Risk

Risk Management 

Threat 

Vulnerability

Information security 

Risk - Likelihood of something happening

Risk Management - Process to identify information security risks and to evaluate and deal with those matters

Anything that can harm information. Manmade or natural

Vulnerability - Weakness that can be used to harm information asset

Information asset - Content of valuable information and it's container

Content of an organisation

Three parts

External - Economic, social, political etc.

Internal - Company culture, contracts, employees etc.

Interested parties and their needs and expectations - Competitors, clients, associates, authorities etc. 

Boundaries and applicability of the ISMS

Can cover either;

- Entire organisation

- Parts of the organisation

Considerations;

- Internal/External parties

- Interest parties and their needs and expectations

- Interfaces and dependencies (suppliers etc.)

Scope decides where to implement 

But implementation should start with Top Management

Must demonstrate leadership and commitment

Their respect to the ISMS is vital