CCPC flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Cyber policy

Authoritative decisions, laws, and regulations that allocate cybersecurity risk, responsibilities, and resources among government, private sector, and individuals.

Governance

The system of decision rights, accountability, and oversight mechanisms that ensures cybersecurity activities align with organizational objectives and legal obligations.

Executive Order 13636

2013 U.S. order directing development of a voluntary cybersecurity framework and expansion of information sharing for critical infrastructure.

CIRCIA

2022 U.S. law requiring covered critical infrastructure entities to report significant cyber incidents to CISA within 72 hours and ransom payments within 24 hours.

Risk formula

Risk = Threat × Vulnerability × Impact (qualitative), or likelihood × consequence (quantitative); controls reduce one or more factors.

NIST CSF functions

Identify, Protect, Detect, Respond, Recover; CSF 2.0 adds Govern as a central function spanning the others.

Risk Management Framework

NIST SP 800-37 process: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor; used to authorize federal information systems.

FAIR

Factor Analysis of Information Risk; a quantitative model expressing cyber risk in monetary terms using loss event frequency and loss magnitude.

STRIDE

Threat modeling mnemonic: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

Residual risk

The risk remaining after controls are applied; must be documented and formally accepted by an accountable risk owner.

CFAA

Computer Fraud and Abuse Act (1986); U.S. federal law criminalizing unauthorized access to protected computers and related offenses.

GDPR

EU General Data Protection Regulation; applies extraterritorially to processing of EU residents' personal data, with fines up to 4% of global turnover or €20 million.

Breach notification laws

State laws requiring organizations to notify affected individuals, and sometimes regulators, after a data breach involving personal information; timing and content vary by state.

Compliance

Adherence to applicable laws, regulations, and standards; a baseline obligation that does not by itself guarantee effective security.

Budapest Convention

2001 international treaty harmonizing cybercrime laws and facilitating cross-border cooperation on computer-related offenses and evidence.

Incident response life cycle

NIST SP 800-61 phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

RTO and RPO

Recovery Time Objective is maximum acceptable downtime; Recovery Point Objective is maximum acceptable data loss measured in time.

Business impact analysis

Process identifying critical business functions, dependencies, and the financial and operational consequences of disruption; informs BCP and DR priorities.

3-2-1 backup rule

Keep at least three copies of data, on two different media, with one copy stored offsite; supports resilience and recovery.

Tabletop exercise

Discussion-based simulation of an incident scenario used to validate plans, roles, and communications; findings drive corrective actions.

Data minimization

Privacy principle requiring collection and processing of only personal data that is adequate, relevant, and necessary for the stated purpose.

Standard Contractual Clauses

EU-approved model contract terms used to lawfully transfer personal data to countries without an adequacy decision.

Schrems II

2020 EU Court of Justice ruling invalidating the EU-US Privacy Shield and imposing additional safeguards for international data transfers.

Data localization

Legal requirement that certain data be stored or processed within national borders; examples include China, Russia, and sectoral Indian rules.

Data Protection Impact Assessment

GDPR Article 35 process assessing risks to personal data before high-risk processing; required for certain categories of processing.

ISAC

Information Sharing and Analysis Center; sector-specific organization that collects and shares threat intelligence among members.

STIX and TAXII

Standards for expressing cyber threat intelligence (STIX) and transporting it (TAXII); used for automated indicator sharing.

Traffic Light Protocol

Marking scheme (RED, AMBER, GREEN, CLEAR) defining permitted dissemination of shared information to protect confidentiality.

CISA 2015

U.S. Cybersecurity Information Sharing Act providing liability protection for sharing cyber threat indicators with the government under prescribed procedures.

Deterrence by denial

Strategy reducing the likelihood or impact of a successful attack through hardening, resilience, and defense so adversaries perceive low benefit.

Tallinn Manual

Academic study (1.0 and 2.0) analyzing how existing international law, including sovereignty and use-of-force rules, applies to cyber operations.

UN GGE norms

Voluntary norms of responsible state behavior in cyberspace, including not attacking critical infrastructure and not allowing territory to be used for wrongful cyber acts.

NIST AI RMF

AI Risk Management Framework (1.0, 2023) organizing AI risk work into Govern, Map, Measure, and Manage functions for trustworthy AI.

Shared responsibility model

Cloud security principle: provider secures infrastructure; customer secures data, identities, and configurations; division varies by service model.

SBOM

Software Bill of Materials; machine-readable inventory of software components and dependencies supporting supply chain risk management.

FedRAMP

U.S. federal program authorizing cloud services through standardized security assessment and continuous monitoring for government use.