Terms, definitions and abbreviated terms

Group heading. This unit groups subclauses and carries no text of its own. The pages it groups are linked below.

What it says, in our words

This clause holds the vocabulary the rest of the document uses. It has two parts: the defined terms and the abbreviated terms. The definitions come from the two normative references and from the wording this document itself adds, and the clause says which source applies to each term.

What it means for an ISMS manager

Treat this clause as the contract between the document and your existing glossary. Twenty-two terms are defined, and several of them are the words a risk workshop argues about: asset, threat, vulnerability, risk, validity, veracity. If your risk register uses its own definitions, the gap between the two is where a finding will come from. The abbreviated terms matter less, but they are a quick check on whether a supplier's questionnaire is using the same vocabulary. The abbreviations are data protection officer, identity and access management, large language model, multi-party computation and personally identifiable information.

What this heading groups

• 3.1 Terms and definitions
• 3.2 Abbreviated terms

What an auditor samples

• The organisation's glossary, with the source and edition for each term it defines.
• A mapping from the organisation's terms to the document's terms, with the differences named.
• The review record showing the risk and privacy owners agreed the mapping.

Evidence lines are the artefacts an auditor or a reviewer asks to see. They are named here so the work can be planned; they are not a certificate and they do not replace the official text.