Terms and definitions

What this part of the catalogue does

Clause 3.1 defines 38 terms used in the document, several adopted or adapted from ISO/IEC 27000, ISO/IEC 27035-1, ISO 31000, ISO 22301, ISO/IEC 29100, ISO/IEC 27031 and other standards: access control, asset (primary assets such as information and business processes, and supporting assets such as hardware, software, networks, personnel, sites and organizational structure), attack, authentication, authenticity, chain of custody, confidential information, control, disruption, endpoint device, entity, information processing facility, information security breach, information security event, information security incident, information security incident management, information system, interested party, non-repudiation, personnel, PII, PII principal, PII processor, policy, privacy impact assessment, procedure, process, record, recovery point objective, recovery time objective, reliability, rule, sensitive information, threat, topic-specific policy, user, user endpoint device and vulnerability.

What it means when you fill the register

The definitions clause fixes the vocabulary the rest of the catalogue relies on: information, information security, control, risk, asset, event and incident among others. The definitions are deliberately neutral about technology, which is what allows the same control set to apply to a cloud service and a paper archive. For the attribute work the definitions do the quiet work. If 'control' is used to mean a tool, the attribute values drift; if it means anything that changes the likelihood or effect of an incident, the values stay stable. Our pages use the second sense throughout and say so. A glossary difference between two teams is often the real reason their attribute counts disagree.

Definitions settle arguments that otherwise run for a meeting. 'Asset', 'event' and 'incident' are the three that matter most to an attribute register, because a row can be right about the control and wrong about the thing it protects. The definitions are also the reason a control can be described in the same words across sectors. When two teams disagree about a value, the fastest route is usually back to the definition, not to a longer justification.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method