance of information security
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: system by which an organization’s (3.50) information security (3.28) activities are directed and controlled.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Governance and ecosystem
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: an approach that merges different disciplines to explore ways that human can protect the environment and maintain activities in a sustainable manner.
in scheme: ARK Cybersecurity Terminology

Governing body
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: person or group of people who are accountable for the performance (3.52) and conformity of the organization (3.50) Note 1 to entry: The governing body can, in some jurisdictions, be a board of directors.
broader: Organization
in scheme: ARK Cybersecurity Terminology

Guidelines context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2032
type: Concept
comment: Guidelines Context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Human resource security
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Human Resources Security is a set of processes designed to ensure that all employees, suppliers, and contractors are qualified for and understand their engagement/job tasks and responsibilities, and that access is revoked after the engagement is finished.
in scheme: ARK Cybersecurity Terminology

Identify
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Develop the organisation’s understanding to manage cyber security risk to systems, assets, data and capabilities.
in scheme: ARK Cybersecurity Terminology

Identity and access management
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Access Management is the set of practices that enables only those permitted the ability to perform an action on a particular resource. The three most common Access Management services you encounter every day perhaps without realizing it are: Policy Administration, Authentication, and Authorization.
in scheme: ARK Cybersecurity Terminology

Indicator
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: measure (3.42) that provides an estimate or evaluation.
broader: Measure
in scheme: ARK Cybersecurity Terminology

Information flow context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2041
type: Concept
comment: Information flow control adds metadata to data flows (data transfer across networks, files read from the disc, and so on) and ensures that sensitive data does not flow from a higher security context to a lower security context.
in scheme: ARK Cybersecurity Terminology

Information need
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: insight necessary to manage objectives (3.49), goals, risks and problems.
in scheme: ARK Cybersecurity Terminology

Information processing facility
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: any information processing system, service or infrastructure, or the physical location housing it.
in scheme: ARK Cybersecurity Terminology

Information protection
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Ensur(ing) that any data contained in a resource is not available when the resource is de-allocated from one object and reallocated to a different object.
in scheme: ARK Cybersecurity Terminology

Information security
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: preservation of confidentiality (3.10), integrity (3.36) and availability (3.7) of information Note 1 to entry: In addition, other properties, such as authenticity (3.6), accountability, non-repudiation (3.48), and reliability (3.55) can also be involved.
in scheme: ARK Cybersecurity Terminology

Information security assurance
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy.
in scheme: ARK Cybersecurity Terminology

Information security continuity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: processes (3.54) and procedures for ensuring continued information security (3.28) operations.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Information security event
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: identified occurrence of a system, service or network state indicating a possible breach of information security (3.28) policy (3.53) or failure of controls (3.14), or a previously unknown situation that can be security relevant.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Information security event management
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: A program that provides centralized logging capabilities for a variety of log types.
in scheme: ARK Cybersecurity Terminology

Information security incident
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: single or a series of unwanted or unexpected information security events (3.30) that have a significant probability of compromising business operations and threatening information security (3.28)
broader: Information security
in scheme: ARK Cybersecurity Terminology

Information security incident management
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: set of processes (3.54) for detecting, reporting, assessing, responding to, dealing with, and learning from information security incidents (3.31)
broader: Information security incident
in scheme: ARK Cybersecurity Terminology

Information security management system professional
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: person who establishes, implements, maintains and continuously improves one or more information security management system processes (3.54)
broader: Information security incident management
in scheme: ARK Cybersecurity Terminology

Information sharing community
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: group of organizations (3.50) that agree to share information Note 1 to entry: An organization can be an individual.
in scheme: ARK Cybersecurity Terminology

Information system
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: set of applications, services, information technology assets, or other information-handling components.
in scheme: ARK Cybersecurity Terminology

InformationSystemContext
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2044
type: Concept
comment: Information system context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Integreity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.
in scheme: ARK Cybersecurity Terminology

Integrity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: property of accuracy and completenes.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Interested party
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision or activity.
in scheme: ARK Cybersecurity Terminology

Internal audit
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2019
type: Concept
comment: An internal audit is conducted by the organization itself, or by an external party on its behalf.
in scheme: ARK Cybersecurity Terminology

Internal context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: internal environment in which the organization (3.50) seeks to achieve its objectives Note 1 to entry: Internal context can include: — governance, organizational structure, roles and accountabilities; — policies (3.53), objectives (3.49), and the strategies that are in place to achieve them; — the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes (3.54), systems and technologies); — information systems (3.35), information flows and decision-making processes (both formal and informal); — relationships with, and perceptions and values of, internal stakeholders (3.37); — the organization's culture; — standards, guidelines and models adopted by the organization; — form and extent of contractual relationships.
in scheme: ARK Cybersecurity Terminology
narrower: Capabilities context
narrower: Contractual Context
narrower: Culture context
narrower: Decision making process context
narrower: Governance context
narrower: Guidelines context
narrower: Information flow context
narrower: InformationSystemContext
narrower: Internal stakeholder context
narrower: Models context
narrower: Objective context
narrower: Organisational structure context
narrower: Organizational accountability context
narrower: Organizational role context
narrower: Policy context
narrower: Standards Context
narrower: Strategy context

Internal stakeholder context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2049
type: Concept
comment: Internal stakeholder context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Key drivers and trends
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2025
type: Concept
comment: The cybersecurity landscape is continually evolving, driven by a range of key factors and emerging trends. These drivers and trends shape the strategies of businesses, governments, and cybersecurity providers as they work to protect against increasingly sophisticated cyber threats.
in scheme: ARK Cybersecurity Terminology

Legal and compliance
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: A comprehensive review of an organization's adherence to governing documents such as whether a Certification Practice Statement satisfies the requirements of a Certificate Policy and whether an organization adheres to its Certification Practice Statement.
in scheme: ARK Cybersecurity Terminology

Legal environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2036
type: Concept
comment: understanding the legal frameworks in which a business operates so that compliance can be achieved and maintained.
in scheme: ARK Cybersecurity Terminology

Level of risk
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: magnitude of a risk (3.61) expressed in terms of the combination of consequences (3.12) and their likelihood (3.40)
broader: Risk
in scheme: ARK Cybersecurity Terminology

Likelihood
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: chance of something happening.
broader: Risk
in scheme: ARK Cybersecurity Terminology

Management system
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: set of interrelated or interacting elements of an organization (3.50) to establish policies (3.53) and objectives (3.49) and processes (3.54) to achieve those objectives Note 1 to entry: A management system can address a single discipline or several disciplines. Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning and operation. Note 3 to entry: The scope of a management system may include the whole of the organization, specific and identified functions of the organization, specific and identified sections of the organization, or one or more functions across a group of organizations.
in scheme: ARK Cybersecurity Terminology

Measure
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: variable to which a value is assigned as the result of measurement (3.43)
broader: Measurement
in scheme: ARK Cybersecurity Terminology

Measurement
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: process (3.54) to determine a value
in scheme: ARK Cybersecurity Terminology

Measurement function
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: algorithm or calculation performed to combine two or more base measures (3.8)
broader: Measurement
in scheme: ARK Cybersecurity Terminology

Measurement method
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: logical sequence of operations, described generically, used in quantifying an attribute with respect to a specified scale Note 1 to entry: The type of measurement method depends on the nature of the operations used to quantify an attribute (3.4). Two types can be distinguished: — subjective: quantification involving human judgment; and — objective: quantification based on numerical rules.
broader: Measurement
in scheme: ARK Cybersecurity Terminology

Models context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2040
type: Concept
comment: Models context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Monitoring
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: determining the status of a system, a process (3.54) or an activity Note 1 to entry: To determine the status, there may be a need to check, supervise or critically observe.
in scheme: ARK Cybersecurity Terminology

Natural environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2038
type: Concept
comment: The natural environment consists of land-based ecosystems such as grasslands and forests, aquatic ecosystems such as rivers and wetlands, and coastal and marine ecosystems such as mangroves and sea-grass meadows.
in scheme: ARK Cybersecurity Terminology

Nonconformity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: non-fulfilment of a requirement (3.56)
broader: Requirement
in scheme: ARK Cybersecurity Terminology

Non-repudiation
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: ability to prove the occurrence of a claimed event (3.21) or action and its originating entities.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Objective
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: result to be achieved Note 1 to entry: An objective can be strategic, tactical, or operational. Note 2 to entry: Objectives can relate to different disciplines (such as financial, health and safety, and environmental goals) and can apply at different levels [such as strategic, organization-wide, project, product and process (3.54)]. Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an operational criterion, as an information security objective or by the use of other words with similar meaning (e.g. aim, goal, or target). Note 4 to entry: In the context of information security management systems, information security objectives are set by the organization, consistent with the information security policy, to achieve specific results.
broader: Management system
in scheme: ARK Cybersecurity Terminology

Objective context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2043
type: Concept
comment: Objective context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Organisational structure context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2027
type: Concept
comment: The organizational structure in the context of cybersecurity refers to how a company is organized to effectively manage and implement its cybersecurity strategies and practices.
in scheme: ARK Cybersecurity Terminology

Organization
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives (3.49) Note 1 to entry: The concept of organization includes but is not limited to sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.
in scheme: ARK Cybersecurity Terminology

Organizational accountability context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2054
type: Concept
comment: Organizational accountability context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Organizational role context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2045
type: Concept
comment: Organizational role context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Outsource
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: make an arrangement where an external organization (3.50) performs part of an organization’s function or process (3.54) Note 1 to entry: An external organization is outside the scope of the management system (3.41), although the outsourced function or process is within the scope.
broader: Organization
in scheme: ARK Cybersecurity Terminology

Performance
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: measurable result Note 1 to entry: Performance can relate either to quantitative or qualitative findings. Note 2 to entry: Performance can relate to the management of activities, processes (3.54), products (including services), systems or organizations (3.50)
broader: Measurement
in scheme: ARK Cybersecurity Terminology

Physical security
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: A set of mutually reinforcing security controls implemented by technical, physical, and procedural means. Such controls are typically selected to achieve a common information security-related purpose.
in scheme: ARK Cybersecurity Terminology

Policy
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: intentions and direction of an organization (3.50), as formally expressed by its top management (3.75)
broader: Management system
in scheme: ARK Cybersecurity Terminology

Policy context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2034
type: Concept
comment: Policy context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Political environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2029
type: Concept
comment: The political environment in the context of cybersecurity refers to the influence of governmental policies, regulations, and actions on cybersecurity practices, strategies, and challenges.
in scheme: ARK Cybersecurity Terminology

Process
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: set of interrelated or interacting activities which transforms inputs into outputs.
broader: Management system
in scheme: ARK Cybersecurity Terminology

Protect
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Develop and implement safeguards to deliver critical infrastructure services.
in scheme: ARK Cybersecurity Terminology

Protection
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: In the context of systems security engineering, a control objective that applies across all types of asset types and the corresponding consequences of loss. A system protection capability is a system control objective and a system design problem. The solution to the problem is optimized through a balanced proactive strategy and a reactive strategy that is not limited to prevention. The strategy also encompasses avoiding asset loss and consequences; detecting asset loss and consequences; minimizing (i.e., limiting, containing, restricting) asset loss and consequences; responding to asset loss and consequences; recovering from asset loss and consequences; and forecasting or predicting asset loss and consequences.
in scheme: ARK Cybersecurity Terminology

Recover
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cyber security event.
in scheme: ARK Cybersecurity Terminology

Regulatory environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2039
type: Concept
comment: that part of the firm's external marketing environment on which legal and political forces act to change regulations which affect the marketing effort
in scheme: ARK Cybersecurity Terminology

Reliability
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: property of consistent intended behaviour and results.
broader: Information security
in scheme: ARK Cybersecurity Terminology

Requirement
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: need or expectation that is stated, generally implied or obligatory Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization and interested parties that the need or expectation under consideration is implied. Note 2 to entry: A specified requirement is one that is stated, for example in documented information.
in scheme: ARK Cybersecurity Terminology

Residual risk
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: risk (3.61) remaining after risk treatment (3.72) Note 1 to entry: Residual risk can contain unidentified risk. Note 2 to entry: Residual risk can also be referred to as “retained risk”.
broader: Risk
in scheme: ARK Cybersecurity Terminology

Resilience
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: The ability of an information system to continue to: (i) operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities; and (ii) recover to an effective operational posture in a time frame consistent with mission needs.
in scheme: ARK Cybersecurity Terminology

Respond
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Create and put into practice the appropriate activities to take action in response to detected cyber security events.
in scheme: ARK Cybersecurity Terminology

Review
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: activity undertaken to determine the suitability, adequacy and effectiveness (3.20) of the subject matter to achieve established objectives (3.49)
in scheme: ARK Cybersecurity Terminology

Review object
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: specific item being reviewed.
broader: Review
in scheme: ARK Cybersecurity Terminology

Review objective
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: statement describing what is to be achieved as a result of a review (3.59)
broader: Review
in scheme: ARK Cybersecurity Terminology

©2024 ARK
type: NamedIndividual
rights: This work is licensed under a Creative Commons Attribution 4.0 International License.
type: RightsStatement

Risk
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: effect of uncertainty on objectives (3.49) Note 1 to entry: An effect is a deviation from the expected — positive or negative. Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood. Note 3 to entry: Risk is often characterized by reference to potential “events” (as defined in ISO Guide 73:2009, 3.5.1.3) and “consequences” (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these. Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated “likelihood” (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence. Note 5 to entry: In the context of information security management systems, information security risks can be expressed as effect of uncertainty on information security objectives. Note 6 to entry: Information security risk is associated with the potential that threats will exploit vulnerabilities of an information asset or group of information assets and thereby cause harm to an organization.
in scheme: ARK Cybersecurity Terminology

Risk acceptance
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: informed decision to take a particular risk (3.61) Note 1 to entry: Risk acceptance can occur without risk treatment (3.72) or during the process (3.54) of risk treatment. Note 2 to entry: Accepted risks are subject to monitoring (3.46) and review (3.58).
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk analysis
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: process (3.54) to comprehend the nature of risk (3.61) and to determine the level of risk (3.39) Note 1 to entry: Risk analysis provides the basis for risk evaluation (3.67) and decisions about risk treatment (3.72). Note 2 to entry: Risk analysis includes risk estimation.
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk assessment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: overall process (3.54) of risk identification (3.68), risk analysis (3.63) and risk evaluation (3.67)
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk communication and consultation
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: set of continual and iterative processes (3.54) that an organization conducts to provide, share or obtain information, and to engage in dialogue with stakeholders (3.37) regarding the management of risk (3.61) Note 1 to entry: The information can relate to the existence, nature, form, likelihood (3.41), significance, evaluation, acceptability and treatment of risk. Note 2 to entry: Consultation is a two-way process of informed communication between an organization (3.50) and its stakeholders on an issue prior to making a decision or determining a direction on that issue. Consultation is — a process which impacts on a decision through influence rather than power; and — an input to decision making, not joint decision making.
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk criteria
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: terms of reference against which the significance of risk (3.61) is evaluated Note 1 to entry: Risk criteria are based on organizational objectives, and external context (3.22) and internal context (3.38). Note 2 to entry: Risk criteria can be derived from standards, laws, policies (3.53) and other requirements (3.56).
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk evaluation
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: process (3.54) of comparing the results of risk analysis (3.63) with risk criteria (3.66) to determine whether the risk (3.61) and/or its magnitude is acceptable or tolerable Note 1 to entry: Risk evaluation assists in the decision about risk treatment (3.72).
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk identification
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: process (3.54) of finding, recognizing and describing risks (3.61) Note 1 to entry: Risk identification involves the identification of risk sources, events (3.21), their causes and their potential consequences (3.12). Note 2 to entry: Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and stakeholders’ (3.37) needs.
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk management
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: coordinated activities to direct and control an organization (3.50) with regard to risk (3.61)
broader: Risk
in scheme: ARK Cybersecurity Terminology

Risk management process
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: systematic application of management policies (3.53), procedures and practices to the activities of communicating, consulting, establishing the context and identifying, analysing, evaluating, treating, monitoring and reviewing risk (3.61) Note 1 to entry: ISO/IEC 27005 uses the term “process” (3.54) to describe risk management overall. The elements within the risk management (3.69) process are referred to as “activities”.
broader: Risk management
in scheme: ARK Cybersecurity Terminology

Risk owner
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: person or entity with the accountability and authority to manage a risk (3.61)
broader: Risk management
in scheme: ARK Cybersecurity Terminology

Risk treatment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: process (3.54) to modify risk (3.61) Note 1 to entry: Risk treatment can involve: — avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk; — taking or increasing risk in order to pursue an opportunity; — removing the risk source; — changing the likelihood (3.40); — changing the consequences (3.12); — sharing the risk with another party or parties (including contracts and risk financing); — retaining the risk by informed choice. Note 2 to entry: Risk treatments that deal with negative consequences are sometimes referred to as “risk mitigation”, “risk elimination”, “risk prevention” and “risk reduction”. Note 3 to entry: Risk treatment can create new risks or modify existing risks.
broader: Risk management
in scheme: ARK Cybersecurity Terminology

Secure configuration
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: A recognized standardized and established benchmark (e.g., National Checklist Program, DISA STIGs, CIS Benchmarks, etc.) that stipulates specific secure configuration settings for a given IT platform.
in scheme: ARK Cybersecurity Terminology

Security implementation standard
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: document specifying authorized ways for realizing security.
in scheme: ARK Cybersecurity Terminology

Social environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2042
type: Concept
comment: Social environment in cybersecurity
in scheme: ARK Cybersecurity Terminology

Stakeholder Context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-28
source: ISO27000:2018
type: Concept
comment: Stakeholder Context in cybersecurity
in scheme: ARK Cybersecurity Terminology
narrower: Stakeholder perception
narrower: Stakeholder relationship
narrower: Stakeholder value

Stakeholder perception
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2035
type: Concept
comment: The stakeholder perception approach refers to the way stakeholders perceive and evaluate the actions and behavior of a company or organization.
in scheme: ARK Cybersecurity Terminology

Stakeholder relationship
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2031
type: Concept
comment: professional connections businesses form with people or groups who have an interest in their activities and decisions.
in scheme: ARK Cybersecurity Terminology

Stakeholder value
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2026
type: Concept
comment: Stakeholder value refers to the benefits and advantages that various stakeholders derive from an organization's activities, policies, and performance.
in scheme: ARK Cybersecurity Terminology

Standards Context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2028
type: Concept
comment: Standards in the context of cybersecurity are established frameworks, guidelines, and specifications that organizations follow to ensure their systems, processes, and practices are secure and resilient against cyber threats.
in scheme: ARK Cybersecurity Terminology

Strategy context
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2047
type: Concept
comment: Strategy context in cybersecurity
in scheme: ARK Cybersecurity Terminology

Supplier relationship security
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: In a supplier relationship, it is important for an organisation to ensure that its information is protected against risks such as data breaches, unauthorized access, or loss of confidentiality. This can be achieved through a combination of technical and organisational measures and through establishing clear policies and procedures for handling and protecting information.
in scheme: ARK Cybersecurity Terminology

System and network security
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: Protecting network communications at the layer of the IP model that is responsible for routing packets across networks.
in scheme: ARK Cybersecurity Terminology

Technological environment
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2050
type: Concept
comment: Technological environment om cybersecurity
in scheme: ARK Cybersecurity Terminology

Threat
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: potential cause of an unwanted incident, which can result in harm to a system or organization (3.50)
broader: Information security incident
in scheme: ARK Cybersecurity Terminology

Threat and vulnerability management
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-03-14
source: ISO/IEC 27002:2022(E)
type: Concept
comment: An ISCM capability that identifies vulnerabilities [Common Vulnerabilities and Exposures (CVEs)] on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to the network.
in scheme: ARK Cybersecurity Terminology

Top management
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: person or group of people who directs and controls an organization (3.50) at the highest level Note 1 to entry: Top management has the power to delegate authority and provide resources within the organization. Note 2 to entry: If the scope of the management system (3.41) covers only part of an organization, then top management refers to those who direct and control that part of the organization. Note 3 to entry: Top management is sometimes called executive management and can include Chief Executive Officers, Chief Financial Officers, Chief Information Officers, and similar roles.
broader: Organization
in scheme: ARK Cybersecurity Terminology

Trusted information communication entity
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: autonomous organization (3.50) supporting information exchange within an information sharing community (3.34)
in scheme: ARK Cybersecurity Terminology

Vulnerability
type: NamedIndividual
contributor: Junli Liang
contributor: Rob Brennan
created: 2024-04-08
source: ISO27000:2018
type: Concept
comment: weakness of an asset or control (3.14) that can be exploited by one or more threats (3.74)
in scheme: ARK Cybersecurity Terminology