This taxonomy defines cybersecurity terms, taken from ISO and NIST documents, that are used to model this domain on the ARK Platform. Due to copyright restrictions, no definitions are provided for ISO terms.
ARK Cybersecurity Terminology
means to ensure that access to assets is authorized and restricted based on business and security requirements
Access control
includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications.
Application security
An ISCM capability that identifies unauthorized software or unmanaged devices that are likely to be used by attackers as a platform from which to extend compromise of the network to be mitigated.
Asset management
attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset.
Attack
systematic, independent and documented process (3.54) for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party), and it can be a combined audit (combining two or more disciplines). Note 2 to entry: An internal audit is conducted by the organization itself, or by an external party on its behalf. Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.
Audit
extent and boundaries of an audit (3.3)
Audit scope
provision of assurance that a claimed characteristic of an entity is correct.
Authentication
property that an entity is what it claims to be.
Authenticity
Ensuring timely and reliable access to and use of information.
property of being accessible and usable on demand by an authorized entity.
Availability
measure (3.42) defined in terms of an attribute and the method for quantifying it Note 1 to entry: A base measure is functionally independent of other measures.
Base measure
Context capabilities are essential capabilities to get things done for a company. The context capabilities constitute the transactional services that typically are under the radar but surface when they do not work well. For example, Finance and Accounting are context capabilities for most companies.
Capabilities context
A combined audit is an efficient and cost-effective approach for organizations seeking to comply with multiple standards or regulatory requirements.
Combined audit
ability to apply knowledge and skills to achieve intended results.
Competence
landscape in which various organizations, service providers, and technology developers operate, compete, and collaborate to offer cybersecurity solutions and services.
Competitive environment
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
property that information is not made available or disclosed to unauthorized individuals, entities, or processes (3.54)
Confidentiality
fulfilment of a requirement (3.56)
Conformity
outcome of an event (3.21) affecting objectives (3.49) Note 1 to entry: An event can lead to a range of consequences. Note 2 to entry: A consequence can be certain or uncertain and, in the context of information security, is usually negative. Note 3 to entry: Consequences can be expressed qualitatively or quantitatively. Note 4 to entry: Initial consequences can escalate through knock-on effects.
Consequence
recurring activity to enhance performance (3.52)
Continual improvement
The probability that the specified PNT system performance will be maintained for the duration of a phase of operation, presuming that the PNT system was available at the beginning of that phase of operation.
Continuity
A contextual theory of contract law also recognizes a number of phenomena. First, contract interpretation, through the lens of context, should be used to regulate influences that question the purity of the freedom of contract upon which most agreements are based.
Contractual Context
measure that is modifying risk (3.61) Note 1 to entry: Controls include any process (3.54), policy (3.53), device, practice, or other actions which modify risk (3.61). Note 2 to entry: It is possible that controls not always exert the intended or assumed modifying effect.
Control
statement describing what is to be achieved as a result of implementing controls (3.14)
Control objective
action to eliminate a detected nonconformity (3.47)
Correction
action to eliminate the cause of a nonconformity (3.47) and to prevent recurrence.
Corrective action
Cultural environment in cybersecurity
Cultural environment
Culture context in cybersecurity
Culture context
The decision-making process in cybersecurity is a critical aspect of organizational governance, risk management, and resilience. By following a systematic approach to identify objectives, assess risks, evaluate options, and implement effective measures, organizations can make informed decisions that mitigate cyber threats, protect assets, and support business objectives.
Decision making process context
is a layered approach to cyber security that covers five important elements: detection, protection, management, response and recovery.
Defence
measure (3.42) that is defined as a function of two or more values of base measures (3.8)
Derived measure
Develop and implement appropriate activities to identify the occurrence of a cyber security event.
Detect
information required to be controlled and maintained by an organization (3.50) and the medium on which it is contained Note 1 to entry: Documented information can be in any format and media and from any source. Note 2 to entry: Documented information can refer to — the management system (3.41), including related processes (3.54); — information created in order for the organization (3.50) to operate (documentation); — evidence of results achieved (records).
Documented information
Economic environment in cybersecurity
Economic environment
extent to which planned activities are realized and planned results achieved.
Effectiveness
occurrence or change of a particular set of circumstances Note 1 to entry: An event can be one or more occurrences, and can have several causes. Note 2 to entry: An event can consist of something not happening. Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”.
Event
An external audit is performed by an independent auditor or auditing firm not affiliated with the organization being audited.
External audit
external environment in which the organization seeks to achieve its objectives (3.49) Note 1 to entry: External context can include the following: — the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive environment, whether international, national, regional or local; — key drivers and trends having impact on the objectives of the organization (3.50); — relationships with, and perceptions and values of, external stakeholders (3.37).
External context
External Environment in cybersecurity
External Environment
External envrionment in cybersecurity
External envrionment
person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision or activity
External stakeholder
The financial environment encompasses all external and internal factors that influence financial decision-making within an economy or organization.
Financial environment
A set of processes that ensures that data assets are formally managed throughout the enterprise. A data governance model establishes authority and management and decision making parameters related to the data produced or managed by the enterprise.
Governance
Governance context in cybersecurity
Governance context
system by which an organization’s (3.50) information security (3.28) activities are directed and controlled.
Governance of information security
an approach that merges different disciplines to explore ways that human can protect the environment and maintain activities in a sustainable manner.
Governance and ecosystem
person or group of people who are accountable for the performance (3.52) and conformity of the organization (3.50) Note 1 to entry: The governing body can, in some jurisdictions, be a board of directors.
Governing body
Guidelines Context in cybersecurity
Guidelines context
Human Resources Security is a set of processes designed to ensure that all employees, suppliers, and contractors are qualified for and understand their engagement/job tasks and responsibilities, and that access is revoked after the engagement is finished.
Human resource security
Develop the organisation’s understanding to manage cyber security risk to systems, assets, data and capabilities.
Identify
Access Management is the set of practices that enables only those permitted the ability to perform an action on a particular resource. The three most common Access Management services you encounter every day perhaps without realizing it are: Policy Administration, Authentication, and Authorization.
Identity and access management
measure (3.42) that provides an estimate or evaluation.
Indicator
Information flow control adds metadata to data flows (data transfer across networks, files read from the disc, and so on) and ensures that sensitive data does not flow from a higher security context to a lower security context.
Information flow context
insight necessary to manage objectives (3.49), goals, risks and problems.
Information need
any information processing system, service or infrastructure, or the physical location housing it.
Information processing facility
Ensur(ing) that any data contained in a resource is not available when the resource is de-allocated from one object and reallocated to a different object.
Information protection
preservation of confidentiality (3.10), integrity (3.36) and availability (3.7) of information Note 1 to entry: In addition, other properties, such as authenticity (3.6), accountability, non-repudiation (3.48), and reliability (3.55) can also be involved.
Information security
Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy.
Information security assurance
processes (3.54) and procedures for ensuring continued information security (3.28) operations.
Information security continuity
identified occurrence of a system, service or network state indicating a possible breach of information security (3.28) policy (3.53) or failure of controls (3.14), or a previously unknown situation that can be security relevant.
Information security event
A program that provides centralized logging capabilities for a variety of log types.
Information security event management
single or a series of unwanted or unexpected information security events (3.30) that have a significant probability of compromising business operations and threatening information security (3.28)
Information security incident
set of processes (3.54) for detecting, reporting, assessing, responding to, dealing with, and learning from information security incidents (3.31)
Information security incident management
person who establishes, implements, maintains and continuously improves one or more information security management system processes (3.54)
Information security management system professional
group of organizations (3.50) that agree to share information Note 1 to entry: An organization can be an individual.
Information sharing community
set of applications, services, information technology assets, or other information-handling components.
Information system
Information system context in cybersecurity
InformationSystemContext
Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.
Integreity
property of accuracy and completenes.
Integrity
person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision or activity.
Interested party
An internal audit is conducted by the organization itself, or by an external party on its behalf.
Internal audit
internal environment in which the organization (3.50) seeks to achieve its objectives Note 1 to entry: Internal context can include: — governance, organizational structure, roles and accountabilities; — policies (3.53), objectives (3.49), and the strategies that are in place to achieve them; — the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes (3.54), systems and technologies); — information systems (3.35), information flows and decision-making processes (both formal and informal); — relationships with, and perceptions and values of, internal stakeholders (3.37); — the organization's culture; — standards, guidelines and models adopted by the organization; — form and extent of contractual relationships.
Internal context
Internal stakeholder context in cybersecurity
Internal stakeholder context
The cybersecurity landscape is continually evolving, driven by a range of key factors and emerging trends. These drivers and trends shape the strategies of businesses, governments, and cybersecurity providers as they work to protect against increasingly sophisticated cyber threats.
Key drivers and trends
A comprehensive review of an organization's adherence to governing documents such as whether a Certification Practice Statement satisfies the requirements of a Certificate Policy and whether an organization adheres to its Certification Practice Statement.
Legal and compliance
understanding the legal frameworks in which a business operates so that compliance can be achieved and maintained.
Legal environment
magnitude of a risk (3.61) expressed in terms of the combination of consequences (3.12) and their likelihood (3.40)
Level of risk
chance of something happening.
Likelihood
set of interrelated or interacting elements of an organization (3.50) to establish policies (3.53) and objectives (3.49) and processes (3.54) to achieve those objectives Note 1 to entry: A management system can address a single discipline or several disciplines. Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning and operation. Note 3 to entry: The scope of a management system may include the whole of the organization, specific and identified functions of the organization, specific and identified sections of the organization, or one or more functions across a group of organizations.
Management system
variable to which a value is assigned as the result of measurement (3.43)
Measure
process (3.54) to determine a value
Measurement
algorithm or calculation performed to combine two or more base measures (3.8)
Measurement function
logical sequence of operations, described generically, used in quantifying an attribute with respect to a specified scale Note 1 to entry: The type of measurement method depends on the nature of the operations used to quantify an attribute (3.4). Two types can be distinguished: — subjective: quantification involving human judgment; and — objective: quantification based on numerical rules.
Measurement method
Models context in cybersecurity
Models context
determining the status of a system, a process (3.54) or an activity Note 1 to entry: To determine the status, there may be a need to check, supervise or critically observe.
Monitoring
The natural environment consists of land-based ecosystems such as grasslands and forests, aquatic ecosystems such as rivers and wetlands, and coastal and marine ecosystems such as mangroves and sea-grass meadows.
Natural environment
non-fulfilment of a requirement (3.56)
Nonconformity
ability to prove the occurrence of a claimed event (3.21) or action and its originating entities.
Non-repudiation
result to be achieved Note 1 to entry: An objective can be strategic, tactical, or operational. Note 2 to entry: Objectives can relate to different disciplines (such as financial, health and safety, and environmental goals) and can apply at different levels [such as strategic, organization-wide, project, product and process (3.54)]. Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an operational criterion, as an information security objective or by the use of other words with similar meaning (e.g. aim, goal, or target). Note 4 to entry: In the context of information security management systems, information security objectives are set by the organization, consistent with the information security policy, to achieve specific results.
Objective
Objective context in cybersecurity
Objective context
The organizational structure in the context of cybersecurity refers to how a company is organized to effectively manage and implement its cybersecurity strategies and practices.
Organisational structure context
person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives (3.49) Note 1 to entry: The concept of organization includes but is not limited to sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.
Organization
Organizational accountability context in cybersecurity
Organizational accountability context
Organizational role context in cybersecurity
Organizational role context
make an arrangement where an external organization (3.50) performs part of an organization’s function or process (3.54) Note 1 to entry: An external organization is outside the scope of the management system (3.41), although the outsourced function or process is within the scope.
Outsource
measurable result Note 1 to entry: Performance can relate either to quantitative or qualitative findings. Note 2 to entry: Performance can relate to the management of activities, processes (3.54), products (including services), systems or organizations (3.50)
Performance
A set of mutually reinforcing security controls implemented by technical, physical, and procedural means. Such controls are typically selected to achieve a common information security-related purpose.
Physical security
intentions and direction of an organization (3.50), as formally expressed by its top management (3.75)
Policy
Policy context in cybersecurity
Policy context
The political environment in the context of cybersecurity refers to the influence of governmental policies, regulations, and actions on cybersecurity practices, strategies, and challenges.
Political environment
set of interrelated or interacting activities which transforms inputs into outputs.
Process
Develop and implement safeguards to deliver critical infrastructure services.
Protect
In the context of systems security engineering, a control objective that applies across all types of asset types and the corresponding consequences of loss. A system protection capability is a system control objective and a system design problem. The solution to the problem is optimized through a balanced proactive strategy and a reactive strategy that is not limited to prevention. The strategy also encompasses avoiding asset loss and consequences; detecting asset loss and consequences; minimizing (i.e., limiting, containing, restricting) asset loss and consequences; responding to asset loss and consequences; recovering from asset loss and consequences; and forecasting or predicting asset loss and consequences.
Protection
Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cyber security event.
Recover
that part of the firm's external marketing environment on which legal and political forces act to change regulations which affect the marketing effort
Regulatory environment
property of consistent intended behaviour and results.
Reliability
need or expectation that is stated, generally implied or obligatory Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization and interested parties that the need or expectation under consideration is implied. Note 2 to entry: A specified requirement is one that is stated, for example in documented information.
Requirement
risk (3.61) remaining after risk treatment (3.72) Note 1 to entry: Residual risk can contain unidentified risk. Note 2 to entry: Residual risk can also be referred to as “retained risk”.
Residual risk
The ability of an information system to continue to: (i) operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities; and (ii) recover to an effective operational posture in a time frame consistent with mission needs.
Resilience
Create and put into practice the appropriate activities to take action in response to detected cyber security events.
Respond
activity undertaken to determine the suitability, adequacy and effectiveness (3.20) of the subject matter to achieve established objectives (3.49)
Review
specific item being reviewed.
Review object
statement describing what is to be achieved as a result of a review (3.59)
Review objective
This work is licensed under a Creative Commons Attribution 4.0 International License.
©2024 ARK
effect of uncertainty on objectives (3.49) Note 1 to entry: An effect is a deviation from the expected — positive or negative. Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of, an event, its consequence, or likelihood. Note 3 to entry: Risk is often characterized by reference to potential “events” (as defined in ISO Guide 73:2009, 3.5.1.3) and “consequences” (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these. Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated “likelihood” (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence. Note 5 to entry: In the context of information security management systems, information security risks can be expressed as effect of uncertainty on information security objectives. Note 6 to entry: Information security risk is associated with the potential that threats will exploit vulnerabilities of an information asset or group of information assets and thereby cause harm to an organization.
Risk
informed decision to take a particular risk (3.61) Note 1 to entry: Risk acceptance can occur without risk treatment (3.72) or during the process (3.54) of risk treatment. Note 2 to entry: Accepted risks are subject to monitoring (3.46) and review (3.58).
Risk acceptance
process (3.54) to comprehend the nature of risk (3.61) and to determine the level of risk (3.39) Note 1 to entry: Risk analysis provides the basis for risk evaluation (3.67) and decisions about risk treatment (3.72). Note 2 to entry: Risk analysis includes risk estimation.
Risk analysis
overall process (3.54) of risk identification (3.68), risk analysis (3.63) and risk evaluation (3.67)
Risk assessment
set of continual and iterative processes (3.54) that an organization conducts to provide, share or obtain information, and to engage in dialogue with stakeholders (3.37) regarding the management of risk (3.61) Note 1 to entry: The information can relate to the existence, nature, form, likelihood (3.41), significance, evaluation, acceptability and treatment of risk. Note 2 to entry: Consultation is a two-way process of informed communication between an organization (3.50) and its stakeholders on an issue prior to making a decision or determining a direction on that issue. Consultation is — a process which impacts on a decision through influence rather than power; and — an input to decision making, not joint decision making.
Risk communication and consultation
terms of reference against which the significance of risk (3.61) is evaluated Note 1 to entry: Risk criteria are based on organizational objectives, and external context (3.22) and internal context (3.38). Note 2 to entry: Risk criteria can be derived from standards, laws, policies (3.53) and other requirements (3.56).
Risk criteria
process (3.54) of comparing the results of risk analysis (3.63) with risk criteria (3.66) to determine whether the risk (3.61) and/or its magnitude is acceptable or tolerable Note 1 to entry: Risk evaluation assists in the decision about risk treatment (3.72).
Risk evaluation
process (3.54) of finding, recognizing and describing risks (3.61) Note 1 to entry: Risk identification involves the identification of risk sources, events (3.21), their causes and their potential consequences (3.12). Note 2 to entry: Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and stakeholders’ (3.37) needs.
Risk identification
coordinated activities to direct and control an organization (3.50) with regard to risk (3.61)
Risk management
systematic application of management policies (3.53), procedures and practices to the activities of communicating, consulting, establishing the context and identifying, analysing, evaluating, treating, monitoring and reviewing risk (3.61) Note 1 to entry: ISO/IEC 27005 uses the term “process” (3.54) to describe risk management overall. The elements within the risk management (3.69) process are referred to as “activities”.
Risk management process
person or entity with the accountability and authority to manage a risk (3.61)
Risk owner
process (3.54) to modify risk (3.61) Note 1 to entry: Risk treatment can involve: — avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk; — taking or increasing risk in order to pursue an opportunity; — removing the risk source; — changing the likelihood (3.40); — changing the consequences (3.12); — sharing the risk with another party or parties (including contracts and risk financing); — retaining the risk by informed choice. Note 2 to entry: Risk treatments that deal with negative consequences are sometimes referred to as “risk mitigation”, “risk elimination”, “risk prevention” and “risk reduction”. Note 3 to entry: Risk treatment can create new risks or modify existing risks.
Risk treatment
A recognized standardized and established benchmark (e.g., National Checklist Program, DISA STIGs, CIS Benchmarks, etc.) that stipulates specific secure configuration settings for a given IT platform.
Secure configuration
document specifying authorized ways for realizing security.
Security implementation standard
Social environment in cybersecurity
Social environment
Stakeholder Context in cybersecurity
Stakeholder Context
The stakeholder perception approach refers to the way stakeholders perceive and evaluate the actions and behavior of a company or organization.
Stakeholder perception
professional connections businesses form with people or groups who have an interest in their activities and decisions.
Stakeholder relationship
Stakeholder value refers to the benefits and advantages that various stakeholders derive from an organization's activities, policies, and performance.
Stakeholder value
Standards in the context of cybersecurity are established frameworks, guidelines, and specifications that organizations follow to ensure their systems, processes, and practices are secure and resilient against cyber threats.
Standards Context
Strategy context in cybersecurity
Strategy context
In a supplier relationship, it is important for an organisation to ensure that its information is protected against risks such as data breaches, unauthorized access, or loss of confidentiality. This can be achieved through a combination of technical and organisational measures and through establishing clear policies and procedures for handling and protecting information.
Supplier relationship security
Protecting network communications at the layer of the IP model that is responsible for routing packets across networks.
System and network security
Technological environment om cybersecurity
Technological environment
potential cause of an unwanted incident, which can result in harm to a system or organization (3.50)
Threat
An ISCM capability that identifies vulnerabilities [Common Vulnerabilities and Exposures (CVEs)] on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to the network.
Threat and vulnerability management
person or group of people who directs and controls an organization (3.50) at the highest level Note 1 to entry: Top management has the power to delegate authority and provide resources within the organization. Note 2 to entry: If the scope of the management system (3.41) covers only part of an organization, then top management refers to those who direct and control that part of the organization. Note 3 to entry: Top management is sometimes called executive management and can include Chief Executive Officers, Chief Financial Officers, Chief Information Officers, and similar roles.
Top management
autonomous organization (3.50) supporting information exchange within an information sharing community (3.34)
Trusted information communication entity
weakness of an asset or control (3.14) that can be exploited by one or more threats (3.74)
Vulnerability