Skip to Content
ISO 27001Glossary

ISO 27001 glossary

ISO 27001  has its own vocabulary. Terms such as SoA, ISMS and CIA triad come up in every discussion, but they are not always explained. This page covers 18 terms you will come across in the requirements of the standard and when setting up an ISMS. The official definitions are in ISO/IEC 27000:2018 , available from NEN .

The terms are grouped by theme. Click a link in a definition to read more on the related page.

Core terms

ISMS (Information Security Management System) A management system for information security. The ISMS is the central structure of ISO 27001: it describes how you identify risks, implement measures, check whether they work, and keep improving. It is not a software package but a systematic approach. More explanation on the page about the ISMS.

CIA triad The three pillars of information security: Confidentiality, Integrity and Availability. Confidentiality means only authorised people can access information. Integrity means information remains correct and complete. Availability means information is there when you need it. ISO 27001 protects information along all three dimensions.

Information security policy A document that describes the intentions and direction of the organisation regarding information security. The management board approves it. It contains no technical details, only the principles and objectives. ISO 27001 explicitly requires this document in clause 5.2. Read more about the content on the page information security policy.

Scope (scope of application) The part of the organisation to which the ISMS applies. You can choose the whole organisation or a defined part, such as one product, location or department. The scope must be logical and must be seen as credible by the auditor. See defining the scope for examples.

Control (beheersmaatregel) A measure that reduces or manages a risk. ISO 27001 contains a catalogue of 93 controls in Annex A. You select the controls that are relevant to your risk profile.

Risk terms

Risk assessment (risicobeoordeling) The process of identifying, analysing and evaluating risks to information security. ISO 27001 requires a formal, reproducible risk assessment. The result is a risk register with likelihoods, impacts and treatment decisions. Detailed explanation on the page risk analysis.

Risk acceptance A deliberate decision not to reduce a risk any further. You accept the residual risk because the cost of measures does not outweigh the risk reduction, or because the risk falls within your risk appetite. ISO 27001 requires that the management board sets your risk appetite in advance.

Risk appetite The level of risk an organisation is willing to accept. The management board sets this before the risk assessment. A financial institution usually has a lower risk appetite for data leaks than a bakery.

Residual risk The risk that remains after you have taken measures. No single measure eliminates a risk completely. The management board formally accepts the residual risk as part of the ISMS.

Vulnerability A weakness in a system, process or control that a threat can exploit. For example: outdated software, missing access security, or an employee without security training. A vulnerability on its own is not a risk. It only becomes a risk when there is also a threat that can exploit it.

Threat A potential cause of an unwanted event that can damage information. Threats can be internal (an employee who deletes data by accident) or external (a hacker, fire, flood). The NCSC  publishes the annual Cybersecuritybeeld Nederland (Cyber Security Assessment Netherlands) with current threats.

Documents and processes

SoA, Statement of Applicability (verklaring van toepasselijkheid) A mandatory document in ISO 27001 that records, for each control in Annex A, whether you apply it and why. The SoA is the bridge between your risk analysis and your controls. See the page on the statement of applicability for an example row.

Annex A The annex to ISO 27001:2022 that contains 93 controls, organised in four categories: organisational (37), people (8), physical (14) and technological (34). You are not obliged to implement all 93. See Annex A for the full overview.

Risk register A document or spreadsheet that keeps track of all identified risks, including likelihood, impact, treatment decision, owner and status. The risk register is a living document that you update at least once a year.

Management review A periodic formal meeting in which the management board assesses the status of the ISMS. ISO 27001 requires this in clause 9.3. The minutes are a mandatory document, and the auditor always asks to see them.

Internal audit A systematic check carried out by your own organisation (or an external party acting on its behalf) to verify whether the ISMS meets the requirements. The internal auditor must be independent of what they audit. More on the page internal audit.

Organisational roles

ISMS owner (Information Security Manager) The person responsible for setting up, maintaining and improving the ISMS. In small organisations, this role is combined with another function, such as CTO or IT manager. ISO 27001 does not require a specific job title, but it does require clear assignment of responsibilities (clause 5.3).

Risk owner The person responsible for a specific risk: deciding on its treatment, monitoring progress and accepting the residual risk. Every risk in the risk register has an owner.

Accredited certification body An organisation authorised to issue ISO 27001 certificates, such as Kiwa , DNV  or BSI . Accreditation is granted by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) . Only certificates from accredited bodies are recognised by customers and supervisory authorities.

More information

GDPR and ISO 27001Frequently asked questions