7 terms
ISO 27001 is the international standard that sets requirements for an information security management system and its independent certification.
ISO/IEC 27002 is the international code of practice that describes information security controls and explains how to implement them in an organization.
ISO/IEC 27701 is the international standard for a privacy information management system that governs how organizations process personal data.
The NIST CSF is a voluntary cybersecurity framework that organizes security outcomes into six functions to help organizations assess and manage cyber risk.
A security audit is a systematic, evidence-based evaluation of how well an organization's security controls meet a defined standard or policy.
A security policy is a management-approved document that sets an organization's rules, responsibilities and expectations for protecting information.
SOC 2 is an AICPA attestation framework in which an independent auditor reports on a service organization's controls for security and related criteria.