Cyber and information security

The terms overlap but are defined differently. ISO/IEC 27000 defines information security as the preservation of confidentiality, integrity and availability of information in any form, including paper and speech. The EU Cybersecurity Act, Regulation (EU) 2019/881 Art. 2(1), defines cybersecurity as the activities necessary to protect network and information systems, their users and other persons affected by cyber threats, and NIS2 Art. 6(3) adopts that definition, while Art. 6(2) defines the security of network and information systems as resistance to events that compromise availability, authenticity, integrity or confidentiality. ISO/IEC 27032:2023 treats Internet security as a further subset. The Danish pairing "cyber- og informationssikkerhed", used in the national strategies, deliberately covers both, whereas "IT-sikkerhed" traditionally means the technical subset.

Structurally the discipline is run as a management system. ISO/IEC 27001:2022 specifies an ISMS on the Plan-Do-Check-Act pattern: context and scope (clause 4), leadership (5), risk assessment and treatment (6.1.2 and 6.1.3), operation (8), performance evaluation through internal audit and management review (9.2, 9.3) and continual improvement (10). The NIST Cybersecurity Framework 2.0 organises outcomes in six functions, Govern, Identify, Protect, Detect, Respond and Recover, and is often used alongside ISO as a maturity and communication tool. NIS2 Art. 21(2) sets a minimum list of measures that cover much of the same ground, from risk analysis and incident handling to supply chain security, cryptography and MFA.

The work spans four domains that must be coordinated: technical controls (identity, endpoint, network, cloud, application security, cryptography), processes (change, vulnerability and incident management, continuity), people (awareness, vetting, roles, culture) and physical security. Typical roles include a CISO or information security coordinator, system and information owners, IT operations, a SOC, a data protection officer under GDPR Art. 37 to 39 where required, and internal audit. Separating those who operate controls from those who oversee them is itself a control.

Common misconceptions are that security is an IT project with an end date, that a certificate or a compliance report equals protection, and that it is purely about preventing external attackers, whereas faults, human error, suppliers and insiders cause a large share of incidents. The discipline is also distinct from privacy and data protection, which concern the lawful processing of personal data, even though GDPR Art. 32 requires security of processing, and from safety, which concerns harm to people and the environment, although the two converge in operational technology. Security is steered by risk management, which sets priorities, and by governance, which sets direction and accountability.