@prefix arkcyt: <https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix skos: <http://www.w3.org/2004/02/skos/core#> .
@prefix vocab: <http://purl.org/vocab/vann/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

arkcyt: a owl:Ontology,
        skos:ConceptScheme ;
    rdfs:label "ARK Cybersecurity Terminology"@en ;
    dcterms:abstract "This taxonomy defines cybersecurity terms, taken from ISO and NIST documents, that are used to model this domain on the ARK Platform. Due to copyright restrictions, no definitions are provided for ISO terms."@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:description "This taxonomy defines cybersecurity terms, taken from ISO and NIST documents, that are used to model this domain on the ARK Platform. Due to copyright restrictions, no definitions are provided for ISO terms."@en ;
    dcterms:modified "2024-05-29"^^xsd:date ;
    vocab:preferredNamespacePrefix "arkcyt" ;
    vocab:preferredNamespaceUri "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    rdfs:comment "This taxonomy defines cybersecurity terms, taken from ISO and NIST documents, that are used to model this domain on the ARK Platform. Due to copyright restrictions, no definitions are provided for ISO terms."@en ;
    owl:versionInfo "0.1" ;
    skos:prefLabel "ARK Cybersecurity Terminology"@en .

arkcyt:AccessControl a skos:Concept ;
    rdfs:label "Access control"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "means to ensure that access to assets is authorized and restricted based on business and security requirements"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "means to ensure that access to assets is authorized and restricted based on business and security requirements"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Access control"@en .

arkcyt:ApplicationSecurity a skos:Concept ;
    rdfs:label "Application security"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Application security"@en .

arkcyt:AssessDecideProcess a skos:Concept ;
    rdfs:label "Assess and decide process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2031" ;
    rdfs:comment """The third phase of information security incident management involves the assessment of information
associated with occurrences of information security events and the decision on whether to classify
events as information security incidents. The incident coordinator evaluates the event based on the
event report and the criteria defined during the plan and prepare phase and declare if it is an incident
or not."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The third phase of information security incident management involves the assessment of information
associated with occurrences of information security events and the decision on whether to classify
events as information security incidents. The incident coordinator evaluates the event based on the
event report and the criteria defined during the plan and prepare phase and declare if it is an incident
or not."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Assess and decide process"@en .

arkcyt:AssetManagement a skos:Concept ;
    rdfs:label "Asset management"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "An ISCM capability that identifies unauthorized software or unmanaged devices that are likely to be used by attackers as a platform from which to extend compromise of the network to be mitigated."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "An ISCM capability that identifies unauthorized software or unmanaged devices that are likely to be used by attackers as a platform from which to extend compromise of the network to be mitigated."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Asset management"@en .

arkcyt:Attack a skos:Concept ;
    rdfs:label "Attack"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurityIncident ;
    skos:definition "attempt to destroy, expose, alter, disable, steal or gain unauthorized access to or make unauthorized use of an asset."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Attack"@en .

arkcyt:AuditScope a skos:Concept ;
    rdfs:label "Audit scope"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "extent and boundaries of an audit (3.3)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Audit ;
    skos:definition "extent and boundaries of an audit (3.3)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Audit scope"@en .

arkcyt:Authentication a skos:Concept ;
    rdfs:label "Authentication"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "provision of assurance that a claimed characteristic of an entity is correct."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "provision of assurance that a claimed characteristic of an entity is correct."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Authentication"@en .

arkcyt:Authenticity a skos:Concept ;
    rdfs:label "Authenticity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "property that an entity is what it claims to be."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "property that an entity is what it claims to be."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Authenticity"@en .

arkcyt:Availability a skos:Concept ;
    rdfs:label "Availability"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date,
        "2024-04-08"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)",
        "ISO27000:2018" ;
    rdfs:comment "Ensuring timely and reliable access to and use of information."@en,
        "property of being accessible and usable on demand by an authorized entity."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "Ensuring timely and reliable access to and use of information."@en,
        "property of being accessible and usable on demand by an authorized entity."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Availability"@en .

arkcyt:BaseMeasure a skos:Concept ;
    rdfs:label "Base measure"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """measure (3.42) defined in terms of an attribute and the method for quantifying it
Note 1 to entry: A base measure is functionally independent of other measures."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Measure ;
    skos:definition """measure (3.42) defined in terms of an attribute and the method for quantifying it
Note 1 to entry: A base measure is functionally independent of other measures."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Base measure"@en .

arkcyt:Competence a skos:Concept ;
    rdfs:label "Competence"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "ability to apply knowledge and skills to achieve intended results."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "ability to apply knowledge and skills to achieve intended results."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Competence"@en .

arkcyt:Confidentiality a skos:Concept ;
    rdfs:label "Confidentiality"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date,
        "2024-04-08"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)",
        "ISO27000:2018" ;
    rdfs:comment "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information."@en,
        """property that information is not made available or disclosed to unauthorized individuals, entities, or
processes (3.54)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information."@en,
        """property that information is not made available or disclosed to unauthorized individuals, entities, or
processes (3.54)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Confidentiality"@en .

arkcyt:Conformity a skos:Concept ;
    rdfs:label "Conformity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "fulfilment of a requirement (3.56)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Requirement ;
    skos:definition "fulfilment of a requirement (3.56)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Conformity"@en .

arkcyt:Consequence a skos:Concept ;
    rdfs:label "Consequence"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """outcome of an event (3.21) affecting objectives (3.49)
Note 1 to entry: An event can lead to a range of consequences.
Note 2 to entry: A consequence can be certain or uncertain and, in the context of information security, is usually
negative.
Note 3 to entry: Consequences can be expressed qualitatively or quantitatively.
Note 4 to entry: Initial consequences can escalate through knock-on effects."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Event ;
    skos:definition """outcome of an event (3.21) affecting objectives (3.49)
Note 1 to entry: An event can lead to a range of consequences.
Note 2 to entry: A consequence can be certain or uncertain and, in the context of information security, is usually
negative.
Note 3 to entry: Consequences can be expressed qualitatively or quantitatively.
Note 4 to entry: Initial consequences can escalate through knock-on effects."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Consequence"@en .

arkcyt:ContinualImprovement a skos:Concept ;
    rdfs:label "Continual improvement"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "recurring activity to enhance performance (3.52)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Performance ;
    skos:definition "recurring activity to enhance performance (3.52)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Continual improvement"@en .

arkcyt:Continuity a skos:Concept ;
    rdfs:label "Continuity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "The probability that the specified PNT system performance will be maintained for the duration of a phase of operation, presuming that the PNT system was available at the beginning of that phase of operation."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The probability that the specified PNT system performance will be maintained for the duration of a phase of operation, presuming that the PNT system was available at the beginning of that phase of operation."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Continuity"@en .

arkcyt:ControlObjective a skos:Concept ;
    rdfs:label "Control objective"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "statement describing what is to be achieved as a result of implementing controls (3.14)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Control ;
    skos:definition "statement describing what is to be achieved as a result of implementing controls (3.14)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Control objective"@en .

arkcyt:Correction a skos:Concept ;
    rdfs:label "Correction"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "action to eliminate a detected nonconformity (3.47)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Nonconformity ;
    skos:definition "action to eliminate a detected nonconformity (3.47)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Correction"@en .

arkcyt:CorrectiveAction a skos:Concept ;
    rdfs:label "Corrective action"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "action to eliminate the cause of a nonconformity (3.47) and to prevent recurrence."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Nonconformity ;
    skos:definition "action to eliminate the cause of a nonconformity (3.47) and to prevent recurrence."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Corrective action"@en .

arkcyt:Defence a skos:Concept ;
    rdfs:label "Defence"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "is a layered approach to cyber security that covers five important elements: detection, protection, management, response and recovery."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "is a layered approach to cyber security that covers five important elements: detection, protection, management, response and recovery."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Defence"@en .

arkcyt:DerivedMeasure a skos:Concept ;
    rdfs:label "Derived measure"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "measure (3.42) that is defined as a function of two or more values of base measures (3.8)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Measure ;
    skos:definition "measure (3.42) that is defined as a function of two or more values of base measures (3.8)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Derived measure"@en .

arkcyt:Detect a skos:Concept ;
    rdfs:label "Detect"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Develop and implement appropriate activities to identify the occurrence of a cyber security event."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Develop and implement appropriate activities to identify the occurrence of a cyber security event."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Detect"@en .

arkcyt:DetectReportProcess a skos:Concept ;
    rdfs:label "Detect and report process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2030" ;
    rdfs:comment """The second phase of information security incident management involves the detection of, collection
of information associated with, and reporting on, occurrences of information security events and the
discovered or involved information security vulnerabilities, by manual or automatic means. In this
phase, events and vulnerabilities cannot yet be classified as information security incidents."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The second phase of information security incident management involves the detection of, collection
of information associated with, and reporting on, occurrences of information security events and the
discovered or involved information security vulnerabilities, by manual or automatic means. In this
phase, events and vulnerabilities cannot yet be classified as information security incidents."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Detect and report process"@en .

arkcyt:DocumentedInformation a skos:Concept ;
    rdfs:label "Documented information"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """information required to be controlled and maintained by an organization (3.50) and the medium on
which it is contained
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to
— the management system (3.41), including related processes (3.54);
— information created in order for the organization (3.50) to operate (documentation);
— evidence of results achieved (records)."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """information required to be controlled and maintained by an organization (3.50) and the medium on
which it is contained
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to
— the management system (3.41), including related processes (3.54);
— information created in order for the organization (3.50) to operate (documentation);
— evidence of results achieved (records)."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Documented information"@en .

arkcyt:Effectiveness a skos:Concept ;
    rdfs:label "Effectiveness"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "extent to which planned activities are realized and planned results achieved."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "extent to which planned activities are realized and planned results achieved."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Effectiveness"@en .

arkcyt:EventReport a skos:Concept ;
    rdfs:label "Event report"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2025" ;
    rdfs:comment """The event report should contain all that is necessary to understand the event and make a decision
regarding whether to classify the event as an incident."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The event report should contain all that is necessary to understand the event and make a decision
regarding whether to classify the event as an incident."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Event report"@en .

arkcyt:ExternalContext a skos:Concept ;
    rdfs:label "External context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """external environment in which the organization seeks to achieve its objectives (3.49)
Note 1 to entry: External context can include the following:
— the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive
environment, whether international, national, regional or local;
— key drivers and trends having impact on the objectives of the organization (3.50);
— relationships with, and perceptions and values of, external stakeholders (3.37)."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """external environment in which the organization seeks to achieve its objectives (3.49)
Note 1 to entry: External context can include the following:
— the cultural, social, political, legal, regulatory, financial, technological, economic, natural and competitive
environment, whether international, national, regional or local;
— key drivers and trends having impact on the objectives of the organization (3.50);
— relationships with, and perceptions and values of, external stakeholders (3.37)."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:narrower arkcyt:ExternalEnvrionment,
        arkcyt:ExternalStakeholder,
        arkcyt:KeyDriversAndTrends ;
    skos:prefLabel "External context"@en .

arkcyt:ExternalEnvironment a skos:Concept ;
    rdfs:label "External Environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-28"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "External Environment in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "External Environment in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:narrower arkcyt:CompetitiveEnvironment,
        arkcyt:CulturalEnvironment,
        arkcyt:EconomicEnvironment,
        arkcyt:FinancialEnvironment,
        arkcyt:LegalEnvironment,
        arkcyt:NaturalEnvironment,
        arkcyt:PoliticalEnvironment,
        arkcyt:RegulatoryEnvironment,
        arkcyt:SocialEnvironment,
        arkcyt:TechnologicalEnvironment ;
    skos:prefLabel "External Environment"@en .

arkcyt:GeneralDocumentation a skos:Concept ;
    rdfs:label "General documentation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2024" ;
    rdfs:comment """It is crucial to document as much information as possible related to the event/incident from its detection
through to its resolution. The incident report is the synthesis of all this information."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """It is crucial to document as much information as possible related to the event/incident from its detection
through to its resolution. The incident report is the synthesis of all this information."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "General documentation"@en .

arkcyt:Governance a skos:Concept ;
    rdfs:label "Governance"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "A set of processes that ensures that data assets are formally managed throughout the enterprise. A data governance model establishes authority and management and decision making parameters related to the data produced or managed by the enterprise."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "A set of processes that ensures that data assets are formally managed throughout the enterprise. A data governance model establishes authority and management and decision making parameters related to the data produced or managed by the enterprise."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Governance"@en .

arkcyt:GovernanceInformationSecurity a skos:Concept ;
    rdfs:label "Governance of information security"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """system by which an organization’s (3.50) information security (3.28) activities are directed and
controlled."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition """system by which an organization’s (3.50) information security (3.28) activities are directed and
controlled."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Governance of information security"@en .

arkcyt:Governance_and_Ecosystem a skos:Concept ;
    rdfs:label "Governance and ecosystem"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "an approach that merges different disciplines to explore ways that human can protect the environment and maintain activities in a sustainable manner."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "an approach that merges different disciplines to explore ways that human can protect the environment and maintain activities in a sustainable manner."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Governance and ecosystem"@en .

arkcyt:GoverningBody a skos:Concept ;
    rdfs:label "Governing body"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """person or group of people who are accountable for the performance (3.52) and conformity of the
organization (3.50)
Note 1 to entry: The governing body can, in some jurisdictions, be a board of directors."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Organization ;
    skos:definition """person or group of people who are accountable for the performance (3.52) and conformity of the
organization (3.50)
Note 1 to entry: The governing body can, in some jurisdictions, be a board of directors."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Governing body"@en .

arkcyt:HumanResourceSecurity a skos:Concept ;
    rdfs:label "Human resource security"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Human Resources Security is a set of processes designed to ensure that all employees, suppliers, and contractors are qualified for and understand their engagement/job tasks and responsibilities, and that access is revoked after the engagement is finished."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Human Resources Security is a set of processes designed to ensure that all employees, suppliers, and contractors are qualified for and understand their engagement/job tasks and responsibilities, and that access is revoked after the engagement is finished."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Human resource security"@en .

arkcyt:Identify a skos:Concept ;
    rdfs:label "Identify"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Develop the organisation’s understanding to manage cyber security risk to systems, assets, data and capabilities."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Develop the organisation’s understanding to manage cyber security risk to systems, assets, data and capabilities."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Identify"@en .

arkcyt:IdentityAndAccessManagement a skos:Concept ;
    rdfs:label "Identity and access management"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Access Management is the set of practices that enables only those permitted the ability to perform an action on a particular resource. The three most common Access Management services you encounter every day perhaps without realizing it are: Policy Administration, Authentication, and Authorization."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Access Management is the set of practices that enables only those permitted the ability to perform an action on a particular resource. The three most common Access Management services you encounter every day perhaps without realizing it are: Policy Administration, Authentication, and Authorization."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Identity and access management"@en .

arkcyt:IncidentCoordinator a skos:Concept ;
    rdfs:label "Incident coordinator"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2017" ;
    rdfs:comment """person responsible for leading all incident response (3.1.9) activities and coordinating the incident
response team"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """person responsible for leading all incident response (3.1.9) activities and coordinating the incident
response team"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident coordinator"@en .

arkcyt:IncidentManagementLog a skos:Concept ;
    rdfs:label "Incident management log"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2026" ;
    rdfs:comment """All information gathered during the incident response should be documented/recorded/logged to
serve as a record of actions i.e. date/time and corresponding action/decision."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """All information gathered during the incident response should be documented/recorded/logged to
serve as a record of actions i.e. date/time and corresponding action/decision."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident management log"@en .

arkcyt:IncidentManagementTeam a skos:Concept ;
    rdfs:label "Incident management team"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2015" ;
    rdfs:comment """team consisting of appropriately skilled and trusted members of an organization responsible for
leading all information security incident management activities, in coordination with other parties
both internal and external, throughout the incident lifecycle"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """team consisting of appropriately skilled and trusted members of an organization responsible for
leading all information security incident management activities, in coordination with other parties
both internal and external, throughout the incident lifecycle"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident management team"@en .

arkcyt:IncidentRegister a skos:Concept ;
    rdfs:label "Incident register"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2028" ;
    rdfs:comment """All information security incidents should be recorded in a centrally managed incident register. This
register provides the IMT with an overview of the incidents that have occurred in the organization,
their status, and any follow up activities. It can also be used by the IMT to provide reports to top
management regarding trends and themes around the threat environment and feed into organizational
planning and risk assessments."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """All information security incidents should be recorded in a centrally managed incident register. This
register provides the IMT with an overview of the incidents that have occurred in the organization,
their status, and any follow up activities. It can also be used by the IMT to provide reports to top
management regarding trends and themes around the threat environment and feed into organizational
planning and risk assessments."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident register"@en .

arkcyt:IncidentReport a skos:Concept ;
    rdfs:label "Incident report"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2027" ;
    rdfs:comment """The incident report is the synthesis of all gathered information throughout the incident life cycle. It
serves to analyse and evaluate the incident, and decide if changes are planned for incident management
capability (see also 4.5).
A pre-formatted template document for incident reports should be prepared to ensure no essential
information is missed or overlooked."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The incident report is the synthesis of all gathered information throughout the incident life cycle. It
serves to analyse and evaluate the incident, and decide if changes are planned for incident management
capability (see also 4.5).
A pre-formatted template document for incident reports should be prepared to ensure no essential
information is missed or overlooked."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident report"@en .

arkcyt:IncidentResponse a skos:Concept ;
    rdfs:label "Incident response"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2022" ;
    rdfs:comment """actions taken to mitigate or resolve an information security incident (3.1.5), including those taken to
protect and restore the normal operational conditions of an information system and the information
stored in it"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """actions taken to mitigate or resolve an information security incident (3.1.5), including those taken to
protect and restore the normal operational conditions of an information system and the information
stored in it"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident response"@en .

arkcyt:IncidentResponseTeam a skos:Concept ;
    rdfs:label "Incident response team"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2016" ;
    rdfs:comment """team of appropriately skilled and trusted members of an organization that responds to and resolves
incidents in a coordinated way"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """team of appropriately skilled and trusted members of an organization that responds to and resolves
incidents in a coordinated way"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident response team"@en .

arkcyt:Indicator a skos:Concept ;
    rdfs:label "Indicator"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "measure (3.42) that provides an estimate or evaluation."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Measure ;
    skos:definition "measure (3.42) that provides an estimate or evaluation."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Indicator"@en .

arkcyt:InformationNeed a skos:Concept ;
    rdfs:label "Information need"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "insight necessary to manage objectives (3.49), goals, risks and problems."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "insight necessary to manage objectives (3.49), goals, risks and problems."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information need"@en .

arkcyt:InformationProcessingFacility a skos:Concept ;
    rdfs:label "Information processing facility"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "any information processing system, service or infrastructure, or the physical location housing it."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "any information processing system, service or infrastructure, or the physical location housing it."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information processing facility"@en .

arkcyt:InformationProtection a skos:Concept ;
    rdfs:label "Information protection"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Ensur(ing) that any data contained in a resource is not available when the resource is de-allocated from one object and reallocated to a different object."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Ensur(ing) that any data contained in a resource is not available when the resource is de-allocated from one object and reallocated to a different object."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information protection"@en .

arkcyt:InformationSecurityAssurance a skos:Concept ;
    rdfs:label "Information security assurance"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security assurance"@en .

arkcyt:InformationSecurityContinuity a skos:Concept ;
    rdfs:label "Information security continuity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "processes (3.54) and procedures for ensuring continued information security (3.28) operations."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "processes (3.54) and procedures for ensuring continued information security (3.28) operations."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security continuity"@en .

arkcyt:InformationSecurityEvent a skos:Concept ;
    rdfs:label "Information security event"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date,
        "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2018",
        "ISO27000:2018" ;
    rdfs:comment """identified occurrence of a system, service or network state indicating a possible breach of information
security (3.28) policy (3.53) or failure of controls (3.14), or a previously unknown situation that can be
security relevant."""@en,
        "occurrence indicating a possible breach of information security or failure of controls"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition """identified occurrence of a system, service or network state indicating a possible breach of information
security (3.28) policy (3.53) or failure of controls (3.14), or a previously unknown situation that can be
security relevant."""@en,
        "occurrence indicating a possible breach of information security or failure of controls"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security event"@en .

arkcyt:InformationSecurityEventManagement a skos:Concept ;
    rdfs:label "Information security event management "@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "A program that provides centralized logging capabilities for a variety of log types."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "A program that provides centralized logging capabilities for a variety of log types."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security event management "@en .

arkcyt:InformationSecurityInvestigation a skos:Concept ;
    rdfs:label "Information security investigation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2021" ;
    rdfs:comment """application of examinations, analysis and interpretation to aid understanding of an information security
incident"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """application of examinations, analysis and interpretation to aid understanding of an information security
incident"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security investigation"@en .

arkcyt:InformationSecurityManagementSystemProfessional a skos:Concept ;
    rdfs:label "Information security management system professional"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """person who establishes, implements, maintains and continuously improves one or more information
security management system processes (3.54)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurityIncidentManagement ;
    skos:definition """person who establishes, implements, maintains and continuously improves one or more information
security management system processes (3.54)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security management system professional"@en .

arkcyt:InformationSharingCommunity a skos:Concept ;
    rdfs:label "Information sharing community"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """group of organizations (3.50) that agree to share information
Note 1 to entry: An organization can be an individual."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """group of organizations (3.50) that agree to share information
Note 1 to entry: An organization can be an individual."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information sharing community"@en .

arkcyt:InformationSystem a skos:Concept ;
    rdfs:label "Information system"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "set of applications, services, information technology assets, or other information-handling components."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "set of applications, services, information technology assets, or other information-handling components."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information system"@en .

arkcyt:Integreity a skos:Concept ;
    rdfs:label "Integreity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Integreity"@en .

arkcyt:Integrity a skos:Concept ;
    rdfs:label "Integrity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "property of accuracy and completenes."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "property of accuracy and completenes."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Integrity"@en .

arkcyt:InterestedParty a skos:Concept ;
    rdfs:label "Interested party"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision
or activity."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision
or activity."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Interested party"@en .

arkcyt:InternalContext a skos:Concept ;
    rdfs:label "Internal context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """internal environment in which the organization (3.50) seeks to achieve its objectives
Note 1 to entry: Internal context can include:
— governance, organizational structure, roles and accountabilities;
— policies (3.53), objectives (3.49), and the strategies that are in place to achieve them;
— the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes (3.54),
systems and technologies);
— information systems (3.35), information flows and decision-making processes (both formal and informal);
— relationships with, and perceptions and values of, internal stakeholders (3.37);
— the organization's culture;
— standards, guidelines and models adopted by the organization;
— form and extent of contractual relationships."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """internal environment in which the organization (3.50) seeks to achieve its objectives
Note 1 to entry: Internal context can include:
— governance, organizational structure, roles and accountabilities;
— policies (3.53), objectives (3.49), and the strategies that are in place to achieve them;
— the capabilities, understood in terms of resources and knowledge (e.g. capital, time, people, processes (3.54),
systems and technologies);
— information systems (3.35), information flows and decision-making processes (both formal and informal);
— relationships with, and perceptions and values of, internal stakeholders (3.37);
— the organization's culture;
— standards, guidelines and models adopted by the organization;
— form and extent of contractual relationships."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:narrower arkcyt:CapabilitiesContext,
        arkcyt:ContractualContext,
        arkcyt:CultureContext,
        arkcyt:DecisionMakingProcessContext,
        arkcyt:GovernanceContext,
        arkcyt:GuidelinesContext,
        arkcyt:InformationFlowContext,
        arkcyt:InformationSystemContext,
        arkcyt:InternalStakeholderContext,
        arkcyt:ModelsContext,
        arkcyt:ObjectiveContext,
        arkcyt:OrganisationalStructureContext,
        arkcyt:OrganizationalAccountabilityContext,
        arkcyt:OrganizationalRoleContext,
        arkcyt:PolicyContext,
        arkcyt:StandardsContext,
        arkcyt:StrategyContext ;
    skos:prefLabel "Internal context"@en .

arkcyt:LearnLessonsProcess a skos:Concept ;
    rdfs:label "Learn lessons process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2033" ;
    rdfs:comment """The fifth phase of information security incident management occurs when information security
incidents have been resolved. This phase involves learning lessons from how incidents, related
vulnerabilities and threats have been handled."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The fifth phase of information security incident management occurs when information security
incidents have been resolved. This phase involves learning lessons from how incidents, related
vulnerabilities and threats have been handled."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Learn lessons process"@en .

arkcyt:LegalAndCompliance a skos:Concept ;
    rdfs:label "Legal and compliance"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "A comprehensive review of an organization's adherence to governing documents such as whether a Certification Practice Statement satisfies the requirements of a Certificate Policy and whether an organization adheres to its Certification Practice Statement."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "A comprehensive review of an organization's adherence to governing documents such as whether a Certification Practice Statement satisfies the requirements of a Certificate Policy and whether an organization adheres to its Certification Practice Statement."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Legal and compliance"@en .

arkcyt:LevelRisk a skos:Concept ;
    rdfs:label "Level of risk"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """magnitude of a risk (3.61) expressed in terms of the combination of consequences (3.12) and their
likelihood (3.40)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """magnitude of a risk (3.61) expressed in terms of the combination of consequences (3.12) and their
likelihood (3.40)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Level of risk"@en .

arkcyt:Likelihood a skos:Concept ;
    rdfs:label "Likelihood"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "chance of something happening."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition "chance of something happening."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Likelihood"@en .

arkcyt:MeasurementFunction a skos:Concept ;
    rdfs:label "Measurement function"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "algorithm or calculation performed to combine two or more base measures (3.8)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Measurement ;
    skos:definition "algorithm or calculation performed to combine two or more base measures (3.8)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Measurement function"@en .

arkcyt:MeasurementMethod a skos:Concept ;
    rdfs:label "Measurement method"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """logical sequence of operations, described generically, used in quantifying an attribute with respect to a
specified scale
Note 1 to entry: The type of measurement method depends on the nature of the operations used to quantify an
attribute (3.4). Two types can be distinguished:
— subjective: quantification involving human judgment; and
— objective: quantification based on numerical rules."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Measurement ;
    skos:definition """logical sequence of operations, described generically, used in quantifying an attribute with respect to a
specified scale
Note 1 to entry: The type of measurement method depends on the nature of the operations used to quantify an
attribute (3.4). Two types can be distinguished:
— subjective: quantification involving human judgment; and
— objective: quantification based on numerical rules."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Measurement method"@en .

arkcyt:Monitoring a skos:Concept ;
    rdfs:label "Monitoring"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """determining the status of a system, a process (3.54) or an activity
Note 1 to entry: To determine the status, there may be a need to check, supervise or critically observe."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """determining the status of a system, a process (3.54) or an activity
Note 1 to entry: To determine the status, there may be a need to check, supervise or critically observe."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Monitoring"@en .

arkcyt:Nonrepudiation a skos:Concept ;
    rdfs:label "Non-repudiation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "ability to prove the occurrence of a claimed event (3.21) or action and its originating entities."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "ability to prove the occurrence of a claimed event (3.21) or action and its originating entities."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Non-repudiation"@en .

arkcyt:Objective a skos:Concept ;
    rdfs:label "Objective"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """result to be achieved
Note 1 to entry: An objective can be strategic, tactical, or operational.
Note 2 to entry: Objectives can relate to different disciplines (such as financial, health and safety, and
environmental goals) and can apply at different levels [such as strategic, organization-wide, project, product and
process (3.54)].
Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an
operational criterion, as an information security objective or by the use of other words with similar meaning (e.g.
aim, goal, or target).
Note 4 to entry: In the context of information security management systems, information security objectives are
set by the organization, consistent with the information security policy, to achieve specific results."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:ManagementSystem ;
    skos:definition """result to be achieved
Note 1 to entry: An objective can be strategic, tactical, or operational.
Note 2 to entry: Objectives can relate to different disciplines (such as financial, health and safety, and
environmental goals) and can apply at different levels [such as strategic, organization-wide, project, product and
process (3.54)].
Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an
operational criterion, as an information security objective or by the use of other words with similar meaning (e.g.
aim, goal, or target).
Note 4 to entry: In the context of information security management systems, information security objectives are
set by the organization, consistent with the information security policy, to achieve specific results."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Objective"@en .

arkcyt:Outsource a skos:Concept ;
    rdfs:label "Outsource"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """make an arrangement where an external organization (3.50) performs part of an organization’s function
or process (3.54)
Note 1 to entry: An external organization is outside the scope of the management system (3.41), although the
outsourced function or process is within the scope."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Organization ;
    skos:definition """make an arrangement where an external organization (3.50) performs part of an organization’s function
or process (3.54)
Note 1 to entry: An external organization is outside the scope of the management system (3.41), although the
outsourced function or process is within the scope."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Outsource"@en .

arkcyt:PhysicalSecurity a skos:Concept ;
    rdfs:label "Physical security"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "A set of mutually reinforcing security controls implemented by technical, physical, and procedural means. Such controls are typically selected to achieve a common information security-related purpose."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "A set of mutually reinforcing security controls implemented by technical, physical, and procedural means. Such controls are typically selected to achieve a common information security-related purpose."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Physical security"@en .

arkcyt:PlanPrepareProcess a skos:Concept ;
    rdfs:label "Plan and prepare process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2029" ;
    rdfs:comment """Effective information security incident management requires appropriate planning and preparation.
It is essential to keep calm at all stages of incident response, and that this response time is controlled
and mastered. If it is not, prolonged incident duration may increase adverse impact to the organization.
This response time should be computed as a portion of the recovery time objective (RTO, see
ISO/IEC 27031:2011, 3.13 and 6.3) and should take into consideration the inevitable delay necessary for
detection, reporting and assessment."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Effective information security incident management requires appropriate planning and preparation.
It is essential to keep calm at all stages of incident response, and that this response time is controlled
and mastered. If it is not, prolonged incident duration may increase adverse impact to the organization.
This response time should be computed as a portion of the recovery time objective (RTO, see
ISO/IEC 27031:2011, 3.13 and 6.3) and should take into consideration the inevitable delay necessary for
detection, reporting and assessment."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Plan and prepare process"@en .

arkcyt:PointContact a skos:Concept ;
    rdfs:label "Point of contact"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2023" ;
    rdfs:comment """defined organizational function or role serving as the coordinator or focal point of information
concerning incident management activities"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """defined organizational function or role serving as the coordinator or focal point of information
concerning incident management activities"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Point of contact"@en .

arkcyt:Policy a skos:Concept ;
    rdfs:label "Policy"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "intentions and direction of an organization (3.50), as formally expressed by its top management (3.75)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:ManagementSystem ;
    skos:definition "intentions and direction of an organization (3.50), as formally expressed by its top management (3.75)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Policy"@en .

arkcyt:Process a skos:Concept ;
    rdfs:label "Process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date,
        "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2028",
        "ISO27000:2018" ;
    rdfs:comment "set of activities that have a common goal and last for a limited period of time"@en,
        "set of interrelated or interacting activities which transforms inputs into outputs."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:ManagementSystem ;
    skos:definition "set of activities that have a common goal and last for a limited period of time"@en,
        "set of interrelated or interacting activities which transforms inputs into outputs."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Process"@en .

arkcyt:Protect a skos:Concept ;
    rdfs:label "Protect"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Develop and implement safeguards to deliver critical infrastructure services."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Develop and implement safeguards to deliver critical infrastructure services."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Protect"@en .

arkcyt:Protection a skos:Concept ;
    rdfs:label "Protection"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "In the context of systems security engineering, a control objective that applies across all types of asset types and the corresponding consequences of loss. A system protection capability is a system control objective and a system design problem. The solution to the problem is optimized through a balanced proactive strategy and a reactive strategy that is not limited to prevention. The strategy also encompasses avoiding asset loss and consequences; detecting asset loss and consequences; minimizing (i.e., limiting, containing, restricting) asset loss and consequences; responding to asset loss and consequences; recovering from asset loss and consequences; and forecasting or predicting asset loss and consequences."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "In the context of systems security engineering, a control objective that applies across all types of asset types and the corresponding consequences of loss. A system protection capability is a system control objective and a system design problem. The solution to the problem is optimized through a balanced proactive strategy and a reactive strategy that is not limited to prevention. The strategy also encompasses avoiding asset loss and consequences; detecting asset loss and consequences; minimizing (i.e., limiting, containing, restricting) asset loss and consequences; responding to asset loss and consequences; recovering from asset loss and consequences; and forecasting or predicting asset loss and consequences."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Protection"@en .

arkcyt:Recover a skos:Concept ;
    rdfs:label "Recover"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment """Develop and implement the appropriate activities to maintain plans for 
resilience and to restore any capabilities or services that were 
impaired due to a cyber security event."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Develop and implement the appropriate activities to maintain plans for 
resilience and to restore any capabilities or services that were 
impaired due to a cyber security event."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Recover"@en .

arkcyt:Reliability a skos:Concept ;
    rdfs:label "Reliability"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "property of consistent intended behaviour and results."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition "property of consistent intended behaviour and results."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Reliability"@en .

arkcyt:ResidualRisk a skos:Concept ;
    rdfs:label "Residual risk"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """risk (3.61) remaining after risk treatment (3.72)
Note 1 to entry: Residual risk can contain unidentified risk.
Note 2 to entry: Residual risk can also be referred to as “retained risk”."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """risk (3.61) remaining after risk treatment (3.72)
Note 1 to entry: Residual risk can contain unidentified risk.
Note 2 to entry: Residual risk can also be referred to as “retained risk”."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Residual risk"@en .

arkcyt:Resilience a skos:Concept ;
    rdfs:label "Resilience"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "The ability of an information system to continue to: (i) operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities; and (ii) recover to an effective operational posture in a time frame consistent with mission needs."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The ability of an information system to continue to: (i) operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities; and (ii) recover to an effective operational posture in a time frame consistent with mission needs."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Resilience"@en .

arkcyt:Respond a skos:Concept ;
    rdfs:label "Respond"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Create and put into practice the appropriate activities to take action in response to detected cyber security events."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Create and put into practice the appropriate activities to take action in response to detected cyber security events."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Respond"@en .

arkcyt:RespondProcess a skos:Concept ;
    rdfs:label "Respond process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2032" ;
    rdfs:comment """The fourth phase of information security incident management involves responding to information
security incidents in accordance with the decision in the assess and decide phase, and the procedures
described in the response plan elaborated during the plan and prepare phase. Depending on the
decisions, the responses can be made immediately, in real-time, or in near real-time, and some
responses can involve information security investigation. The incident coordinator is the key role to
coordinate the activities of the IRT(s) and monitor the response timer."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The fourth phase of information security incident management involves responding to information
security incidents in accordance with the decision in the assess and decide phase, and the procedures
described in the response plan elaborated during the plan and prepare phase. Depending on the
decisions, the responses can be made immediately, in real-time, or in near real-time, and some
responses can involve information security investigation. The incident coordinator is the key role to
coordinate the activities of the IRT(s) and monitor the response timer."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Respond process"@en .

arkcyt:ReviewObject a skos:Concept ;
    rdfs:label "Review object"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "specific item being reviewed."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Review ;
    skos:definition "specific item being reviewed."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Review object"@en .

arkcyt:ReviewObjective a skos:Concept ;
    rdfs:label "Review objective"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "statement describing what is to be achieved as a result of a review (3.59)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Review ;
    skos:definition "statement describing what is to be achieved as a result of a review (3.59)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Review objective"@en .

arkcyt:RiskAcceptance a skos:Concept ;
    rdfs:label "Risk acceptance"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """informed decision to take a particular risk (3.61)
Note 1 to entry: Risk acceptance can occur without risk treatment (3.72) or during the process (3.54) of risk
treatment.
Note 2 to entry: Accepted risks are subject to monitoring (3.46) and review (3.58)."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """informed decision to take a particular risk (3.61)
Note 1 to entry: Risk acceptance can occur without risk treatment (3.72) or during the process (3.54) of risk
treatment.
Note 2 to entry: Accepted risks are subject to monitoring (3.46) and review (3.58)."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk acceptance"@en .

arkcyt:RiskAnalysis a skos:Concept ;
    rdfs:label "Risk analysis"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """process (3.54) to comprehend the nature of risk (3.61) and to determine the level of risk (3.39)
Note 1 to entry: Risk analysis provides the basis for risk evaluation (3.67) and decisions about risk treatment (3.72).
Note 2 to entry: Risk analysis includes risk estimation."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """process (3.54) to comprehend the nature of risk (3.61) and to determine the level of risk (3.39)
Note 1 to entry: Risk analysis provides the basis for risk evaluation (3.67) and decisions about risk treatment (3.72).
Note 2 to entry: Risk analysis includes risk estimation."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk analysis"@en .

arkcyt:RiskAssessment a skos:Concept ;
    rdfs:label "Risk assessment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "overall process (3.54) of risk identification (3.68), risk analysis (3.63) and risk evaluation (3.67)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition "overall process (3.54) of risk identification (3.68), risk analysis (3.63) and risk evaluation (3.67)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk assessment"@en .

arkcyt:RiskCommunicationConsultation a skos:Concept ;
    rdfs:label "Risk communication and consultation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """set of continual and iterative processes (3.54) that an organization conducts to provide, share or obtain
information, and to engage in dialogue with stakeholders (3.37) regarding the management of risk (3.61)
Note 1 to entry: The information can relate to the existence, nature, form, likelihood (3.41), significance,
evaluation, acceptability and treatment of risk.
Note 2 to entry: Consultation is a two-way process of informed communication between an organization (3.50) and
its stakeholders on an issue prior to making a decision or determining a direction on that issue. Consultation is
— a process which impacts on a decision through influence rather than power; and
— an input to decision making, not joint decision making."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """set of continual and iterative processes (3.54) that an organization conducts to provide, share or obtain
information, and to engage in dialogue with stakeholders (3.37) regarding the management of risk (3.61)
Note 1 to entry: The information can relate to the existence, nature, form, likelihood (3.41), significance,
evaluation, acceptability and treatment of risk.
Note 2 to entry: Consultation is a two-way process of informed communication between an organization (3.50) and
its stakeholders on an issue prior to making a decision or determining a direction on that issue. Consultation is
— a process which impacts on a decision through influence rather than power; and
— an input to decision making, not joint decision making."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk communication and consultation"@en .

arkcyt:RiskCriteria a skos:Concept ;
    rdfs:label "Risk criteria"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """terms of reference against which the significance of risk (3.61) is evaluated
Note 1 to entry: Risk criteria are based on organizational objectives, and external context (3.22) and internal
context (3.38).
Note 2 to entry: Risk criteria can be derived from standards, laws, policies (3.53) and other requirements (3.56)."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """terms of reference against which the significance of risk (3.61) is evaluated
Note 1 to entry: Risk criteria are based on organizational objectives, and external context (3.22) and internal
context (3.38).
Note 2 to entry: Risk criteria can be derived from standards, laws, policies (3.53) and other requirements (3.56)."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk criteria"@en .

arkcyt:RiskEvaluation a skos:Concept ;
    rdfs:label "Risk evaluation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """process (3.54) of comparing the results of risk analysis (3.63) with risk criteria (3.66) to determine
whether the risk (3.61) and/or its magnitude is acceptable or tolerable
Note 1 to entry: Risk evaluation assists in the decision about risk treatment (3.72)."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """process (3.54) of comparing the results of risk analysis (3.63) with risk criteria (3.66) to determine
whether the risk (3.61) and/or its magnitude is acceptable or tolerable
Note 1 to entry: Risk evaluation assists in the decision about risk treatment (3.72)."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk evaluation"@en .

arkcyt:RiskIdentification a skos:Concept ;
    rdfs:label "Risk identification"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """process (3.54) of finding, recognizing and describing risks (3.61)
Note 1 to entry: Risk identification involves the identification of risk sources, events (3.21), their causes and their
potential consequences (3.12).
Note 2 to entry: Risk identification can involve historical data, theoretical analysis, informed and expert opinions,
and stakeholders’ (3.37) needs."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """process (3.54) of finding, recognizing and describing risks (3.61)
Note 1 to entry: Risk identification involves the identification of risk sources, events (3.21), their causes and their
potential consequences (3.12).
Note 2 to entry: Risk identification can involve historical data, theoretical analysis, informed and expert opinions,
and stakeholders’ (3.37) needs."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk identification"@en .

arkcyt:RiskManagementProcess a skos:Concept ;
    rdfs:label "Risk management process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """systematic application of management policies (3.53), procedures and practices to the activities of
communicating, consulting, establishing the context and identifying, analysing, evaluating, treating,
monitoring and reviewing risk (3.61)
Note 1 to entry: ISO/IEC 27005 uses the term “process” (3.54) to describe risk management overall. The elements
within the risk management (3.69) process are referred to as “activities”."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:RiskManagement ;
    skos:definition """systematic application of management policies (3.53), procedures and practices to the activities of
communicating, consulting, establishing the context and identifying, analysing, evaluating, treating,
monitoring and reviewing risk (3.61)
Note 1 to entry: ISO/IEC 27005 uses the term “process” (3.54) to describe risk management overall. The elements
within the risk management (3.69) process are referred to as “activities”."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk management process"@en .

arkcyt:RiskOwner a skos:Concept ;
    rdfs:label "Risk owner"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "person or entity with the accountability and authority to manage a risk (3.61)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:RiskManagement ;
    skos:definition "person or entity with the accountability and authority to manage a risk (3.61)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk owner"@en .

arkcyt:RiskTreatment a skos:Concept ;
    rdfs:label "Risk treatment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """process (3.54) to modify risk (3.61)
Note 1 to entry: Risk treatment can involve:
— avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
— taking or increasing risk in order to pursue an opportunity;
— removing the risk source;
— changing the likelihood (3.40);
— changing the consequences (3.12);
— sharing the risk with another party or parties (including contracts and risk financing);
— retaining the risk by informed choice.
Note 2 to entry: Risk treatments that deal with negative consequences are sometimes referred to as “risk
mitigation”, “risk elimination”, “risk prevention” and “risk reduction”.
Note 3 to entry: Risk treatment can create new risks or modify existing risks."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:RiskManagement ;
    skos:definition """process (3.54) to modify risk (3.61)
Note 1 to entry: Risk treatment can involve:
— avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk;
— taking or increasing risk in order to pursue an opportunity;
— removing the risk source;
— changing the likelihood (3.40);
— changing the consequences (3.12);
— sharing the risk with another party or parties (including contracts and risk financing);
— retaining the risk by informed choice.
Note 2 to entry: Risk treatments that deal with negative consequences are sometimes referred to as “risk
mitigation”, “risk elimination”, “risk prevention” and “risk reduction”.
Note 3 to entry: Risk treatment can create new risks or modify existing risks."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk treatment"@en .

arkcyt:SecureConfiguration a skos:Concept ;
    rdfs:label "Secure configuration"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "A recognized standardized and established benchmark (e.g., National Checklist Program, DISA STIGs, CIS Benchmarks, etc.) that stipulates specific secure configuration settings for a given IT platform."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "A recognized standardized and established benchmark (e.g., National Checklist Program, DISA STIGs, CIS Benchmarks, etc.) that stipulates specific secure configuration settings for a given IT platform."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Secure configuration"@en .

arkcyt:SecurityImplementationStandard a skos:Concept ;
    rdfs:label "Security implementation standard"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "document specifying authorized ways for realizing security."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "document specifying authorized ways for realizing security."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Security implementation standard"@en .

arkcyt:StakeholderContext a skos:Concept ;
    rdfs:label "Stakeholder Context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-28"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "Stakeholder Context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Stakeholder Context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:narrower arkcyt:StakeholderPerception,
        arkcyt:StakeholderRelationship,
        arkcyt:StakeholderValue ;
    skos:prefLabel "Stakeholder Context"@en .

arkcyt:SupplierRelationshipsSecurity a skos:Concept ;
    rdfs:label "Supplier relationship security"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "In a supplier relationship, it is important for an organisation to ensure that its information is protected against risks such as data breaches, unauthorized access, or loss of confidentiality. This can be achieved through a combination of technical and organisational measures and through establishing clear policies and procedures for handling and protecting information."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "In a supplier relationship, it is important for an organisation to ensure that its information is protected against risks such as data breaches, unauthorized access, or loss of confidentiality. This can be achieved through a combination of technical and organisational measures and through establishing clear policies and procedures for handling and protecting information."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Supplier relationship security"@en .

arkcyt:SystemAndNetworkSecurity a skos:Concept ;
    rdfs:label "System and network security"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "Protecting network communications at the layer of the IP model that is responsible for routing packets across networks."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Protecting network communications at the layer of the IP model that is responsible for routing packets across networks."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "System and network security"@en .

arkcyt:Threat a skos:Concept ;
    rdfs:label "Threat"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "potential cause of an unwanted incident, which can result in harm to a system or organization (3.50)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurityIncident ;
    skos:definition "potential cause of an unwanted incident, which can result in harm to a system or organization (3.50)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Threat"@en .

arkcyt:ThreatAndVulnerabilityManagement a skos:Concept ;
    rdfs:label "Threat and vulnerability management"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-03-14"^^xsd:date ;
    dcterms:source "ISO/IEC 27002:2022(E)" ;
    rdfs:comment "An ISCM capability that identifies vulnerabilities [Common Vulnerabilities and Exposures (CVEs)] on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to the network."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "An ISCM capability that identifies vulnerabilities [Common Vulnerabilities and Exposures (CVEs)] on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to the network."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Threat and vulnerability management"@en .

arkcyt:TopManagement a skos:Concept ;
    rdfs:label "Top management"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """person or group of people who directs and controls an organization (3.50) at the highest level
Note 1 to entry: Top management has the power to delegate authority and provide resources within the
organization.
Note 2 to entry: If the scope of the management system (3.41) covers only part of an organization, then top
management refers to those who direct and control that part of the organization. Note 3 to entry: Top management is sometimes called executive management and can include Chief Executive
Officers, Chief Financial Officers, Chief Information Officers, and similar roles."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Organization ;
    skos:definition """person or group of people who directs and controls an organization (3.50) at the highest level
Note 1 to entry: Top management has the power to delegate authority and provide resources within the
organization.
Note 2 to entry: If the scope of the management system (3.41) covers only part of an organization, then top
management refers to those who direct and control that part of the organization. Note 3 to entry: Top management is sometimes called executive management and can include Chief Executive
Officers, Chief Financial Officers, Chief Information Officers, and similar roles."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Top management"@en .

arkcyt:TrustedInformationCommunicationEntity a skos:Concept ;
    rdfs:label "Trusted information communication entity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """autonomous organization (3.50) supporting information exchange within an information sharing
community (3.34)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """autonomous organization (3.50) supporting information exchange within an information sharing
community (3.34)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Trusted information communication entity"@en .

arkcyt:Vulnerability a skos:Concept ;
    rdfs:label "Vulnerability"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "weakness of an asset or control (3.14) that can be exploited by one or more threats (3.74)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "weakness of an asset or control (3.14) that can be exploited by one or more threats (3.74)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Vulnerability"@en .

arkcyt:acquisition a skos:Concept ;
    rdfs:label "acquisition"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2015" ;
    rdfs:comment "process of creating a copy of data within a defined set"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "process of creating a copy of data within a defined set"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "acquisition"@en .

arkcyt:acquisitiveProcess a skos:Concept ;
    rdfs:label "acquisitive process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2036" ;
    rdfs:comment """That class of processes dealing with the physical investigation of a case where
potential digital evidence is identified and handled."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """That class of processes dealing with the physical investigation of a case where
potential digital evidence is identified and handled."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "acquisitive process"@en .

arkcyt:activity a skos:Concept ;
    rdfs:label "activity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2016" ;
    rdfs:comment "set of cohesive tasks of a process"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "set of cohesive tasks of a process"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "activity"@en .

arkcyt:analysis a skos:Concept ;
    rdfs:label "analysis"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2017" ;
    rdfs:comment "process of evaluating potential digital evidence in order to assess its relevance to the investigation"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "process of evaluating potential digital evidence in order to assess its relevance to the investigation"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "analysis"@en .

arkcyt:assessmentImplementationProcess a skos:Concept ;
    rdfs:label "Assessment of implementation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2047" ;
    rdfs:comment """In the assessment of implementation process, one performs an assessment of the results of the
implementation process group and compares these to the aims for achieving digital investigation
readiness. The output of this process is the results of the assessment of implementing digital investigation
readiness for an information system. It is recommended that, at this process, a legal review is carried out
for all procedures, controls, and architectures defined previously. The revision should show, amongst
other, whether there is conformity with the legal environment and digital forensics principles of the
particular jurisdiction, in order to assure admissibility of potential digital evidence in court."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In the assessment of implementation process, one performs an assessment of the results of the
implementation process group and compares these to the aims for achieving digital investigation
readiness. The output of this process is the results of the assessment of implementing digital investigation
readiness for an information system. It is recommended that, at this process, a legal review is carried out
for all procedures, controls, and architectures defined previously. The revision should show, amongst
other, whether there is conformity with the legal environment and digital forensics principles of the
particular jurisdiction, in order to assure admissibility of potential digital evidence in court."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Assessment of implementation process"@en .

arkcyt:collection a skos:Concept ;
    rdfs:label "collection"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2018" ;
    rdfs:comment "process of gathering the physical items that contain potential digital evidence"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "process of gathering the physical items that contain potential digital evidence"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "collection"@en .

arkcyt:concurrentProcess a skos:Concept ;
    rdfs:label "concurrent process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2038" ;
    rdfs:comment """That class of processes that continues concurrently alongside the other
processes. This class of processes differ from the previous classes in the sense that they happen
in tandem with the other processes instead of linear. In addition, the particular order in which
the concurrent processes execute is irrelevant as opposed to the other non-concurrent processes."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """That class of processes that continues concurrently alongside the other
processes. This class of processes differ from the previous classes in the sense that they happen
in tandem with the other processes instead of linear. In addition, the particular order in which
the concurrent processes execute is irrelevant as opposed to the other non-concurrent processes."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "concurrent process"@en .

arkcyt:definingSystemArchitectureProcess a skos:Concept ;
    rdfs:label "Defining system architecture process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2043" ;
    rdfs:comment """In this process, one should define information system architecture for the organization, while taking
into account the output results of all previous readiness processes. The information system architecture
in this context refer to the organizational structure of an information system, including necessary
application systems, computer equipment, a communications network, and related software.

© ISO/IEC 2015 – All rights reserved 11
Copyrighted material licensed to University College Dublin.
No further reproduction or distribution permitted.
Printed / viewed by: [anon.user@ucd.ie] @ 2024-04-04

ISO/IEC 27043:2015(E)
Input to this process is the result from all previous readiness processes. The input should also include
the aims for the readiness processes.
The output of this process is the defined system architecture for the organization. The aim is to customize
system architecture, with specific reference to electronic storage and transportation of data and/or
information within the architecture, to accommodate the accomplishment of the aims of the readiness
processes. The main aim of this process is to identify potential data and/or information sources within
the system architecture."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should define information system architecture for the organization, while taking
into account the output results of all previous readiness processes. The information system architecture
in this context refer to the organizational structure of an information system, including necessary
application systems, computer equipment, a communications network, and related software.

© ISO/IEC 2015 – All rights reserved 11
Copyrighted material licensed to University College Dublin.
No further reproduction or distribution permitted.
Printed / viewed by: [anon.user@ucd.ie] @ 2024-04-04

ISO/IEC 27043:2015(E)
Input to this process is the result from all previous readiness processes. The input should also include
the aims for the readiness processes.
The output of this process is the defined system architecture for the organization. The aim is to customize
system architecture, with specific reference to electronic storage and transportation of data and/or
information within the architecture, to accommodate the accomplishment of the aims of the readiness
processes. The main aim of this process is to identify potential data and/or information sources within
the system architecture."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Defining system architecture process"@en .

arkcyt:digitalEvidence a skos:Concept ;
    rdfs:label "digital evidence"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2019" ;
    rdfs:comment "information or data, stored or transmitted in binary form, that may be relied on as evidence"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "information or data, stored or transmitted in binary form, that may be relied on as evidence"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "digital evidence"@en .

arkcyt:digitalEvidenceInterpretationProcess a skos:Concept ;
    rdfs:label "Digital evidence interpretation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2060" ;
    rdfs:comment """The results from the potential digital evidence examination and analysis process should then be
interpreted. Interpretation of any evidence is dependent on the information available about the
circumstances surrounding the creation of that item of digital evidence. To be able to carry out a proper
interpretation, information from persons involved in the day-to-day running of the system(s) which are
being investigated, is often required. Furthermore, information about the purpose of the investigation
and a definition of the scope of the investigation is also required.
One goal of the digital evidence interpretation process is to use scientifically proven methods to construct
explanations for the presence of the digital artefacts identified as well as likelihood estimates for each
investigation during the potential digital evidence examination and analysis process, within the context of
the investigation. If the contextual information changes, the interpretation may also have to change in
order to reflect changes to the contextual information. A further goal of the digital evidence interpretation
process is to classify the interpreted evidence according to relevance. This means that the evidence, as
interpreted, is organized in such a way that it is distinguished which digital evidence artefacts are more
important than others. The decision process on deciding which pieces of digital evidence would be more
important than others is left to the discretion of one or more competent investigators.
See ISO/IEC 27042 for details on the digital evidence interpretation process."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The results from the potential digital evidence examination and analysis process should then be
interpreted. Interpretation of any evidence is dependent on the information available about the
circumstances surrounding the creation of that item of digital evidence. To be able to carry out a proper
interpretation, information from persons involved in the day-to-day running of the system(s) which are
being investigated, is often required. Furthermore, information about the purpose of the investigation
and a definition of the scope of the investigation is also required.
One goal of the digital evidence interpretation process is to use scientifically proven methods to construct
explanations for the presence of the digital artefacts identified as well as likelihood estimates for each
investigation during the potential digital evidence examination and analysis process, within the context of
the investigation. If the contextual information changes, the interpretation may also have to change in
order to reflect changes to the contextual information. A further goal of the digital evidence interpretation
process is to classify the interpreted evidence according to relevance. This means that the evidence, as
interpreted, is organized in such a way that it is distinguished which digital evidence artefacts are more
important than others. The decision process on deciding which pieces of digital evidence would be more
important than others is left to the discretion of one or more competent investigators.
See ISO/IEC 27042 for details on the digital evidence interpretation process."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Digital evidence interpretation process"@en .

arkcyt:digitalInvestigation a skos:Concept ;
    rdfs:label "digital investigation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2020" ;
    rdfs:comment """use of scientifically derived and proven methods towards the identification, collection, transportation,
storage, analysis, interpretation, presentation, distribution, return, and/or destruction of digital
evidence derived from digital sources, while obtaining proper authorizations for all activities, properly
documenting all activities, interacting with the physical investigation, preserving digital evidence, and
maintaining the chain of custody, for the purpose of facilitating or furthering the reconstruction of
events found to be incidents requiring a digital investigation, whether of criminal nature or not"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """use of scientifically derived and proven methods towards the identification, collection, transportation,
storage, analysis, interpretation, presentation, distribution, return, and/or destruction of digital
evidence derived from digital sources, while obtaining proper authorizations for all activities, properly
documenting all activities, interacting with the physical investigation, preserving digital evidence, and
maintaining the chain of custody, for the purpose of facilitating or furthering the reconstruction of
events found to be incidents requiring a digital investigation, whether of criminal nature or not"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "digital investigation"@en .

arkcyt:digitalInvestigationProcesses a skos:Concept ;
    rdfs:label "Digital investigation processes"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2033" ;
    rdfs:comment """The digital investigation processes described in this International Standard are purposely designed
at an abstract level so that they can be used for different digital investigations and different types of
digital evidence. The use of this methodology is intended to aid the design and development of high-level
processes with the intent to subsequently decompose them into atomic processes (see ISO/IEC 27041).
Also, the processes aim to be comprehensive in that they represent a harmonization of all published
digital processes by the time of writing this International Standard. The investigation processes are
organized in a succinct fashion and describe how to follow these processes."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The digital investigation processes described in this International Standard are purposely designed
at an abstract level so that they can be used for different digital investigations and different types of
digital evidence. The use of this methodology is intended to aid the design and development of high-level
processes with the intent to subsequently decompose them into atomic processes (see ISO/IEC 27041).
Also, the processes aim to be comprehensive in that they represent a harmonization of all published
digital processes by the time of writing this International Standard. The investigation processes are
organized in a succinct fashion and describe how to follow these processes."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Digital investigation processes"@en .

arkcyt:documentationProcess a skos:Concept ;
    rdfs:label "Documentation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2065" ;
    rdfs:comment """Each process performed should be documented in order to assure repeatability and reproducibility,
preserve chain of custody, but also to improve efficiency and a higher probability of a successful digital
investigation. Proper documentation should also be demonstrated during the presentation process.
This process should include incident scene documentation which is performed at the scene of the
incident, if applicable, and involves the proper documentation of the complete incident scene, including
written documentation of activities, sketches, photographs, videos, and labelling the potential digital
evidence. All activities performed in relation to the digital investigation processes should be recorded,
together with details on the architecture and components of the information system where the incident
occurred, if applicable."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Each process performed should be documented in order to assure repeatability and reproducibility,
preserve chain of custody, but also to improve efficiency and a higher probability of a successful digital
investigation. Proper documentation should also be demonstrated during the presentation process.
This process should include incident scene documentation which is performed at the scene of the
incident, if applicable, and involves the proper documentation of the complete incident scene, including
written documentation of activities, sketches, photographs, videos, and labelling the potential digital
evidence. All activities performed in relation to the digital investigation processes should be recorded,
together with details on the architecture and components of the information system where the incident
occurred, if applicable."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Documentation process"@en .

arkcyt:firstResponseProcess a skos:Concept ;
    rdfs:label "First response process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2050" ;
    rdfs:comment """The first response process should include the first response to the detected incident. Also see ISO/IEC 27037
for more information on incident response. Depending on the type and severity of the incident, this might
include disconnecting equipment from a networked environment, detecting corrupted data, etc. It is
required that the first response does not have a negative influence on the possibility to perform a digital
investigation, e.g. to avoid powering off the equipment, opening or changing files on a live system etc.
Defining the first response sub-processes is out of the scope of this International Standard, as these can
vary greatly depend on the type of target information systems, data contained in the target information
system, circumstances of the incident, classification and description of the incident, etc.
The first response process is included as a process because it falls within the scope of any digital
investigation since such a process will assure the integrity of potential digital evidence."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The first response process should include the first response to the detected incident. Also see ISO/IEC 27037
for more information on incident response. Depending on the type and severity of the incident, this might
include disconnecting equipment from a networked environment, detecting corrupted data, etc. It is
required that the first response does not have a negative influence on the possibility to perform a digital
investigation, e.g. to avoid powering off the equipment, opening or changing files on a live system etc.
Defining the first response sub-processes is out of the scope of this International Standard, as these can
vary greatly depend on the type of target information systems, data contained in the target information
system, circumstances of the incident, classification and description of the incident, etc.
The first response process is included as a process because it falls within the scope of any digital
investigation since such a process will assure the integrity of potential digital evidence."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "First response process"@en .

arkcyt:identification a skos:Concept ;
    rdfs:label "identification"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2021" ;
    rdfs:comment "process involving the search for, recognition, and documentation of potential digital evidence"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "process involving the search for, recognition, and documentation of potential digital evidence"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "identification"@en .

arkcyt:identificationOfPotentialDigitalEvidenceSourcesProcess a skos:Concept ;
    rdfs:label "Identification of potential digital evidence sources process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2040" ;
    rdfs:comment """In this process, one should identify potential sources of digital evidence within an organization. The
output of this process is the defined potential sources of digital evidence.
Some of the identified potential sources might not be available. For example, if access logs are not
introduced within the system, it means that access logs will not be available as a source of data in the case
of a digital investigation. In that case, controls should be explored to make the identified source available."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should identify potential sources of digital evidence within an organization. The
output of this process is the defined potential sources of digital evidence.
Some of the identified potential sources might not be available. For example, if access logs are not
introduced within the system, it means that access logs will not be available as a source of data in the case
of a digital investigation. In that case, controls should be explored to make the identified source available."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Identification of potential digital evidence sources process"@en .

arkcyt:implementationAssessmentResultsProcess a skos:Concept ;
    rdfs:label "Implementation of assessment results process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2048" ;
    rdfs:comment """This process is concerned with the implementation of the conclusions from previous process. This
process is optional, as it is possible that no changes are needed, based on the assessment of implementation
process. Note that in Figure 4, this process is marked as optional and indicated as such with a dashed
line around the process.
During this process, one should decide on recommendations for changes in one or more of the
previous processes. The main decision here is whether to go back to one of the planning processes in
the planning processes group of the readiness class of processes or to go back to one of the processes in
the implementation process group, depending on the conclusions of the assessment of implementation
process. For example, one might conclude that the implementation of a certain measure (e.g. that during
implementing system architecture, one has not properly implemented log-in authorization controls
planned during the defining system architecture process) was not performed in an optimal manner or
one might decide that new implementation as to be performed."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """This process is concerned with the implementation of the conclusions from previous process. This
process is optional, as it is possible that no changes are needed, based on the assessment of implementation
process. Note that in Figure 4, this process is marked as optional and indicated as such with a dashed
line around the process.
During this process, one should decide on recommendations for changes in one or more of the
previous processes. The main decision here is whether to go back to one of the planning processes in
the planning processes group of the readiness class of processes or to go back to one of the processes in
the implementation process group, depending on the conclusions of the assessment of implementation
process. For example, one might conclude that the implementation of a certain measure (e.g. that during
implementing system architecture, one has not properly implemented log-in authorization controls
planned during the defining system architecture process) was not performed in an optimal manner or
one might decide that new implementation as to be performed."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Implementation of assessment results process"@en .

arkcyt:implementingPreincidentAnalysis a skos:Concept ;
    rdfs:label """Implementing pre-incident analysis of data representing potential digital
evidence process"""@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2045" ;
    rdfs:comment """In this process, one should implement pre-incident analysis of data representing potential digital
evidence, as defined in the planning pre-incident analysis of data representing potential digital evidence
process. The output of this process is the implemented pre-incident analysis of data representing
potential digital evidence.
Examples of pre-incident analysis of data representing potential digital evidence include the implementation of
change-tracking software such as a file integrity checker, intrusion detection/prevention software and/or
anti-virus software."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should implement pre-incident analysis of data representing potential digital
evidence, as defined in the planning pre-incident analysis of data representing potential digital evidence
process. The output of this process is the implemented pre-incident analysis of data representing
potential digital evidence.
Examples of pre-incident analysis of data representing potential digital evidence include the implementation of
change-tracking software such as a file integrity checker, intrusion detection/prevention software and/or
anti-virus software."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel """Implementing pre-incident analysis of data representing potential digital
evidence process"""@en .

arkcyt:implementingPreincidentGatheringStorageAndHandling a skos:Concept ;
    rdfs:label """Implementing pre-incident gathering, storage, and handling of data representing
potential digital evidence process"""@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2046" ;
    rdfs:comment """In this process, one should implement pre-incident gathering, storage, and handling of data representing
potential digital evidence, as defined in the planning pre-incident gathering, storage, and handling of
data representing potential digital evidence process. The output of this process is the implemented pre-
incident gathering, storage, and handling of data representing potential digital evidence.
Examples of pre-incident gathering, storage and handling of data representing potential digital evidence
include the implementation of logging software and hardware, with time stamping and digital signature
mechanisms in place, or the implementation of customized software to gather the data of importance
(i.e. system usage data)."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should implement pre-incident gathering, storage, and handling of data representing
potential digital evidence, as defined in the planning pre-incident gathering, storage, and handling of
data representing potential digital evidence process. The output of this process is the implemented pre-
incident gathering, storage, and handling of data representing potential digital evidence.
Examples of pre-incident gathering, storage and handling of data representing potential digital evidence
include the implementation of logging software and hardware, with time stamping and digital signature
mechanisms in place, or the implementation of customized software to gather the data of importance
(i.e. system usage data)."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel """Implementing pre-incident gathering, storage, and handling of data representing
potential digital evidence process"""@en .

arkcyt:implementingSystemArchitectureProcess a skos:Concept ;
    rdfs:label "Implementing system architecture process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2044" ;
    rdfs:comment """In this process, one should implement the system architecture as defined in the defining system
architecture process. The output of this process is the implemented system architecture.
Examples of implementing system architecture include the installation of new software, hardware,
and/or policies which will permit the remainder of the readiness processes to be instantiated across the
information system and the organization."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should implement the system architecture as defined in the defining system
architecture process. The output of this process is the implemented system architecture.
Examples of implementing system architecture include the installation of new software, hardware,
and/or policies which will permit the remainder of the readiness processes to be instantiated across the
information system and the organization."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Implementing system architecture process"@en .

arkcyt:incident a skos:Concept ;
    rdfs:label "incident"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2022" ;
    rdfs:comment """single or a series of unwanted or unexpected information security breaches or events, whether of
criminal nature or not, that have a significant probability of compromising business operations or
threatening information security"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """single or a series of unwanted or unexpected information security breaches or events, whether of
criminal nature or not, that have a significant probability of compromising business operations or
threatening information security"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "incident"@en .

arkcyt:incidentDetectionProcess a skos:Concept ;
    rdfs:label "Incident detection process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2049" ;
    rdfs:comment """Incident detection procedures should be in place prior to the beginning of this process. The procedures
can define the relation between the information system where the incident might occur and the external
incident detection system, which would have the task to detect an incident or can define how humans
operating or administering information systems, detect an incident. Examples of external incident
detection systems are intrusion detection systems, intrusion prevention systems, log-analysing systems,
change-tracking systems, etc.
The incident detection process includes not only the detection of the incident, but also the classification
and description of the incident, which has a significant influence on the rest of the process. For example,
the digital investigation would take a completely different course if the incident was described as
“unauthorized access to the root account of the operating system”, than if it was described as ‘using the
computer to distribute abusive images’.
Based on the above, this process may consist of three sub-processes: incident detection, incident
classification, and incident description.
It is important to note that the incident classification and incident description sub-processes should be
performed based on information gathered prior to incident detection and should not include any activity"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Incident detection procedures should be in place prior to the beginning of this process. The procedures
can define the relation between the information system where the incident might occur and the external
incident detection system, which would have the task to detect an incident or can define how humans
operating or administering information systems, detect an incident. Examples of external incident
detection systems are intrusion detection systems, intrusion prevention systems, log-analysing systems,
change-tracking systems, etc.
The incident detection process includes not only the detection of the incident, but also the classification
and description of the incident, which has a significant influence on the rest of the process. For example,
the digital investigation would take a completely different course if the incident was described as
“unauthorized access to the root account of the operating system”, than if it was described as ‘using the
computer to distribute abusive images’.
Based on the above, this process may consist of three sub-processes: incident detection, incident
classification, and incident description.
It is important to note that the incident classification and incident description sub-processes should be
performed based on information gathered prior to incident detection and should not include any activity"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Incident detection process"@en .

arkcyt:initializationProcess a skos:Concept ;
    rdfs:label "initialization process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2035" ;
    rdfs:comment """That class of processes dealing with the initial commencement of the digital
investigation."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """That class of processes dealing with the initial commencement of the digital
investigation."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "initialization process"@en .

arkcyt:interactionWithPhysicalInvestigationProcess a skos:Concept ;
    rdfs:label "Interaction with physical investigation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2069" ;
    rdfs:comment """The digital investigation process can be dependent on and interconnected with the physical investigation,
if such an investigation is conducted in relation to the same incident. Therefore, this activity should
define the relationship between the digital investigation process and the physical investigation. The
interaction is important for preserving the chain of custody, preserving the integrity of the digital
evidence, protecting the digital evidence from damage, and ensuring an efficient investigation according
to the investigator’s needs and fast adaption to changing boundaries, scope, or investigation objectives."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The digital investigation process can be dependent on and interconnected with the physical investigation,
if such an investigation is conducted in relation to the same incident. Therefore, this activity should
define the relationship between the digital investigation process and the physical investigation. The
interaction is important for preserving the chain of custody, preserving the integrity of the digital
evidence, protecting the digital evidence from damage, and ensuring an efficient investigation according
to the investigator’s needs and fast adaption to changing boundaries, scope, or investigation objectives."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Interaction with physical investigation process"@en .

arkcyt:interpretation a skos:Concept ;
    rdfs:label "interpretation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2023" ;
    rdfs:comment """synthesis of an explanation, within agreed limits, for the factual information about evidence resulting
from the set of examinations and analysis making up the investigation"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """synthesis of an explanation, within agreed limits, for the factual information about evidence resulting
from the set of examinations and analysis making up the investigation"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "interpretation"@en .

arkcyt:investigation a skos:Concept ;
    rdfs:label "investigation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2024" ;
    rdfs:comment "application of examinations, analysis, and interpretation to aid understanding of an incident"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "application of examinations, analysis, and interpretation to aid understanding of an incident"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "investigation"@en .

arkcyt:investigationClosureProcess a skos:Concept ;
    rdfs:label "Investigation closure process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2063" ;
    rdfs:comment """This process concludes the investigation and a decision is to be recorded on the validity of the hypothesis set
in the presentation process. The digital investigation process is iterative. This implies that after completing
this process"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """This process concludes the investigation and a decision is to be recorded on the validity of the hypothesis set
in the presentation process. The digital investigation process is iterative. This implies that after completing
this process"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Investigation closure process"@en .

arkcyt:investigativeProcess a skos:Concept ;
    rdfs:label "investigative process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2037" ;
    rdfs:comment """That class of processes dealing with uncovering the potential digital
evidence."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """That class of processes dealing with uncovering the potential digital
evidence."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "investigative process"@en .

arkcyt:managingInformationFlowProcess a skos:Concept ;
    rdfs:label "Managing information flow process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2066" ;
    rdfs:comment """A defined information flow should exist between each of the processes and among different stakeholders.
This information flow has to be defined for each type of investigation. It is important to identify and
describe information flows so that they can be secured and supported technologically. For instance, an
information flow could refer to the exchange of digital evidence between two investigators involved
in the same investigation. Protection of this information flow can be in the form of, for example, the
use of trusted PKI and time stamping to identify the different investigators and authenticate evidence
(protecting its integrity), as well as to protect the confidentiality of the evidence."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """A defined information flow should exist between each of the processes and among different stakeholders.
This information flow has to be defined for each type of investigation. It is important to identify and
describe information flows so that they can be secured and supported technologically. For instance, an
information flow could refer to the exchange of digital evidence between two investigators involved
in the same investigation. Protection of this information flow can be in the form of, for example, the
use of trusted PKI and time stamping to identify the different investigators and authenticate evidence
(protecting its integrity), as well as to protect the confidentiality of the evidence."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Managing information flow process"@en .

arkcyt:method a skos:Concept ;
    rdfs:label "method"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2025" ;
    rdfs:comment """definition of an operation which can be used to produce data or derive information as an output from
specified inputs"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """definition of an operation which can be used to produce data or derive information as an output from
specified inputs"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "method"@en .

arkcyt:obtainingAuthorizationProcess a skos:Concept ;
    rdfs:label "Obtaining authorization process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2064" ;
    rdfs:comment """Proper authorization should be obtained for each process performed within all of the digital investigation
processes. Authorization might be required from government authorities, system owners, system
custodians, principals, users etc. It is important to obtain proper authorization for actions performed
during the digital investigation process in order not to infringe on the rights of system owners,
custodians, principals, or users, but also to assure that no legal rule is infringed. Needed authorizations
would depend on the environment where the digital investigation is performed, both within the legal
and the organizational environment."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Proper authorization should be obtained for each process performed within all of the digital investigation
processes. Authorization might be required from government authorities, system owners, system
custodians, principals, users etc. It is important to obtain proper authorization for actions performed
during the digital investigation process in order not to infringe on the rights of system owners,
custodians, principals, or users, but also to assure that no legal rule is infringed. Needed authorizations
would depend on the environment where the digital investigation is performed, both within the legal
and the organizational environment."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Obtaining authorization process"@en .

arkcyt:planningIncidentDetectionProcess a skos:Concept ;
    rdfs:label "Planning incident detection process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2042" ;
    rdfs:comment """In this process, one should define actions to be performed when an incident is detected. The output
of this process includes defined actions to be performed once an incident is detected, in particular
information to be passed on to the rest of digital investigation process. Information should also include
pre-known system inputs, results from all of the readiness class processes, as well as data gathered and
generated during the implementation process group processes."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should define actions to be performed when an incident is detected. The output
of this process includes defined actions to be performed once an incident is detected, in particular
information to be passed on to the rest of digital investigation process. Information should also include
pre-known system inputs, results from all of the readiness class processes, as well as data gathered and
generated during the implementation process group processes."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Planning incident detection process"@en .

arkcyt:planningPreincidentGatheringStorageAndHandlingOfDataRepresentingPotentialDigitalEvidenceProcess a skos:Concept ;
    rdfs:label """Planning pre-incident gathering, storage, and handling of data representing
potential digital evidence process"""@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2041" ;
    rdfs:comment """In this process, one should define activities for pre-incident gathering, storage and handling of data
representing potential digital evidence. The output of this process includes the defined activities for
pre-incident gathering, storage, and handling of data representing potential digital evidence.
The gathering period of certain types of data, is to be determined based on a risk assessment. The
gathering, storage, and handling of data also have to conform to digital investigation principles in
order for digital evidence to be admissible in a court of law. """@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should define activities for pre-incident gathering, storage and handling of data
representing potential digital evidence. The output of this process includes the defined activities for
pre-incident gathering, storage, and handling of data representing potential digital evidence.
The gathering period of certain types of data, is to be determined based on a risk assessment. The
gathering, storage, and handling of data also have to conform to digital investigation principles in
order for digital evidence to be admissible in a court of law. """@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel """Planning pre-incident gathering, storage, and handling of data representing
potential digital evidence process"""@en .

arkcyt:planningProcess a skos:Concept ;
    rdfs:label "Planning process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2051" ;
    rdfs:comment """During this process, the investigator has to perform all the potential planning needed for later in the
digital investigation process. Planning should include the use of defined ISO/IEC 27041 based validated
processes to develop relevant procedures and methodologies to be used, planning for use of appropriate
human resources. and the planning of all activities during other processes.
If digital investigation readiness controls were implemented, the investigator should plan how to use the
results of those controls so as to maximize the success of the digital investigation process. The aims of the
digital investigation readiness process are to maximize the potential use of potential digital evidence,
minimize the costs of the investigation, minimize interference with and prevent the interruption of
business processes, and to preserve or improve the current level of information systems security.
The planning process is included because it is of extreme importance due to the fact that it determines
the efficiency and success of all the other processes."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """During this process, the investigator has to perform all the potential planning needed for later in the
digital investigation process. Planning should include the use of defined ISO/IEC 27041 based validated
processes to develop relevant procedures and methodologies to be used, planning for use of appropriate
human resources. and the planning of all activities during other processes.
If digital investigation readiness controls were implemented, the investigator should plan how to use the
results of those controls so as to maximize the success of the digital investigation process. The aims of the
digital investigation readiness process are to maximize the potential use of potential digital evidence,
minimize the costs of the investigation, minimize interference with and prevent the interruption of
business processes, and to preserve or improve the current level of information systems security.
The planning process is included because it is of extreme importance due to the fact that it determines
the efficiency and success of all the other processes."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Planning process"@en .

arkcyt:potentialDigitalEvidence a skos:Concept ;
    rdfs:label "potential digital evidence"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2026" ;
    rdfs:comment """information or data, stored or transmitted in binary form, which has not yet been determined, through
the process of examination and analysis, to be relevant to the investigation"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """information or data, stored or transmitted in binary form, which has not yet been determined, through
the process of examination and analysis, to be relevant to the investigation"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "potential digital evidence"@en .

arkcyt:potentialDigitalEvidenceAcquisitionProcess a skos:Concept ;
    rdfs:label "Potential digital evidence acquisition process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2055",
        "ISO IEC 27043:2058" ;
    rdfs:comment """Once potential digital evidence has been collected, it has to be acquired in order to permit its analysis
in a later process.
Proper data acquisition of protected devices with additional security controls such as data encryption
should be considered. Guidance on this, and sound processes for handling potential digital evidence,
is found in ISO/IEC 27037. Adhering to strict legal regulations during the potential digital evidence
acquisition process is of crucial importance, as potential digital evidence might become unusable when
proper procedures are not followed.
It is common practice to make verifiable images (see ISO/IEC 27037) using hash functions (see ISO/IEC 10118-
2) of all the bits contained within each media item that contains potential digital evidence.
Professionals and scientists in the digital investigation field have a task to develop proper procedures
for the acquisition of potential digital evidence that is applicable to networked environments, the live
investigation process, cloud environments, and environments with large amounts of data.
Take note that this process is optional at this stage, since it is not always possible to acquire one or
more images of the evidence after it has been collected. It often happens that the image acquisition
only takes place within an investigation laboratory and, hence, this process might only occur within the
investigative processes class. Although this process is marked as optional at this stage as well as within
the investigative processes class, it is imperative that exactly one instance of the process is carried out,
i.e. either here or within the investigative processes class. This process, as described in this clause, is
exactly the same as the first process within the investigative processes class and is not described again
within the investigative processes class."""@en,
        "See 9.4 for a description of this process."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Once potential digital evidence has been collected, it has to be acquired in order to permit its analysis
in a later process.
Proper data acquisition of protected devices with additional security controls such as data encryption
should be considered. Guidance on this, and sound processes for handling potential digital evidence,
is found in ISO/IEC 27037. Adhering to strict legal regulations during the potential digital evidence
acquisition process is of crucial importance, as potential digital evidence might become unusable when
proper procedures are not followed.
It is common practice to make verifiable images (see ISO/IEC 27037) using hash functions (see ISO/IEC 10118-
2) of all the bits contained within each media item that contains potential digital evidence.
Professionals and scientists in the digital investigation field have a task to develop proper procedures
for the acquisition of potential digital evidence that is applicable to networked environments, the live
investigation process, cloud environments, and environments with large amounts of data.
Take note that this process is optional at this stage, since it is not always possible to acquire one or
more images of the evidence after it has been collected. It often happens that the image acquisition
only takes place within an investigation laboratory and, hence, this process might only occur within the
investigative processes class. Although this process is marked as optional at this stage as well as within
the investigative processes class, it is imperative that exactly one instance of the process is carried out,
i.e. either here or within the investigative processes class. This process, as described in this clause, is
exactly the same as the first process within the investigative processes class and is not described again
within the investigative processes class."""@en,
        "See 9.4 for a description of this process."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Potential digital evidence acquisition process"@en .

arkcyt:potentialDigitalEvidenceCollectionProcess a skos:Concept ;
    rdfs:label "Potential digital evidence collection process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2054" ;
    rdfs:comment """Once potential digital evidence has been identified, it has to be collected in order to permit its analysis
in a later process.
Potential digital evidence must be collected in such a manner that its integrity is preserved. This is
important if one needs to use this evidence at a later stage to draw some formal conclusions, i.e. in a
court of law. Adhering to strict legal regulations during the evidence collection process is of crucial
importance, as digital evidence might become unusable when proper procedures are not followed."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Once potential digital evidence has been identified, it has to be collected in order to permit its analysis
in a later process.
Potential digital evidence must be collected in such a manner that its integrity is preserved. This is
important if one needs to use this evidence at a later stage to draw some formal conclusions, i.e. in a
court of law. Adhering to strict legal regulations during the evidence collection process is of crucial
importance, as digital evidence might become unusable when proper procedures are not followed."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Potential digital evidence collection process"@en .

arkcyt:potentialDigitalEvidenceExaminationAndAnalysisProcess a skos:Concept ;
    rdfs:label "Potential digital evidence examination and analysis process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2059" ;
    rdfs:comment """Examination and analysis of the digital evidence involves the use of a large number of techniques to
identify digital evidence as well as reconstructing it, if needed. In order to make a hypothesis on how the
incident occurred, one should define what its exact characteristics are and who is to be held responsible.
Making a hypothesis basically involves the reconstruction of a sequence of events that have led to the
current state of the system being investigated. Due to the volume, diversity and complexity of the data
to be analysed in present-day digital investigations, the analysis of evidence becomes a challenge.
As volumes of data to be examined and analysed can be vast, accredited automated techniques are often
employed to complement manual validation techniques.
See ISO/IEC 27042 for details on the digital evidence analysis process.
It should be noted that from this point onwards, “potential digital evidence” becomes “digital evidence”
according to the definitions of ‘potential digital evidence’ and ‘digital evidence’."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Examination and analysis of the digital evidence involves the use of a large number of techniques to
identify digital evidence as well as reconstructing it, if needed. In order to make a hypothesis on how the
incident occurred, one should define what its exact characteristics are and who is to be held responsible.
Making a hypothesis basically involves the reconstruction of a sequence of events that have led to the
current state of the system being investigated. Due to the volume, diversity and complexity of the data
to be analysed in present-day digital investigations, the analysis of evidence becomes a challenge.
As volumes of data to be examined and analysed can be vast, accredited automated techniques are often
employed to complement manual validation techniques.
See ISO/IEC 27042 for details on the digital evidence analysis process.
It should be noted that from this point onwards, “potential digital evidence” becomes “digital evidence”
according to the definitions of ‘potential digital evidence’ and ‘digital evidence’."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Potential digital evidence examination and analysis process"@en .

arkcyt:potentialDigitalEvidenceIdentificationProcess a skos:Concept ;
    rdfs:label "Potential digital evidence identification process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2053" ;
    rdfs:comment """This is the second process performed at the scene of the incident. Although it overlaps in time with the
previous process, it should be considered as a separate process because it includes different types of
procedures within the process, with the specific aim of identifying potential digital evidence.
Identifying potential digital evidence at the incident scene is of crucial importance for the remainder of
the process, because if potential digital evidence is not identified at this point, it might not even exist at a later point during the process. This is especially important when an incident happens in a networked environment, in an environment where live investigations should be performed, in a cloud environment
or in an environment with exceptionally large amounts of data to deal with.
This process is included with the sole aim to identify potential digital evidence."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """This is the second process performed at the scene of the incident. Although it overlaps in time with the
previous process, it should be considered as a separate process because it includes different types of
procedures within the process, with the specific aim of identifying potential digital evidence.
Identifying potential digital evidence at the incident scene is of crucial importance for the remainder of
the process, because if potential digital evidence is not identified at this point, it might not even exist at a later point during the process. This is especially important when an incident happens in a networked environment, in an environment where live investigations should be performed, in a cloud environment
or in an environment with exceptionally large amounts of data to deal with.
This process is included with the sole aim to identify potential digital evidence."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Potential digital evidence identification process"@en .

arkcyt:potentialDigitalEvidenceStorageAndPreservationProcess a skos:Concept ;
    rdfs:label "Potential digital evidence storage and preservation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2057" ;
    rdfs:comment """The storage of potential digital evidence might be needed if analysis cannot be performed right away or
if there is a legal requirement to keep potential digital evidence for a certain period of time.
Preservation of the integrity of the evidence and chain of custody is of utmost importance during this
process. Care should also be taken not to damage the media containing potential digital evidence due to
shock, temperature, humidity, pollution, loss of power, malfunction, etc."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The storage of potential digital evidence might be needed if analysis cannot be performed right away or
if there is a legal requirement to keep potential digital evidence for a certain period of time.
Preservation of the integrity of the evidence and chain of custody is of utmost importance during this
process. Care should also be taken not to damage the media containing potential digital evidence due to
shock, temperature, humidity, pollution, loss of power, malfunction, etc."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Potential digital evidence storage and preservation process"@en .

arkcyt:potentialDigitalEvidenceTransportationProcess a skos:Concept ;
    rdfs:label "Potential digital evidence transportation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2056" ;
    rdfs:comment """During this process, potential digital evidence is to be transported to a location where it is to be stored
and later analysed. Transportation can be done physically or electronically. If the evidence is transported
electronically, special precautions have to be taken to preserve the integrity and chain of custody, such
as encrypting and digitally signing data."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """During this process, potential digital evidence is to be transported to a location where it is to be stored
and later analysed. Transportation can be done physically or electronically. If the evidence is transported
electronically, special precautions have to be taken to preserve the integrity and chain of custody, such
as encrypting and digitally signing data."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Potential digital evidence transportation process"@en .

arkcyt:preparationProcess a skos:Concept ;
    rdfs:label "Preparation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2052" ;
    rdfs:comment """Preparation process activities are intended to prepare an organization for performing activities within
this process that might include but is not limited to the preparation of relevant equipment (hardware
and software), infrastructure, human resources, raising awareness, training, and documentation. During
this process, preparations also have to be made to implement procedures defined in the previous process.
This process is included since such a process will ensure that the investigator is better prepared in order
to carry out the acquisitive processes in a more efficient manner. This will also ensure that the integrity
of potential digital evidence is not compromised due to possible ill-preparedness by the investigator.
"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Preparation process activities are intended to prepare an organization for performing activities within
this process that might include but is not limited to the preparation of relevant equipment (hardware
and software), infrastructure, human resources, raising awareness, training, and documentation. During
this process, preparations also have to be made to implement procedures defined in the previous process.
This process is included since such a process will ensure that the investigator is better prepared in order
to carry out the acquisitive processes in a more efficient manner. This will also ensure that the integrity
of potential digital evidence is not compromised due to possible ill-preparedness by the investigator.
"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Preparation process"@en .

arkcyt:presentationProcess a skos:Concept ;
    rdfs:label "Presentation process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2062" ;
    rdfs:comment """The document created during the reporting process is to be presented to a wide audience as stated
in this Clause. The main purpose of the presentation process is to conduct a live demonstration of the
results based on the report. This demonstration can be performed using questions and answers, as
an oral presentation, as a multimedia presentation, as an expert witness testimony or as whatever is
suitable to the case.
The presentation process also includes proving the validity of the hypothesis if or when the hypothesis
is challenged. Thus, the one who presents the hypothesis should be well prepared for it and should
preferably have had insight into the reporting process."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The document created during the reporting process is to be presented to a wide audience as stated
in this Clause. The main purpose of the presentation process is to conduct a live demonstration of the
results based on the report. This demonstration can be performed using questions and answers, as
an oral presentation, as a multimedia presentation, as an expert witness testimony or as whatever is
suitable to the case.
The presentation process also includes proving the validity of the hypothesis if or when the hypothesis
is challenged. Thus, the one who presents the hypothesis should be well prepared for it and should
preferably have had insight into the reporting process."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Presentation process"@en .

arkcyt:preservation a skos:Concept ;
    rdfs:label "preservation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2027" ;
    rdfs:comment """process to maintain and safeguard the integrity and/or original condition of the potential digital
evidence and digital evidence"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """process to maintain and safeguard the integrity and/or original condition of the potential digital
evidence and digital evidence"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "preservation"@en .

arkcyt:preservingChainOfCustodyProcess a skos:Concept ;
    rdfs:label "Preserving chain of custody process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2067" ;
    rdfs:comment """All legal requirements should be complied with and all processes should be properly documented in
order to preserve chain of custody as the evidence is handled by several parties. This process is to be
performed from the incident detection process until the last process."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """All legal requirements should be complied with and all processes should be properly documented in
order to preserve chain of custody as the evidence is handled by several parties. This process is to be
performed from the incident detection process until the last process."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Preserving chain of custody process"@en .

arkcyt:preservingDigitalEvidenceProcess a skos:Concept ;
    rdfs:label "Preserving digital evidence process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2068" ;
    rdfs:comment """Preserving digital evidence means to preserve the integrity of the original digital evidence. In order to
achieve this, one should conform to strict procedures from the time that the incident is detected until
such time as the investigation is closed. These procedures should ensure that the original evidence is not
changed and, even more important, they should guarantee that no opportunity arises during which the
original evidence may be changed, lost, stolen, destroyed, etc."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """Preserving digital evidence means to preserve the integrity of the original digital evidence. In order to
achieve this, one should conform to strict procedures from the time that the incident is detected until
such time as the investigation is closed. These procedures should ensure that the original evidence is not
changed and, even more important, they should guarantee that no opportunity arises during which the
original evidence may be changed, lost, stolen, destroyed, etc."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Preserving digital evidence process"@en .

arkcyt:readiness a skos:Concept ;
    rdfs:label "readiness"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2029" ;
    rdfs:comment "process of being prepared for a digital investigation before an incident has occurred"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "process of being prepared for a digital investigation before an incident has occurred"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "readiness"@en .

arkcyt:readinessProcess a skos:Concept ;
    rdfs:label "readiness process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2034" ;
    rdfs:comment """That class of processes dealing with pre-incident investigation processes. This
class deals with defining strategies which can be employed to ensure systems are in place, and that
the staff involved in the investigative process are proficiently trained prior to dealing with an incident
occurring. The readiness processes are optional to the rest of the digital investigation processes. """@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """That class of processes dealing with pre-incident investigation processes. This
class deals with defining strategies which can be employed to ensure systems are in place, and that
the staff involved in the investigative process are proficiently trained prior to dealing with an incident
occurring. The readiness processes are optional to the rest of the digital investigation processes. """@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "readiness process"@en .

arkcyt:reportingProcess a skos:Concept ;
    rdfs:label "Reporting process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2061" ;
    rdfs:comment """The interpretation that results from the digital evidence interpretation process forms the main output,
i.e. the report. The report should, where economical, be printed on paper. It is possible that during a
certain digital investigation, the number of digital evidence artefacts could be many. Therefore, due
diligence should be exercised to list all relevant digital evidence in the report in order to assure that no
valuable evidence is omitted from the report.
The report should be written in simple language and should be clear, concise and unambiguous in its
statements. It should also be understandable for a wide audience whom do not necessarily possess a
technical understanding of incident investigations. Such audiences include, but not limited to, judges, juries,
the accused, lawyers, prosecutors, an organization’s management team, shareholders, and employees.
The author(s) of a report should always be aware of the potential impact of the report in a law suit on all
the applicable audiences as mentioned above. Authors of such reports should also keep in mind possible
consequences of potentially wrong or misinterpreted reports. Therefore, the report should elaborate
on issues such as which potential evidence was collected/acquired, which analysis techniques were performed, which statements and from whom have been taken into account and what outcome results
from this. Sometimes no clear outcome is possible based on the available evidence. In such a case, the
report should state clearly the assumptions made, the probabilities corresponding to the assumptions
and the conclusions arising from the assumptions. It is essential to emphasize the hypothetical character
of such conclusions.
"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """The interpretation that results from the digital evidence interpretation process forms the main output,
i.e. the report. The report should, where economical, be printed on paper. It is possible that during a
certain digital investigation, the number of digital evidence artefacts could be many. Therefore, due
diligence should be exercised to list all relevant digital evidence in the report in order to assure that no
valuable evidence is omitted from the report.
The report should be written in simple language and should be clear, concise and unambiguous in its
statements. It should also be understandable for a wide audience whom do not necessarily possess a
technical understanding of incident investigations. Such audiences include, but not limited to, judges, juries,
the accused, lawyers, prosecutors, an organization’s management team, shareholders, and employees.
The author(s) of a report should always be aware of the potential impact of the report in a law suit on all
the applicable audiences as mentioned above. Authors of such reports should also keep in mind possible
consequences of potentially wrong or misinterpreted reports. Therefore, the report should elaborate
on issues such as which potential evidence was collected/acquired, which analysis techniques were performed, which statements and from whom have been taken into account and what outcome results
from this. Sometimes no clear outcome is possible based on the available evidence. In such a case, the
report should state clearly the assumptions made, the probabilities corresponding to the assumptions
and the conclusions arising from the assumptions. It is essential to emphasize the hypothetical character
of such conclusions.
"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Reporting process"@en .

arkcyt:scenarioDefinitionProcess a skos:Concept ;
    rdfs:label "Scenario definition process"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2039" ;
    rdfs:comment """In this process, one should examine all probable scenarios where digital evidence might be required.
The output of this process includes the defined scenarios.
It is also recommended that a proper risk assessment is performed during this process for each
identified scenario respectively. A risk assessment would enable one to better identify possible threats,
vulnerabilities and related scenarios that would expose particular information assets. Based on the
assessed risk from certain threats, vulnerabilities or scenarios, one can, in later processes, better decide
on the required controls to achieve investigation readiness within an organization. This will enable an
organization to take into account the risk level, costs, and benefits of possible controls in a bid to reduce
the identified risk."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """In this process, one should examine all probable scenarios where digital evidence might be required.
The output of this process includes the defined scenarios.
It is also recommended that a proper risk assessment is performed during this process for each
identified scenario respectively. A risk assessment would enable one to better identify possible threats,
vulnerabilities and related scenarios that would expose particular information assets. Based on the
assessed risk from certain threats, vulnerabilities or scenarios, one can, in later processes, better decide
on the required controls to achieve investigation readiness within an organization. This will enable an
organization to take into account the risk level, costs, and benefits of possible controls in a bid to reduce
the identified risk."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Scenario definition process"@en .

arkcyt:validation a skos:Concept ;
    rdfs:label "validation"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2030" ;
    rdfs:comment """confirmation, through the provision of objective evidence, that the requirements for a specific intended
use or application have been fulfilled"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """confirmation, through the provision of objective evidence, that the requirements for a specific intended
use or application have been fulfilled"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "validation"@en .

arkcyt:verification a skos:Concept ;
    rdfs:label "verification"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2031" ;
    rdfs:comment "confirmation, through the provision of objective evidence, that specified requirements have been fulfilled"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "confirmation, through the provision of objective evidence, that specified requirements have been fulfilled"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "verification"@en .

arkcyt:volatileData a skos:Concept ;
    rdfs:label "volatile data"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2032" ;
    rdfs:comment "caused by data that is especially prone to change and can be easily modified"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "caused by data that is especially prone to change and can be easily modified"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "volatile data"@en .

arkcyt:Audit a skos:Concept ;
    rdfs:label "Audit"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """systematic, independent and documented process (3.54) for obtaining audit evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),
and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: An internal audit is conducted by the organization itself, or by an external party on its behalf.
Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """systematic, independent and documented process (3.54) for obtaining audit evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),
and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: An internal audit is conducted by the organization itself, or by an external party on its behalf.
Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:narrower arkcyt:CombinedAudit,
        arkcyt:ExternalAudit,
        arkcyt:InternalAudit ;
    skos:prefLabel "Audit"@en .

arkcyt:CapabilitiesContext a skos:Concept ;
    rdfs:label "Capabilities context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2030" ;
    rdfs:comment "Context capabilities are essential capabilities to get things done for a company. The context capabilities constitute the transactional services that typically are under the radar but surface when they do not work well. For example, Finance and Accounting are context capabilities for most companies."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Context capabilities are essential capabilities to get things done for a company. The context capabilities constitute the transactional services that typically are under the radar but surface when they do not work well. For example, Finance and Accounting are context capabilities for most companies."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Capabilities context"@en .

arkcyt:CombinedAudit a skos:Concept ;
    rdfs:label "Combined audit"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2021" ;
    rdfs:comment "A combined audit is an efficient and cost-effective approach for organizations seeking to comply with multiple standards or regulatory requirements."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "A combined audit is an efficient and cost-effective approach for organizations seeking to comply with multiple standards or regulatory requirements."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Combined audit"@en .

arkcyt:CompetitiveEnvironment a skos:Concept ;
    rdfs:label "Competitive environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2024" ;
    rdfs:comment "landscape in which various organizations, service providers, and technology developers operate, compete, and collaborate to offer cybersecurity solutions and services."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "landscape in which various organizations, service providers, and technology developers operate, compete, and collaborate to offer cybersecurity solutions and services."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Competitive environment"@en .

arkcyt:ContractualContext a skos:Concept ;
    rdfs:label "Contractual Context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2037" ;
    rdfs:comment "A contextual theory of contract law also recognizes a number of phenomena. First, contract interpretation, through the lens of context, should be used to regulate influences that question the purity of the freedom of contract upon which most agreements are based."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "A contextual theory of contract law also recognizes a number of phenomena. First, contract interpretation, through the lens of context, should be used to regulate influences that question the purity of the freedom of contract upon which most agreements are based."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Contractual Context"@en .

arkcyt:Control a skos:Concept ;
    rdfs:label "Control"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """measure that is modifying risk (3.61)
Note 1 to entry: Controls include any process (3.54), policy (3.53), device, practice, or other actions which modify
risk (3.61).
Note 2 to entry: It is possible that controls not always exert the intended or assumed modifying effect."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition """measure that is modifying risk (3.61)
Note 1 to entry: Controls include any process (3.54), policy (3.53), device, practice, or other actions which modify
risk (3.61).
Note 2 to entry: It is possible that controls not always exert the intended or assumed modifying effect."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Control"@en .

arkcyt:CulturalEnvironment a skos:Concept ;
    rdfs:label "Cultural environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2048" ;
    rdfs:comment "Cultural environment in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Cultural environment in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Cultural environment"@en .

arkcyt:CultureContext a skos:Concept ;
    rdfs:label "Culture context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2053" ;
    rdfs:comment "Culture context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Culture context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Culture context"@en .

arkcyt:DecisionMakingProcessContext a skos:Concept ;
    rdfs:label "Decision making process context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2033" ;
    rdfs:comment "The decision-making process in cybersecurity is a critical aspect of organizational governance, risk management, and resilience. By following a systematic approach to identify objectives, assess risks, evaluate options, and implement effective measures, organizations can make informed decisions that mitigate cyber threats, protect assets, and support business objectives."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The decision-making process in cybersecurity is a critical aspect of organizational governance, risk management, and resilience. By following a systematic approach to identify objectives, assess risks, evaluate options, and implement effective measures, organizations can make informed decisions that mitigate cyber threats, protect assets, and support business objectives."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Decision making process context"@en .

arkcyt:EconomicEnvironment a skos:Concept ;
    rdfs:label "Economic environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2052" ;
    rdfs:comment "Economic environment in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Economic environment in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Economic environment"@en .

arkcyt:Event a skos:Concept ;
    rdfs:label "Event"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """occurrence or change of a particular set of circumstances
Note 1 to entry: An event can be one or more occurrences, and can have several causes.
Note 2 to entry: An event can consist of something not happening.
Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """occurrence or change of a particular set of circumstances
Note 1 to entry: An event can be one or more occurrences, and can have several causes.
Note 2 to entry: An event can consist of something not happening.
Note 3 to entry: An event can sometimes be referred to as an “incident” or “accident”."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Event"@en .

arkcyt:ExternalAudit a skos:Concept ;
    rdfs:label "External audit"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2020" ;
    rdfs:comment "An external audit is performed by an independent auditor or auditing firm not affiliated with the organization being audited."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "An external audit is performed by an independent auditor or auditing firm not affiliated with the organization being audited."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "External audit"@en .

arkcyt:ExternalEnvrionment a skos:Concept ;
    rdfs:label "External envrionment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2046" ;
    rdfs:comment "External envrionment in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "External envrionment in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "External envrionment"@en .

arkcyt:ExternalStakeholder a skos:Concept ;
    rdfs:label "External stakeholder"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2023" ;
    rdfs:comment """person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision
or activity"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """person or organization (3.50) that can affect, be affected by, or perceive itself to be affected by a decision
or activity"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "External stakeholder"@en .

arkcyt:FinancialEnvironment a skos:Concept ;
    rdfs:label "Financial environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2022" ;
    rdfs:comment "The financial environment encompasses all external and internal factors that influence financial decision-making within an economy or organization."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The financial environment encompasses all external and internal factors that influence financial decision-making within an economy or organization."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Financial environment"@en .

arkcyt:GovernanceContext a skos:Concept ;
    rdfs:label "Governance context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2051" ;
    rdfs:comment "Governance context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Governance context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Governance context"@en .

arkcyt:GuidelinesContext a skos:Concept ;
    rdfs:label "Guidelines context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2032" ;
    rdfs:comment "Guidelines Context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Guidelines Context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Guidelines context"@en .

arkcyt:InformationFlowContext a skos:Concept ;
    rdfs:label "Information flow context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2041" ;
    rdfs:comment "Information flow control adds metadata to data flows (data transfer across networks, files read from the disc, and so on) and ensures that sensitive data does not flow from a higher security context to a lower security context."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Information flow control adds metadata to data flows (data transfer across networks, files read from the disc, and so on) and ensures that sensitive data does not flow from a higher security context to a lower security context."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information flow context"@en .

arkcyt:InformationSecurityIncidentManagement a skos:Concept ;
    rdfs:label "Information security incident management"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date,
        "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2020",
        "ISO27000:2018" ;
    rdfs:comment "collaborative activities to handle information security incidents (3.1.5) in a consistent and effective way"@en,
        """set of processes (3.54) for detecting, reporting, assessing, responding to, dealing with, and learning
from information security incidents (3.31)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurityIncident ;
    skos:definition "collaborative activities to handle information security incidents (3.1.5) in a consistent and effective way"@en,
        """set of processes (3.54) for detecting, reporting, assessing, responding to, dealing with, and learning
from information security incidents (3.31)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security incident management"@en .

arkcyt:InformationSystemContext a skos:Concept ;
    rdfs:label "InformationSystemContext"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2044" ;
    rdfs:comment "Information system context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Information system context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "InformationSystemContext"@en .

arkcyt:InternalAudit a skos:Concept ;
    rdfs:label "Internal audit"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2019" ;
    rdfs:comment "An internal audit is conducted by the organization itself, or by an external party on its behalf."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "An internal audit is conducted by the organization itself, or by an external party on its behalf."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Internal audit"@en .

arkcyt:InternalStakeholderContext a skos:Concept ;
    rdfs:label "Internal stakeholder context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2049" ;
    rdfs:comment "Internal stakeholder context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Internal stakeholder context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Internal stakeholder context"@en .

arkcyt:KeyDriversAndTrends a skos:Concept ;
    rdfs:label "Key drivers and trends"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2025" ;
    rdfs:comment "The cybersecurity landscape is continually evolving, driven by a range of key factors and emerging trends. These drivers and trends shape the strategies of businesses, governments, and cybersecurity providers as they work to protect against increasingly sophisticated cyber threats. "@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The cybersecurity landscape is continually evolving, driven by a range of key factors and emerging trends. These drivers and trends shape the strategies of businesses, governments, and cybersecurity providers as they work to protect against increasingly sophisticated cyber threats. "@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Key drivers and trends"@en .

arkcyt:LegalEnvironment a skos:Concept ;
    rdfs:label "Legal environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2036" ;
    rdfs:comment " understanding the legal frameworks in which a business operates so that compliance can be achieved and maintained."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition " understanding the legal frameworks in which a business operates so that compliance can be achieved and maintained."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Legal environment"@en .

arkcyt:ModelsContext a skos:Concept ;
    rdfs:label "Models context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2040" ;
    rdfs:comment "Models context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Models context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Models context"@en .

arkcyt:NaturalEnvironment a skos:Concept ;
    rdfs:label "Natural environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2038" ;
    rdfs:comment "The natural environment consists of land-based ecosystems such as grasslands and forests, aquatic ecosystems such as rivers and wetlands, and coastal and marine ecosystems such as mangroves and sea-grass meadows."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The natural environment consists of land-based ecosystems such as grasslands and forests, aquatic ecosystems such as rivers and wetlands, and coastal and marine ecosystems such as mangroves and sea-grass meadows."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Natural environment"@en .

arkcyt:ObjectiveContext a skos:Concept ;
    rdfs:label "Objective context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2043" ;
    rdfs:comment "Objective context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Objective context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Objective context"@en .

arkcyt:OrganisationalStructureContext a skos:Concept ;
    rdfs:label "Organisational structure context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2027" ;
    rdfs:comment "The organizational structure in the context of cybersecurity refers to how a company is organized to effectively manage and implement its cybersecurity strategies and practices."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The organizational structure in the context of cybersecurity refers to how a company is organized to effectively manage and implement its cybersecurity strategies and practices."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Organisational structure context"@en .

arkcyt:OrganizationalAccountabilityContext a skos:Concept ;
    rdfs:label "Organizational accountability context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2054" ;
    rdfs:comment "Organizational accountability context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Organizational accountability context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Organizational accountability context"@en .

arkcyt:OrganizationalRoleContext a skos:Concept ;
    rdfs:label "Organizational role context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2045" ;
    rdfs:comment "Organizational role context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Organizational role context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Organizational role context"@en .

arkcyt:Performance a skos:Concept ;
    rdfs:label "Performance"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """measurable result
Note 1 to entry: Performance can relate either to quantitative or qualitative findings.
Note 2 to entry: Performance can relate to the management of activities, processes (3.54), products (including
services), systems or organizations (3.50)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Measurement ;
    skos:definition """measurable result
Note 1 to entry: Performance can relate either to quantitative or qualitative findings.
Note 2 to entry: Performance can relate to the management of activities, processes (3.54), products (including
services), systems or organizations (3.50)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Performance"@en .

arkcyt:PolicyContext a skos:Concept ;
    rdfs:label "Policy context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2034" ;
    rdfs:comment "Policy context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Policy context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Policy context"@en .

arkcyt:PoliticalEnvironment a skos:Concept ;
    rdfs:label "Political environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2029" ;
    rdfs:comment "The political environment in the context of cybersecurity refers to the influence of governmental policies, regulations, and actions on cybersecurity practices, strategies, and challenges."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The political environment in the context of cybersecurity refers to the influence of governmental policies, regulations, and actions on cybersecurity practices, strategies, and challenges."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Political environment"@en .

arkcyt:RegulatoryEnvironment a skos:Concept ;
    rdfs:label "Regulatory environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2039" ;
    rdfs:comment "that part of the firm's external marketing environment on which legal and political forces act to change regulations which affect the marketing effort"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "that part of the firm's external marketing environment on which legal and political forces act to change regulations which affect the marketing effort"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Regulatory environment"@en .

arkcyt:SocialEnvironment a skos:Concept ;
    rdfs:label "Social environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2042" ;
    rdfs:comment "Social environment in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Social environment in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Social environment"@en .

arkcyt:StakeholderPerception a skos:Concept ;
    rdfs:label "Stakeholder perception"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2035" ;
    rdfs:comment "The stakeholder perception approach refers to the way stakeholders perceive and evaluate the actions and behavior of a company or organization."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "The stakeholder perception approach refers to the way stakeholders perceive and evaluate the actions and behavior of a company or organization."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Stakeholder perception"@en .

arkcyt:StakeholderRelationship a skos:Concept ;
    rdfs:label "Stakeholder relationship"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2031" ;
    rdfs:comment "professional connections businesses form with people or groups who have an interest in their activities and decisions."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "professional connections businesses form with people or groups who have an interest in their activities and decisions."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Stakeholder relationship"@en .

arkcyt:StakeholderValue a skos:Concept ;
    rdfs:label "Stakeholder value"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2026" ;
    rdfs:comment "Stakeholder value refers to the benefits and advantages that various stakeholders derive from an organization's activities, policies, and performance."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Stakeholder value refers to the benefits and advantages that various stakeholders derive from an organization's activities, policies, and performance."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Stakeholder value"@en .

arkcyt:StandardsContext a skos:Concept ;
    rdfs:label "Standards Context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2028" ;
    rdfs:comment "Standards in the context of cybersecurity are established frameworks, guidelines, and specifications that organizations follow to ensure their systems, processes, and practices are secure and resilient against cyber threats."@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Standards in the context of cybersecurity are established frameworks, guidelines, and specifications that organizations follow to ensure their systems, processes, and practices are secure and resilient against cyber threats."@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Standards Context"@en .

arkcyt:StrategyContext a skos:Concept ;
    rdfs:label "Strategy context"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2047" ;
    rdfs:comment "Strategy context in cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Strategy context in cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Strategy context"@en .

arkcyt:TechnologicalEnvironment a skos:Concept ;
    rdfs:label "Technological environment"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2050" ;
    rdfs:comment "Technological environment om cybersecurity"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "Technological environment om cybersecurity"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Technological environment"@en .

arkcyt:Nonconformity a skos:Concept ;
    rdfs:label "Nonconformity"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "non-fulfilment of a requirement (3.56)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Requirement ;
    skos:definition "non-fulfilment of a requirement (3.56)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Nonconformity"@en .

arkcyt:Requirement a skos:Concept ;
    rdfs:label "Requirement"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """need or expectation that is stated, generally implied or obligatory
Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization and
interested parties that the need or expectation under consideration is implied.
Note 2 to entry: A specified requirement is one that is stated, for example in documented information."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """need or expectation that is stated, generally implied or obligatory
Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization and
interested parties that the need or expectation under consideration is implied.
Note 2 to entry: A specified requirement is one that is stated, for example in documented information."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Requirement"@en .

arkcyt:Review a skos:Concept ;
    rdfs:label "Review"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """activity undertaken to determine the suitability, adequacy and effectiveness (3.20) of the subject matter
to achieve established objectives (3.49)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """activity undertaken to determine the suitability, adequacy and effectiveness (3.20) of the subject matter
to achieve established objectives (3.49)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Review"@en .

arkcyt:InformationSecurityIncident a skos:Concept ;
    rdfs:label "Information security incident"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date,
        "2024-05-27"^^xsd:date ;
    dcterms:source "ISO IEC 27043:2019",
        "ISO27000:2018" ;
    rdfs:comment """related and identified information security event(s) (3.1.4) that can harm an organization's assets or
compromise its operations"""@en,
        """single or a series of unwanted or unexpected information security events (3.30) that have a significant
probability of compromising business operations and threatening information security (3.28)"""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:InformationSecurity ;
    skos:definition """related and identified information security event(s) (3.1.4) that can harm an organization's assets or
compromise its operations"""@en,
        """single or a series of unwanted or unexpected information security events (3.30) that have a significant
probability of compromising business operations and threatening information security (3.28)"""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security incident"@en .

arkcyt:ManagementSystem a skos:Concept ;
    rdfs:label "Management system"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """set of interrelated or interacting elements of an organization (3.50) to establish policies (3.53) and
objectives (3.49) and processes (3.54) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning
and operation.
Note 3 to entry: The scope of a management system may include the whole of the organization, specific and
identified functions of the organization, specific and identified sections of the organization, or one or more
functions across a group of organizations."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """set of interrelated or interacting elements of an organization (3.50) to establish policies (3.53) and
objectives (3.49) and processes (3.54) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
Note 2 to entry: The system elements include the organization’s structure, roles and responsibilities, planning
and operation.
Note 3 to entry: The scope of a management system may include the whole of the organization, specific and
identified functions of the organization, specific and identified sections of the organization, or one or more
functions across a group of organizations."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Management system"@en .

arkcyt:Measure a skos:Concept ;
    rdfs:label "Measure"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "variable to which a value is assigned as the result of measurement (3.43)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Measurement ;
    skos:definition "variable to which a value is assigned as the result of measurement (3.43)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Measure"@en .

arkcyt:Organization a skos:Concept ;
    rdfs:label "Organization"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """person or group of people that has its own functions with responsibilities, authorities and relationships
to achieve its objectives (3.49)
Note 1 to entry: The concept of organization includes but is not limited to sole-trader, company, corporation, firm,
enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated
or not, public or private."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """person or group of people that has its own functions with responsibilities, authorities and relationships
to achieve its objectives (3.49)
Note 1 to entry: The concept of organization includes but is not limited to sole-trader, company, corporation, firm,
enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated
or not, public or private."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Organization"@en .

arkcyt:RiskManagement a skos:Concept ;
    rdfs:label "Risk management"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "coordinated activities to direct and control an organization (3.50) with regard to risk (3.61)"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:broader arkcyt:Risk ;
    skos:definition "coordinated activities to direct and control an organization (3.50) with regard to risk (3.61)"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk management"@en .

arkcyt:Measurement a skos:Concept ;
    rdfs:label "Measurement"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment "process (3.54) to determine a value"@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition "process (3.54) to determine a value"@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Measurement"@en .

arkcyt:InformationSecurity a skos:Concept ;
    rdfs:label "Information security"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """preservation of confidentiality (3.10), integrity (3.36) and availability (3.7) of information
Note 1 to entry: In addition, other properties, such as authenticity (3.6), accountability, non-repudiation (3.48),
and reliability (3.55) can also be involved."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """preservation of confidentiality (3.10), integrity (3.36) and availability (3.7) of information
Note 1 to entry: In addition, other properties, such as authenticity (3.6), accountability, non-repudiation (3.48),
and reliability (3.55) can also be involved."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Information security"@en .

arkcyt:Risk a skos:Concept ;
    rdfs:label "Risk"@en ;
    dcterms:contributor "Junli Liang",
        "Rob Brennan" ;
    dcterms:created "2024-04-08"^^xsd:date ;
    dcterms:source "ISO27000:2018" ;
    rdfs:comment """effect of uncertainty on objectives (3.49)
Note 1 to entry: An effect is a deviation from the expected — positive or negative.
Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or
knowledge of, an event, its consequence, or likelihood.
Note 3 to entry: Risk is often characterized by reference to potential “events” (as defined in ISO Guide 73:2009,
3.5.1.3) and “consequences” (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these.
Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including
changes in circumstances) and the associated “likelihood” (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence.
Note 5 to entry: In the context of information security management systems, information security risks can be
expressed as effect of uncertainty on information security objectives.
Note 6 to entry: Information security risk is associated with the potential that threats will exploit vulnerabilities
of an information asset or group of information assets and thereby cause harm to an organization."""@en ;
    rdfs:isDefinedBy "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:definition """effect of uncertainty on objectives (3.49)
Note 1 to entry: An effect is a deviation from the expected — positive or negative.
Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or
knowledge of, an event, its consequence, or likelihood.
Note 3 to entry: Risk is often characterized by reference to potential “events” (as defined in ISO Guide 73:2009,
3.5.1.3) and “consequences” (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these.
Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including
changes in circumstances) and the associated “likelihood” (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence.
Note 5 to entry: In the context of information security management systems, information security risks can be
expressed as effect of uncertainty on information security objectives.
Note 6 to entry: Information security risk is associated with the potential that threats will exploit vulnerabilities
of an information asset or group of information assets and thereby cause harm to an organization."""@en ;
    skos:inScheme "https://openark.adaptcentre.ie/Ontologies/CybersecurityTerminology#" ;
    skos:prefLabel "Risk"@en .