Glossary terms starting with I

Terms

ICT Risk ManagementRisk Management

The process of identifying, assessing, and managing risks associated with information and communication technology. ICT risk management is central to DORA, CPS 234, and other technology-focused regulations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

IEC 27001Compliance and Regulatory

The International Electrotechnical Commission's numbering for ISO 27001, the international standard for information security management systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

IEC 62443Compliance and Regulatory

An international series of standards for industrial automation and control system cybersecurity, covering operator, integrator, and component manufacturer requirements.Used in: NIST SP 800-53 Rev 5, ISO 27001:2022

IP ReputationInformation Security

A scoring system that evaluates IP addresses based on their historical behavior to identify sources of spam, malware, or other malicious activity.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

IP SpoofingInformation Security

The creation of Internet Protocol packets with a forged source IP address to impersonate another computing system. IP spoofing is used in denial-of-service attacks and to bypass IP-based authentication.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

IP WhitelistingInformation Security

A security practice that restricts network or application access to only specified trusted IP addresses, blocking all other connection attempts.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

IPsecInformation Security

A suite of protocols that authenticates and encrypts IP packets to secure communications over IP networks, commonly used in VPN implementations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

ISACAGovernance

A global professional association that provides knowledge, credentials, training, and community for information systems audit, assurance, security, governance, risk, and privacy professionals. ISACA administers CISA, CISM, CRISC, and CGEIT certifications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR

ISC2Information Security

The International Information System Security Certification Consortium, a non-profit organization that provides cybersecurity certifications including CISSP.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

ISM (Information Security Manual)Compliance

The Australian Government's cybersecurity framework produced by the Australian Signals Directorate. The ISM provides cybersecurity guidance for all levels of government and is based on risk management principles.Used in: NIST Cybersecurity Framework 2.0

ISMS (Information Security Management System)Information Security

A systematic approach to managing sensitive information so that it remains secure. ISO 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

ISO 14001Compliance

The international standard for Environmental Management Systems (EMS) that specifies requirements for establishing, implementing, maintaining, and improving environmental performance. ISO 14001 shares the Annex SL structure with ISO 27001 and ISO 9001.Used in: ISO 27001:2022, ISO 9001:2015

ISO 19011Audit

The international standard that provides guidance on managing audit programmes, conducting internal or external audits, and evaluating the competence of auditors. ISO 19011 applies to all management system audits.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

ISO 20000Compliance and Regulatory

The international standard for IT service management systems, specifying requirements for establishing, implementing, and improving IT service delivery.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ISO 22000Compliance and Regulatory

The international standard for food safety management systems, specifying requirements for organizations in the food chain to ensure food safety.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ISO 22301Compliance

The international standard for Business Continuity Management Systems (BCMS) that specifies requirements for planning, establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving a BCMS.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

ISO 27001Information Security

The international standard for information security management systems (ISMS). The 2022 revision (ISO/IEC 27001:2022) includes 93 controls in Annex A, restructured into four themes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

ISO 27001 CertificationCompliance and Regulatory

Formal certification that an organization's information security management system meets all requirements of the ISO 27001 standard.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ISO 27001 Lead AuditorAudit and Assurance

A professional qualified to lead ISO 27001 audits, assessing information security management systems against the standard's requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

ISO 27001 Lead ImplementerCompliance and Regulatory

A professional qualified to lead the implementation and management of an ISO 27001 information security management system.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ISO 27002Information Security

The companion standard to ISO 27001 that provides implementation guidance for the Annex A controls. Not a certifiable standard itself. It supports ISO 27001 implementation.Used in: ISO 27001:2022, ISO 27002:2022

ISO 27005Compliance and Regulatory

The international standard providing guidelines for information security risk management, supporting the requirements of ISO 27001.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

ISO 27017Cloud

An international standard that provides guidelines for information security controls applicable to the provision and use of cloud services. ISO 27017 extends ISO 27002 with cloud-specific guidance.Used in: ISO 27002:2022, ISO 27001:2022, Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

ISO 27018Privacy

An international standard that establishes objectives, controls, and guidelines for implementing measures to protect Personally Identifiable Information (PII) in public cloud computing environments.Used in: ISO 27001:2022, GDPR, Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

ISO 27019Compliance and Regulatory

An international standard providing guidance on information security controls for the energy utility industry's process control systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ISO 27032Compliance and Regulatory

An international standard providing guidance for improving cybersecurity, addressing the security of cyberspace and its relationship to other security domains.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ISO 27035Compliance and Regulatory

An international standard providing principles for incident management in information security, covering planning, detection, assessment, and response.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

ISO 27701Privacy

An extension to ISO 27001 and ISO 27002 for privacy information management. ISO 27701 specifies requirements for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).Used in: ISO 27001:2022, ISO 27002:2022, GDPR

ISO 27799Compliance and Regulatory

An international standard providing guidance on information security management in health informatics for organizations handling personal health information.Used in: ISO 27001:2022, HIPAA Security Rule

ISO 31000Risk Management

The international standard for risk management that provides principles, a framework, and a process for managing risk. ISO 31000 applies to any type of risk, regardless of its nature, and is applicable to any organisation.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

ISO 37001Compliance and Regulatory

The international standard for anti-bribery management systems, specifying requirements for preventing, detecting, and addressing bribery.Used in: ISO 9001:2015, ISO 27001:2022, NIST Cybersecurity Framework 2.0

ISO 42001AI & Technology

The international standard for Artificial Intelligence Management Systems (AIMS) that specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system.Used in: EU AI Act

ISO 45001Compliance and Regulatory

The international standard for occupational health and safety management systems, providing a framework for managing workplace safety risks.Used in: ISO 9001:2015, HIPAA Security Rule

ISOIEC 27001Compliance and Regulatory

The joint ISO and IEC international standard specifying requirements for establishing, implementing, maintaining, and improving an information security management system.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

IT AuditAudit and Assurance

An examination of an organization's information technology infrastructure, policies, and operations to determine whether controls adequately protect assets.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

IT Contingency PlanBusiness Continuity

A documented plan for maintaining or restoring IT operations when systems are disrupted, covering both preventive and recovery measures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

IT GovernanceGovernance

The framework of policies, processes, and organizational structures that ensure IT investments support business objectives and manage technology risks.Used in: COBIT 2019, ISO 27001:2022

IT Portfolio ManagementGovernance

The management of an organization's IT investments, projects, and assets as a portfolio to optimize value, manage risk, and align with strategy.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

IT Service ContinuityBusiness Continuity

The capability to restore IT services within agreed timeframes after a disruption, forming a critical component of overall business continuity.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

IT Service ManagementGovernance

A set of policies, processes, and procedures for managing the delivery and support of IT services to meet organizational and customer requirements.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

IT Service Management (ITSM)Governance

The activities directed by policies, organised and structured in processes and supporting procedures, that are performed by an organisation to plan, deliver, operate, and control IT services offered to customers.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

ITARCompliance and Regulatory

International Traffic in Arms Regulations controlling the export and temporary import of defense articles and services on the US Munitions List.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ITAR (International Traffic in Arms Regulations)Compliance

US regulations that control the export and import of defence-related articles and services. ITAR requires that information related to defence and military technologies is protected from foreign access.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

ITILGovernance

The Information Technology Infrastructure Library, a set of practices for IT service management (ITSM). ITIL 4 aligns with modern ways of working including Agile, DevOps, and Lean.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

ITIL (Information Technology Infrastructure Library)Governance

A set of detailed practices for IT service management that focuses on aligning IT services with the needs of the business. ITIL 4 organises guidance around the Service Value System and 34 management practices.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

IaaS SecurityCloud Security

Security controls and practices specific to Infrastructure as a Service cloud environments where the customer manages the operating system and above.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022

Identity AnalyticsInformation Security

The use of data analysis and machine learning to detect anomalous identity-related activities and optimize access management decisions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, EU AI Act

Identity FederationInformation Security

A system of trust between identity providers and service providers that allows users to authenticate once and access multiple systems across different organisations. Federation protocols include SAML, OAuth, and OpenID Connect.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity GovernanceInformation Security

The policies and processes that manage and control user identities, access rights, and entitlements across the organisation. Identity governance includes access certifications, segregation of duties enforcement, and role management.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, COBIT 2019

Identity Lifecycle ManagementInformation Security

The end-to-end management of user identities from creation through modification and eventual deprovisioning when no longer needed.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity ProofingInformation Security

The process of verifying that a person is who they claim to be before issuing credentials, using documents, biometrics, or knowledge-based verification.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity ProviderInformation Security

A service that creates, maintains, and manages identity information and provides authentication services to applications in a federated or SSO environment.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity ResolutionPrivacy and Data Protection

The process of connecting disparate data points to a single individual across different data sources and devices, raising privacy implications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR

Identity Threat DetectionInformation Security

Security capabilities focused on detecting threats targeting identity infrastructure including credential theft, privilege escalation, and lateral movement.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity VerificationInformation Security

The process of confirming that an individual's claimed identity matches their actual identity through document checks, biometric comparison, or other methods.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity and Access ManagementInformation Security

A framework of policies, processes, and technologies for managing digital identities and controlling user access to organizational resources.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity and Access Management (IAM)Information Security

A framework of policies, processes, and technologies for managing digital identities and controlling user access to critical information within an organisation. IAM ensures the right individuals have appropriate access at the right times.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Identity as a ServiceCloud Security

Cloud-based identity management that provides authentication, authorization, single sign-on, and directory services delivered as a managed service.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5

Identity as a Service (IDaaS)Cloud

A cloud-based authentication infrastructure that provides identity and access management capabilities as a service. IDaaS solutions include single sign-on, multi-factor authentication, directory services, and access governance.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5

Image AnalysisInformation Security

The forensic examination of disk images, memory dumps, or file system snapshots to identify evidence of security incidents or policy violations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Immutable InfrastructureInformation Security

An infrastructure approach where servers are never modified after deployment, instead being replaced with new instances built from updated templates.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Impact AnalysisRisk Management

The assessment of the potential consequences of a risk event, security incident, or system change on business operations, finances, and reputation.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Impact AssessmentRisk Management

An analysis of the potential consequences of a specific event, threat, or vulnerability being realised. Impact assessments consider financial, operational, reputational, legal, and regulatory consequences.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, PCI DSS v4.0

Impact ScoreRisk Management

A numerical rating assigned to a vulnerability or risk based on the potential severity of consequences if it is exploited or occurs.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

ImpersonationInformation Security

A social engineering technique where an attacker pretends to be a trusted individual or authority figure to manipulate victims into revealing information.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Implied ConsentPrivacy and Data Protection

Consent inferred from an individual's actions or inaction rather than explicit agreement, with limited applicability under strict privacy regulations.Used in: GDPR, ISO 27001:2022

Incident CategoryInformation Security

A classification system for organizing security incidents by type such as malware, phishing, data breach, or denial of service.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident ClassificationInformation Security

The process of categorizing security incidents by type, severity, and impact to ensure appropriate response procedures and resource allocation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident Command SystemBusiness Continuity

A standardized management structure for coordinating emergency response, defining clear roles, communication channels, and resource management procedures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident CommanderInformation Security

The individual with overall authority and responsibility for managing the response to a specific security incident.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident CommunicationInformation Security

The structured process of informing stakeholders, regulators, affected parties, and the public about security incidents according to defined protocols.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident ContainmentInformation Security

Actions taken to limit the scope and impact of a security incident, such as isolating affected systems, blocking malicious traffic, or disabling compromised accounts.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident DocumentationInformation Security

The recording of all aspects of a security incident including timeline, actions taken, evidence collected, and lessons learned.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident EradicationInformation Security

The phase of incident response focused on removing the root cause of a security incident and eliminating all traces of the threat from affected systems.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident EscalationInformation Security

The process of elevating a security incident to higher levels of management or specialized response teams based on severity and impact.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident HandlerInformation Security

A trained professional responsible for detecting, analyzing, and responding to security incidents as part of the incident response team.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident LikelihoodRisk Management

The probability that a specific security incident will occur, based on threat intelligence, vulnerability data, and historical incident patterns.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident LogInformation Security

A chronological record of all events, actions, and decisions related to a security incident from detection through resolution.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident ManagementGovernance

The process for detecting, reporting, assessing, responding to, and learning from incidents in a systematic and coordinated manner.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident Management ProcessInformation Security

The defined workflow for handling security incidents from detection through containment, eradication, recovery, and post-incident review.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident MetricsInformation Security

Quantitative measures used to track and evaluate the frequency, severity, response time, and cost of security incidents.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident PlaybookInformation Security

A documented set of step-by-step procedures for responding to specific types of security incidents, guiding responders through standardized actions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident Post-MortemInformation Security

A structured review conducted after a security incident to analyze what happened, identify root causes, and develop improvements to prevent recurrence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident RecoveryInformation Security

The phase of incident response where affected systems are restored to normal operations and verified to be free of threats.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident RegisterInformation Security

A centralized log of all security incidents including their type, severity, response actions, and resolution status.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident ReportingInformation Security

The formal documentation and communication of security incidents to management, regulators, and other stakeholders as required by policy and regulation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident ResponseInformation Security

The organised approach to addressing and managing a security breach or cyberattack. Includes preparation, identification, containment, eradication, recovery, and lessons learned.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident Response AutomationInformation Security

The use of technology to automate steps in the incident response process, such as containment actions, evidence collection, and notifications.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident Response FrameworkInformation Security

A structured approach providing guidance for preparing for, detecting, containing, and recovering from cybersecurity incidents.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident Response LifecycleInformation Security

The complete process of handling a security incident from preparation and detection through containment, eradication, recovery, and lessons learned.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident Response PlanInformation Security

A documented set of instructions that outlines an organisation's procedures for detecting, responding to, and recovering from security incidents. Required by frameworks including ISO 27001, NIST CSF, PCI DSS, and HIPAA.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, HIPAA Security Rule

Incident Response RetainerInformation Security

A pre-arranged agreement with a cybersecurity firm to provide incident response services on-demand when a security breach occurs.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident Response TeamInformation Security

A cross-functional group of trained professionals responsible for managing the organization's response to cybersecurity incidents.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Incident Review BoardInformation Security

A governance body that reviews significant security incidents to evaluate response effectiveness and approve recommendations for improvement.Used in: COBIT 2019, ISO 27001:2022

Incident Severity LevelInformation Security

A classification system that rates security incidents based on their impact and urgency to determine appropriate response priority and resources.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident TimelineInformation Security

A chronological reconstruction of events before, during, and after a security incident used for analysis and reporting.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Incident TriageInformation Security

The initial assessment and prioritization of security incidents based on severity, impact, and urgency to determine appropriate response actions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Indicator of AttackInformation Security

Observable patterns of behavior or events that suggest an active attack is underway, used by security teams to detect threats in real time.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Indicator of CompromiseInformation Security

Forensic artifacts such as file hashes, IP addresses, domain names, or registry keys that indicate a system has been breached or infected.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Indicator of Compromise (IoC)Information Security

Forensic evidence that suggests a security breach has occurred or is in progress. IoCs include unusual network traffic patterns, unexpected file changes, suspicious login attempts, and known malicious IP addresses or file hashes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Individual RightsPrivacy

The set of rights granted to data subjects under privacy regulations, enabling them to exercise control over their personal data. Under GDPR, these include rights of access, rectification, erasure, restriction, portability, and objection.Used in: GDPR, ISO 27001:2022

Industrial Control System SecurityInformation Security

Security measures for protecting SCADA, DCS, and PLC systems that manage critical infrastructure and industrial processes from cyber threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Industrial EspionageInformation Security

The unauthorized acquisition of trade secrets, proprietary information, or intellectual property for commercial advantage.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Industry Self-RegulationCompliance and Regulatory

Voluntary standards, codes of conduct, and best practices adopted by industry participants to regulate their own behavior without government mandate.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Information AssetInformation Security

Any data, system, or resource that has value to the organization and requires protection based on its classification level.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information Asset RegisterGovernance

A catalog of an organization's information assets including their classification, ownership, location, and protection requirements.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Information AssuranceInformation Security

Practices for managing risks related to the use, processing, storage, and transmission of information to ensure its confidentiality, integrity, and availability.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information ClassificationGovernance

A governance process that categorizes information assets based on their sensitivity and criticality to determine appropriate protection measures.Used in: COBIT 2019, ISO 27001:2022

Information Classification PolicyInformation Security

A policy defining how information assets should be categorized based on sensitivity and the handling requirements for each classification level.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information CommissionerPrivacy

The head of a data protection authority responsible for enforcing data protection laws within a jurisdiction. In the UK, the Information Commissioner leads the Information Commissioner's Office (ICO).Used in: GDPR, ISO 27001:2022

Information Commissioner's Office (ICO)Privacy

The UK's independent body established to uphold information rights, including enforcement of the UK GDPR and Data Protection Act 2018. The ICO has the power to impose fines of up to 17.5 million pounds or 4% of annual global turnover.Used in: GDPR, ISO 27001:2022

Information ExchangeInformation Security

The sharing of information between organizations, departments, or systems, requiring security controls to protect data during transfer.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information GovernanceGovernance

The set of multi-disciplinary structures, policies, procedures, processes, and controls implemented to manage information at an enterprise level. Information governance ensures that data is managed as a valuable organisational asset.Used in: COBIT 2019, ISO 27001:2022

Information HandlingInformation Security

The procedures for creating, processing, storing, transmitting, and disposing of information according to its classification and sensitivity.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information LifecycleInformation Security

The stages through which information passes from creation and collection through use, storage, archival, and eventual destruction.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information PrivacyPrivacy and Data Protection

The right of individuals to control how their personal information is collected, used, and shared by organizations and governments.Used in: GDPR, ISO 27001:2022

Information Rights ManagementInformation Security

Technology that protects sensitive documents by controlling who can access, edit, print, or forward them regardless of where the documents are stored.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information Risk ManagementRisk Management

The process of identifying, assessing, and treating risks to an organization's information assets to protect their confidentiality, integrity, and availability.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Information SecurityInformation Security

The practice of protecting information by mitigating risks to its confidentiality, integrity, and availability. Governed by frameworks such as ISO 27001 and NIST CSF.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Information Security Management SystemInformation Security

A systematic approach to managing sensitive company information through policies, procedures, and controls to ensure confidentiality, integrity, and availability.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information Security Management System (ISMS)Information Security

A systematic approach to managing sensitive information so that it remains secure, encompassing people, processes, and technology. An ISMS is central to ISO 27001 certification and includes risk assessment, security controls, and continuous improvement.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information Security PolicyInformation Security

A formal document that defines an organisation's approach to managing and protecting its information assets. The policy sets the strategic direction for information security and is typically approved by top management.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information SharingInformation Security

The exchange of cybersecurity threat intelligence, vulnerability data, and incident information between organizations to improve collective defense capabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Information SystemInformation Security

An integrated set of components for collecting, storing, processing, and communicating information that requires security protection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Information Systems AuditAudit and Assurance

An examination of an organization's information systems, technology infrastructure, and IT controls to evaluate security, reliability, and compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Infrastructure Penetration TestingInformation Security

Authorized security testing of network infrastructure including servers, routers, switches, and firewalls to identify configuration and security weaknesses.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Infrastructure SecurityInformation Security

Security measures for protecting the core technology infrastructure including servers, networks, storage, and operating systems from threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Infrastructure as Code (IaC)Cloud

The practice of managing and provisioning infrastructure through machine-readable configuration files rather than manual processes. IaC enables consistent, repeatable, and auditable infrastructure deployments.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, NIST Cybersecurity Framework 2.0

Infrastructure as Code SecurityCloud Security

Security practices for scanning and validating infrastructure code templates to prevent misconfigurations before cloud resources are provisioned.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Ingress FilteringInformation Security

The practice of monitoring and controlling inbound network traffic to block unauthorised access and malicious traffic. Ingress filtering verifies that incoming packets have legitimate source addresses.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Inherent RiskRisk Management

The level of risk present in an activity or process before any controls or mitigating actions are applied, representing the natural risk exposure.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Initial Certification AuditAudit and Assurance

The first formal audit conducted by a certification body to determine whether an organization's management system meets standard requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Input ValidationInformation Security

The process of verifying that user-supplied data meets expected formats and constraints before processing, preventing injection attacks and data corruption.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Insider RiskInformation Security

The potential for current or former employees, contractors, or partners to intentionally or accidentally compromise organizational security.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Insider ThreatInformation Security

A security risk that originates from within the organisation, typically from current or former employees, contractors, or business partners who have inside information concerning security practices, data, and computer systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Insider Threat ProgramInformation Security

An organizational initiative that combines policies, procedures, and technologies to detect, deter, and mitigate threats from trusted insiders.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Insurance ComplianceCompliance and Regulatory

Regulatory requirements for insurance companies including solvency standards, consumer protection, data privacy, and claims handling procedures.Used in: GDPR, ISO 27001:2022

Integrated Management System (IMS)Compliance

A single management system that addresses the requirements of multiple standards simultaneously, such as ISO 9001, ISO 27001, and ISO 14001. Integration is facilitated by the Annex SL high-level structure shared by all ISO management system standards.Used in: ISO 27001:2022, ISO 9001:2015

Integrated Risk ManagementRisk Management

A coordinated approach to managing all types of risk across an organization, breaking down silos between risk management functions.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

IntegrityInformation Security

The principle of ensuring that data is accurate, complete, and has not been modified by unauthorised parties. One of the three pillars of the CIA triad.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Integrity MonitoringInformation Security

Continuous surveillance of systems and data to detect unauthorized modifications, ensuring that information and configurations remain in their authorized state.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Integrity VerificationInformation Security

The process of confirming that data, systems, or configurations have not been tampered with or altered from their authorized state.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Intellectual Property ProtectionInformation Security

Security measures for safeguarding trade secrets, patents, copyrights, and other proprietary assets from theft and unauthorized use.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Intelligent AutomationAI and Technology

The combination of artificial intelligence and automation technologies to streamline business processes, requiring governance and compliance oversight.Used in: EU AI Act, COBIT 2019, ISO 27001:2022

Interactive Application Security TestingInformation Security

A security testing approach that combines elements of static and dynamic analysis to identify vulnerabilities while the application is running.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022

Internal AuditRisk Management

An independent, objective assurance activity within an organisation that evaluates the effectiveness of risk management, controls, and governance processes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, COBIT 2019

Internal AuditorAudit

A professional employed by or contracted to an organisation to conduct independent assessments of risk management, control, and governance processes. Internal auditors follow standards set by the Institute of Internal Auditors (IIA).Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022

Internal ControlGovernance

A process effected by an organisation's board, management, and other personnel designed to provide reasonable assurance regarding the achievement of objectives in operations, reporting, and compliance. The COSO framework defines the standard for internal control.Used in: ISO 27001:2022, COBIT 2019, NIST Cybersecurity Framework 2.0

Internal Penetration TestingInformation Security

Authorized security testing conducted from within the organization's network to simulate attacks by insiders or compromised accounts.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

International Data TransferPrivacy and Data Protection

The transmission of personal data from one jurisdiction to another, requiring appropriate safeguards and legal bases under data protection regulations.Used in: GDPR, ISO 27001:2022

International Traffic in Arms RegulationsCompliance and Regulatory

US regulations controlling the export and import of defense-related articles and services on the United States Munitions List.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Internet Key ExchangeInformation Security

A protocol used in IPsec VPNs to establish security associations by negotiating encryption algorithms and exchanging cryptographic keys.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

Internet of Things SecurityAI and Technology

Security practices for protecting IoT devices, networks, and data from threats including unauthorized access, device hijacking, and data interception.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Intrusion Detection SystemInformation Security

A security tool that monitors network traffic or system activities for signs of malicious behavior and generates alerts when suspicious activity is detected.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Intrusion Detection System (IDS)Information Security

A device or software application that monitors network traffic or system activities for malicious activities or policy violations. IDS alerts security personnel when suspicious activity is detected.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Intrusion Prevention SystemInformation Security

A network security tool that monitors traffic and automatically takes action to block or prevent detected threats from entering the network.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Intrusion Prevention System (IPS)Information Security

A network security technology that monitors network traffic for malicious activities and can take automated actions to block or prevent detected threats. IPS extends IDS capabilities with active threat mitigation.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Investigation ReportInformation Security

A formal document detailing the findings, analysis, and conclusions of a security incident investigation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

IsolationInformation Security

A security technique that separates systems, processes, or data from each other to prevent unauthorized access and contain the impact of breaches.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Issue ManagementRisk Management

The process of identifying, tracking, escalating, and resolving compliance issues, audit findings, and risk events to ensure timely remediation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0