Basic terms
Words that are used interchangeably in practice although they mean different things. Each part takes two to four of them, fetches the definition from the primary source, quotes it verbatim and shows where the difference changes a decision in everyday work.
One part a week, on Sundays. Sources are BSI standards, the IT-Grundschutz Kompendium, ISO standards and legal texts; whatever cannot be evidenced is phrased without claiming a quotation.
Published so far
A threat is not a hazard
Terms: Threat, vulnerability, hazard, risk
Basic Terms, part 1: threat, vulnerability, hazard and risk build on one another in IT-Grundschutz and mean four different things. Plus the term the BSI abolished in 2017 that almost everyone still uses.
Read this part
How bad is not how fast
Terms: Protection needs, criticality
Basic terms, part 2: protection needs assessment and business impact analysis both ask about damage, but about different damage. One has no clock, the other lives by it. Why the BSI itself warns against merging them, and what separates normal operation from emergency operation.
Read this part
Core is not the middle
Terms: Basic, core and standard protection
Basic terms, part 3: basic, core and standard safeguarding are drawn as a staircase in almost every presentation. BSI Standard 200-2 describes something else: three approaches for three situations, on two axes. Anyone who takes core safeguarding for the middle step underestimates it.
Read this part
The server is not the crown jewel
Terms: Information domain, target object, asset, crown jewels
Basic terms, part 4: information domain, target object and asset are treated in everyday practice as the same thing as an inventory. IT-Grundschutz means three different things, and none of them is a device list. Why 3,000 clients can be one target object and the crown jewel is never a system.
Read this part
A policy is not a guideline
Terms: Policy, guideline, security concept, work instruction
Basic terms, part 5: policy, guideline, security concept and work instruction end up in the same folder in many organisations, often in the same document. BSI Standard 200-1 distinguishes them by purpose, audience and approver. Mix the levels and you get a policy nobody is allowed to change and instructions nobody reads.
Read this part
A requirement is not a measure
Terms: Requirement, measure, control, module
Basic terms, part 6: "Has the measure been implemented?" Someone from IT-Grundschutz means something different by that than someone working to ISO 27001. The BSI Kompendium cleanly separates module, requirement and measure: what is being secured, what must be fulfilled and how it is fulfilled in your organisation. In the German ISO version, however, the control is called "Maßnahme" (measure). The same word, two levels.
Read this part
A Grundschutz check is not an audit
Terms: Grundschutz check, internal review, audit
Basic terms, part 7: "We had an audit in spring." Often it was an IT-Grundschutz check that the information security officer carried out with the responsible staff. That is valuable, but something else. BSI Standard 200-2 distinguishes three kinds of review: the check as a target/actual comparison, the IS audit as a regular review of effectiveness, and the audit by independent bodies. Who reviews, against what, and with what consequence.
Read this part
An attestation is not a certificate
Terms: Certification, accreditation, attestation
Basic terms, part 8: The supplier questionnaire says "ISO 27001 certified", "C5 attestation", "BSI-tested" or "accredited". Four answers that sound alike and mean different things. Who checks, who checks the checker, and what ends up on paper: certification, accreditation and attestation, with the passages from EU law, the BSI Act and the BSI's C5.
Read this partWhat is still to come
The order may shift; the topics are fixed.
- Part 9: Disruption, emergency, crisis
- Part 10: RTO, RPO, MTPD, WRT
- Part 11: BIA, risk analysis
- Part 12: Processing on behalf, joint controllership, transfer
- Part 13: Erasure, restriction, anonymisation, pseudonymisation
- Part 14: TOM, measure, safeguard
A term missing?
If two words stand for the same thing in your organisation and nobody can say whether they really do: write to us. The series lives on the confusions that actually occur in practice.