Definitions

12. The following definitions are used in this Prudential Standard:

(a) availability refers to accessibility and usability when required;

(b) confidentiality refers to access being restricted only to those authorised;

(c) criticality refers to the potential impact of a loss of availability;

(d) information asset means information and information technology, including software, hardware and data (both soft and hard copy);

(e) information security means the preservation of an information asset’s confidentiality, integrity and availability;

(f) information security capability means the totality of resources, skills and controls which provide the ability and capacity to maintain information security;

(g) information security control means a prevention, detection or response measure to reduce the likelihood or impact of an information security incident;

(h) information security incident means an actual or potential compromise of information security;

(i) information security policy framework means the totality of policies, standards, guidelines and procedures pertaining to information security;

(j) information security threat (threat) is a circumstance or event that has the potential to exploit an information security vulnerability;

(k) information security vulnerability (vulnerability) is a weakness in an information asset or information security control that could be exploited to compromise information security;

(l) integrity refers to completeness, accuracy and freedom from unauthorised change or usage; and

(m) sensitivity means the potential impact of a loss of confidentiality or integrity.