2.3 ISO/IEC 27000 Vocabulary

ISO/IEC 27000 is the vocabulary standard for the 27000 family. The Foundation exam uses its definitions verbatim, so small wording differences matter. This section collects the terms you must be able to define, distinguish, and apply.

Assets: Primary and Supporting

An asset is anything that has value to the organization and therefore needs protection.

Primary assets

Primary assets are the things the business directly cares about:

• Information — customer records, source code, financials, contracts, design documents.
• Business processes and activities — order-to-cash, payroll, incident response.

Supporting assets

Supporting assets carry or process primary assets:

• Hardware — servers, laptops, mobile devices, network gear.
• Software — operating systems, applications, libraries.
• Networks — internal LAN, WAN, internet links.
• Facilities — data centers, offices, wiring closets.
• People — employees, contractors, suppliers (their knowledge and access).
• Services — cloud providers, utilities, outsourcing partners.

Why the distinction matters

Risk treatment often targets supporting assets to protect primary assets. You don't encrypt a laptop for the laptop's sake — you encrypt it because it stores a primary asset (customer data). On the exam, if asked what the protected asset is in a "laptop with customer data is stolen" scenario, the best answer is the information, not the hardware.

---

Threats, Threat Sources, and Threat Vectors

A threat is a potential cause of an unwanted incident, which may result in harm to a system or organization.

Threat source

The threat source is the origin — who or what might cause the harm.

Threat vector

A threat vector is the path or means by which a threat reaches an asset. Common vectors include:

• Phishing email targeting employees.
• Unpatched internet-facing service.
• Lost or stolen laptop.
• Removable media (USB drives).
• Physical intrusion.
• Supplier compromise (supply chain).

Example

• Threat: Unauthorized disclosure of customer data.
• Threat source: Adversarial — external attacker.
• Threat vector: Spear-phishing email to a help-desk agent, followed by credential theft.
• Asset at risk: Customer information (primary asset) stored in the CRM (supporting asset).

---

Vulnerabilities

A vulnerability is a weakness of an asset or control that can be exploited by one or more threats. A vulnerability without a matching threat is not yet a risk; a threat without a matching vulnerability cannot cause harm.

Examples

---

Risk

Risk is the combination of the likelihood that a threat will exploit a vulnerability and the impact that would result. ISO/IEC 27000 defines risk as the "effect of uncertainty on objectives."

Risk equation (conceptual)

Risk = Likelihood × Impact

In practice, ISO/IEC 27001 Clause 6.1.2 requires a defined risk assessment methodology — qualitative scales (low/medium/high) are common and acceptable. The exam does not require a specific formula, but it does require understanding that risk depends on both likelihood and impact, not just one.

Relationship: Asset, Threat, Vulnerability, Risk, Control

graph LR
    AS["Asset"] --> RJ["Risk"]
    TH["Threat"] --> RJ
    VL["Vulnerability"] --> RJ
    RJ --> CT["Control"]
    CT -.reduces.-> RJ

    style AS fill:#1e3a5f,color:#fff
    style TH fill:#c9a227,color:#1e3a5f
    style VL fill:#2d5a87,color:#fff
    style RJ fill:#8b0000,color:#fff
    style CT fill:#2d5a87,color:#fff

A risk only exists when a threat can exploit a vulnerability to harm an asset. A control reduces risk by reducing likelihood, reducing impact, or both.

---

Controls: Preventive, Detective, Corrective

A control is a measure that is modifying risk. Controls are commonly classified by when they act:

Some controls serve multiple categories: a firewall is preventive; its logs are detective; an automatic failover to a clean site is corrective.

Note on Annex A structure

ISO/IEC 27001 Annex A is organized thematically (organizational, people, physical, technological controls), not by preventive/detective/corrective. Do not expect to find a "Detective controls" heading in Annex A. The exam may give you a control and ask which category it belongs to — classify by function, not by Annex A section.

---

Owners

The 27000 vocabulary distinguishes three ownership roles:

Why this matters for the exam

• ISO/IEC 27001 Clause 5.3 requires roles and responsibilities to be assigned. "Assigned" means named, not implicit.
• A single person can hold more than one owner role, but the roles themselves remain distinct.
• The asset owner is not automatically the risk owner — senior management often owns risks that asset owners cannot accept.
• Control owners report performance; they do not own the underlying risk.

---

Information Security Incident

An information security incident is an identified occurrence of a system, service, or network state indicating a possible breach of information security policy or failure of controls, or a previously unknown situation that may be security-relevant.

Key distinctions:

• An event is any observable occurrence. Most events are benign (a user logging in).
• An incident is an event (or set of events) that violates policy or controls, or threatens security.
• A vulnerability is not an incident; an incident realizes a threat via a vulnerability.

ISO/IEC 27001 Clause 6.1.2 (risk assessment), Clause 6.1.3 (risk treatment), and Annex A controls A.5.24–A.5.27 (incident management) govern how incidents are detected, reported, assessed, responded to, and learned from.

---

Common Exam Traps

1. Calling hardware the protected asset when information is what matters. Identify the primary asset first.
2. Treating vulnerability as a risk. A vulnerability plus a threat plus an asset equals a risk; a vulnerability alone does not.
3. Confusing threat source with threat vector. Source = who/what; vector = how it gets there.
4. Listing a control as "preventive" because it is in Annex A. Annex A is thematic; classify by function.
5. Merging risk owner with asset owner. They are distinct roles, even when held by the same person.