GLOSSARY

Information security terms.

The key terms around ISMS, ISO/IEC 27001, risks and data protection, explained briefly and clearly.

A

Acknowledgement: Confirmation by a person that they have read a policy. In Varmo, a policy can require acknowledgement by all members; with every new valid version, everyone is asked again.Guide: Managing policies with an approval workflow
Approval workflow: Defined sequence of approvers who approve a result, for example a policy or a baseline check. Approvers on the same step sign off independently of each other; the next step begins after the previous one; with the last signature, the version applies.Guide: Managing approvals with the four-eyes principle
Approver: Functional role whose members sign off in an approval workflow. Whoever creates or submits something never approves it themselves (four-eyes principle). If a designated person has been named, they alone receive the task; the other members stand in for them after a deadline has passed or after a handover.Guide: Managing approvals with the four-eyes principle
Asset(information asset, protection object): Anything that has value for an organisation and must be protected: information, business processes, applications, IT systems, rooms or service providers. Every asset has a responsible person, the owner.Learn more Guide: Recording assets and defining dependencies

B

Baseline check: Check in Varmo of whether an asset such as an IT system, a building or a service provider meets the organisation's minimum requirements before it goes into operation. The owner answers the requirements that apply to the asset's category and submits them for approval.Guide: Carrying out the baseline check for assets
BSI IT-Grundschutz: Methodology of the German Federal Office for Information Security (BSI) for information security, described in BSI Standards 200-1 to 200-4 and in the IT-Grundschutz Compendium. It is also widely used as a reference model outside Germany.

C

Criticality: In Varmo, the highest protection requirement of an asset across all security objectives. It passes through the links of the dependency chain to the assets on the lower levels.Guide: Conducting and approving the protection requirements assessment

D

Data protection impact assessment(DPIA): Prior assessment of the risks that a processing of personal data poses to the data subjects. It is required under the Swiss FADP (Art. 22) and the GDPR (Art. 35) if a processing is likely to result in a high risk.
Dependency chain: Ordering of assets according to BSI Standard 200-2 from abstract to physical: information, processes and services, applications, IT systems and networks, and rooms, buildings and service providers. Through the links, the protection requirement of a piece of information passes to the assets on the lower levels, such as the application and the server on which it is stored.Guide: Recording assets and defining dependencies

E

Exception: A deliberately approved, time-limited deviation from a requirement when it temporarily cannot be met. An exception is linked to a risk that must be accepted.Learn more
Extent of damage: In the protection requirements assessment, the estimate of how serious the damage would be in the worst case if a security objective were violated; it determines the protection requirement normal, high or very high. Not to be confused with the impact in the risk assessment.Guide: Conducting and approving the protection requirements assessment

F

Finding: Result of a review, for example from an audit: a major or minor nonconformity with a requirement, an observation or an opportunity for improvement. Nonconformities require a root cause analysis and corrective actions.Guide: Handling internal audits and findings
Four-eyes principle: Principle that a decision or approval is confirmed by a second, independent person. Whoever creates or submits something does not approve it themselves.Guide: Managing approvals with the four-eyes principle
Functional role: Role that bundles functional permissions, such as ISMS manager, risk analyst or top management. In Varmo, people receive functional permissions only through functional roles; the system role (user or Tenant Admin) governs the administration of members and the account.Guide: Setting functional roles and permissions

I

Impact: Axis of the risk assessment: how severe the effect of a risk is if it occurs. According to BSI Standard 200-3 in the levels negligible, limited, considerable and existence-threatening. Together with the likelihood, it gives the risk level via the risk matrix.Guide: Setting the risk methodology and acceptance criteria
Information security: Protection of information in any form, digital, on paper or as people's knowledge, with the aim of preserving confidentiality, integrity and availability. It covers more than IT security.
Information security management system(ISMS): The entirety of rules, processes, responsibilities and tools with which an organisation plans, implements, reviews and continually improves its information security. The requirements are set out in ISO/IEC 27001.
Interested parties(stakeholders): People or organisations that influence information security or are affected by it, such as customers, authorities, employees or suppliers. ISO/IEC 27001 (4.2) requires their requirements to be determined.
Internal audit: Planned, independent review by the organisation itself of whether the ISMS meets its own requirements and those of the standard and is effectively implemented (ISO/IEC 27001, 9.2).Learn more Guide: Handling internal audits and findings
Internal control: Regular check with which an organisation monitors whether requirements are being met, for example the quarterly review of permissions. Every execution is recorded with its result and evidence.
ISO/IEC 27001: International standard with the requirements for an information security management system. The current 2022 edition contains the requirements in clauses 4 to 10 and 93 controls in Annex A. Organisations can be certified against it.Learn more

L

Likelihood(probability of occurrence): Axis of the risk assessment: how often a damaging event is to be expected. According to BSI Standard 200-3 in the levels rare, medium, frequent and very frequent. Together with the impact, it gives the risk level via the risk matrix.Guide: Setting the risk methodology and acceptance criteria

M

Management review

Regular review of the ISMS by top management based on defined inputs such as audit results, risks and objectives, with decisions on improvement (ISO/IEC 27001, 9.3).Learn more Guide: Preparing and conducting the management review

Mappings between catalogues(mappings, correspondences)

A mapping links a requirement to a requirement in another catalogue, for example an Annex A control from ISO/IEC 27001 to a control from NIST SP 800-53. The type always describes this requirement in relation to the other: what is a subset from one side is a superset from the other. The fulfilment is only inherited automatically if the requirement is equal or fully contained in a requirement that is met (subset). For supersets and intersections, the fulfilment is only suggested for review. You can assess any mapping differently with a justification. Mappings between catalogues are included from the Pro plan.

Equal: Two requirements from different catalogues require essentially the same. If one is met, the other automatically counts as met too – in both directions.Example: AC-3 (Access Enforcement) from NIST SP 800-53 and A.8.3 (Information access restriction) from ISO/IEC 27001 both require access to be enforced in line with the access control policy. If one is met, the other also counts as met.
Subset of: One requirement requires less than the other and is fully contained in it. If the more comprehensive requirement is met, the contained one automatically counts as met too – not the other way round.Example: SC-12 (Cryptographic Key Establishment and Management) from NIST SP 800-53 is a subset of A.8.24 (Use of cryptography) from ISO/IEC 27001: key management is explicitly part of the cryptography rules. If A.8.24 is met, SC-12 counts as met – not the other way round.
Superset of: One requirement requires more than the other and fully includes it. If only the smaller one is met, the more comprehensive one is only partially met; the fulfilment is only suggested for review.Example: The same pair from the other side: A.8.24 is a superset of SC-12. Meeting SC-12 alone only partially covers A.8.24 and is therefore only suggested for review.
Intersects with: Two requirements only partially overlap; each requires something the other does not. The fulfilment is not inherited automatically, but only suggested for review.Example: AC-3 (Access Enforcement) from NIST SP 800-53 and A.5.15 (Access control) from ISO/IEC 27001 both concern access, but do not require the same. Meeting one is only suggested for review for the other.

Learn more

Maturity level

Assessment of how far a requirement has been implemented, on a scale from 0 (not implemented) to 4 (dynamic, continuously reviewed and improved), as in the assessment tool for the ICT minimum standard (Switzerland).

Maximum principle

Rule according to which an asset receives, for each security objective, the highest protection requirement of the information it processes. It applies unless a cumulative or distribution effect is justified.

Measure(control)

Provision that reduces a risk or meets a requirement, for example a backup, a training session or an access rule. Measures have responsible people, deadlines and evidence.Guide: Implementing and evidencing measures

N

Need-to-know: Principle that people only access the information they need for their task.
NIS2: Directive (EU) 2022/2555 on measures for a high common level of cybersecurity. Among other things, it obliges essential and important entities in the EU to take cybersecurity risk-management measures (Art. 21) and to report significant incidents (Art. 23).Learn more
NIST Cybersecurity Framework(NIST CSF): Framework of the US National Institute of Standards and Technology. Version 2.0 organises cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Learn more

O

Owner(asset owner, risk owner): Person who is responsible for an asset or a risk. The risk owner decides on the treatment and accepts the residual risk within the defined criteria.Guide: Reporting, reviewing and treating risks

P

Protection requirement: Measure of how serious the damage would be if the confidentiality, integrity or availability of a piece of information were violated. According to BSI Standard 200-2, it is usually classified as normal, high or very high.Guide: Conducting and approving the protection requirements assessment

R

Residual risk: Risk that remains after the measures have been implemented. It is assessed and formally accepted by the responsible body or treated further.Guide: Reporting, reviewing and treating risks
Reviewer role(reviewing body): Functional role that reviews and assesses reported risks. In Varmo, the ISMS managers decide whether a specific reviewer role carries out the review or all people with the permission to assess risks.Guide: Reporting, reviewing and treating risks
Risk acceptance: Deliberate, documented decision to bear a risk. The risk acceptance criteria define which levels may be accepted by whom and which cannot be accepted (ISO/IEC 27001, 6.1.2).Guide: Setting the risk methodology and acceptance criteria
Risk matrix: Grid of likelihood and impact that assigns a risk level to every combination. According to BSI Standard 200-3, it has four by four fields with the levels low, medium, high and very high (called risk categories in the standard).Guide: Setting the risk methodology and acceptance criteria

S

Scope: Definition of which parts of an organisation, locations, processes and systems the ISMS applies to. It is determined and documented according to ISO/IEC 27001 (4.3).
Security objectives: The three basic values of information security: confidentiality (only authorised people have access), integrity (information is correct and complete) and availability (information is available when needed).
Segregation of duties: Principle that incompatible tasks are assigned to different people, such as granting permissions and approving risks. Where this is not possible, a justified exception is recorded.
Statement of Applicability(SoA): Document according to ISO/IEC 27001 (6.1.3 d) that names the necessary controls, justifies their inclusion, states their implementation status and justifies the exclusion of controls from Annex A.Guide: Setting applicability and approving the SoA

T

Task(Pendenz, open item): An open item of work. In Varmo, a person's tasks are listed under “My tasks”, such as approvals, reviews, measures or acknowledgements; tasks for a team remain in the team queue until someone takes them on. In Switzerland, the term “Pendenz” is common for this.Guide: Using My tasks and the team queue
Tenant Admin: Role in Varmo that manages the members, access, sign-in and account of an organisation. Every Tenant Admin is automatically also an ISMS manager; here too, functional permissions come from the functional roles.Guide: Inviting members and managing access
Threat: Circumstance or event that can compromise the confidentiality, integrity or availability of information, such as fire, malware or operating errors. If a threat meets a vulnerability, a risk arises.

How close are you to ISO/IEC 27001?

In a personal demo, we show you the way to the readiness report, with no obligation. Or try it free for 30 days with every feature.

Request a demo Try it free