GB/T 29246-2023Information security technology - Information security management systems - Overview and vocabulary (English PDF)

Foreword

This document was drafted in accordance with the provisions of GB/T 1.1-2020

Directives for standardization - Part 1.Rules for the structure and drafting of

standardizing documents.

This document replaces GB/T 29246-2017 Information technology - Security

techniques - Information security management systems - Overview and vocabulary.

Compared with GB/T 29246-2017, in addition to structural adjustments and editorial

changes, the main technical changes are as follows.

a) The terms "analytical model", "attribute", "data", "decision criteria",

"executive management", "ISMS project", "measurement results", "object",

"scale", "unit of measurement", "validation" and "verification" are deleted (see

Chapter 3 of the 2017 edition);

b) The terms "interested party" (see 2.41 of the 2017 edition) and "stakeholder"

(see 2.82 of the 2017 edition) with the same definition are merged into the

term "interested party; stakeholder" (see 3.37);

c) The description of ISO/IEC 27009 is added (see 5.3.3);

d) The description of ISO/IEC 27021 is added (see 5.4.10);

e) The descriptions of some standards in the information security management

system family of standards are updated (see Chapter 5; see Chapter 4 of the

2017 edition).

This document is identical to ISO/IEC 27000.2018 Information technology - Security

techniques - Information security management systems - Overview and vocabulary.

The following minimal editorial changes are made to this document.

-- In order to coordinate with the existing standards, the name of the standard is

changed to "Information security technology - Information security

management systems - Overview and vocabulary".

1 Scope

This document provides the overview of information security management systems

(ISMS). It also provides terms and definitions commonly used in the ISMS family of

standards.

2 Normative references

There are no normative references in this document.

3 Terms and definitions

The measure (3.42) defined in terms of an attribute and the method for quantifying it.

A person or organization (3.50) that can affect, be affected by, or perceive itself to be

affected by a decision or activity.

4 Information security management systems (ISMS)

Protecting information assets through defining, achieving, maintaining, and improving

information security effectively is essential to enable an organization to achieve its

objectives, and maintain and enhance its legal compliance and image.

5 ISMS family of standards

The ISMS family of standards consists of inter-related standards, already published or

under development, and contains a number of significant structural components. These

components are focused on.

Information technology - Security techniques - Guidelines for auditors on information

security controls (Information technology - Security techniques - Guidelines for

auditors on information security controls)

......