CCPC key terms

A government's stated set of principles, priorities, and planned actions for managing cyber risks, assigning responsibilities, and guiding public and private behavior in cyberspace.

A high-level document that sets a country's long-term cyber objectives, defines roles across agencies, and coordinates defense, economic, and diplomatic cyber efforts.

The structures, decision rights, and accountability mechanisms an organization or state uses to direct, oversee, and control its cybersecurity activities and investments.

Coordinating all relevant agencies and levels of government behind shared cyber objectives rather than leaving policy to a single department.

The amount and type of cyber risk an organization is willing to accept in pursuit of its objectives, expressed as a formal statement that guides decisions.

The acceptable variation around a stated risk appetite, giving practical thresholds that determine when a specific risk must be treated or escalated.

A structured process of identifying assets, threats, and vulnerabilities and estimating the likelihood and impact of harm to prioritize action.

Choosing and applying options to address assessed risk, such as mitigating controls, transferring through insurance, avoiding an activity, or formally accepting the residual risk.

The risk that remains after controls and treatments have been applied, which leadership must knowingly accept or further reduce.

A voluntary framework organized around the functions Identify, Protect, Detect, Respond, and Recover that helps organizations structure and improve their cybersecurity programs.

An international standard specifying requirements for establishing, operating, and continually improving an information security management system.

A staged reference that describes progressively more capable practices, letting organizations benchmark their current cybersecurity posture and plan improvements.

A structured method for identifying likely attackers, attack paths, and weaknesses in a system design so controls can be built in early.

The ongoing cycle of discovering, prioritizing, remediating, and verifying weaknesses in software and systems before attackers can exploit them.

A binding rule issued by a government or agency that creates legal obligations, often with penalties for noncompliance, in areas such as security or privacy.

The state of meeting applicable laws, regulations, standards, and contractual duties, evidenced through controls, documentation, and independent verification.

An independent, evidence-based examination that determines whether controls and practices conform to specified requirements and are operating effectively.

The reasonable investigation and care an organization is expected to take before and during a relationship or transaction to identify and manage legal and security risks.

The ongoing standard of prudent, reasonable action an organization must exercise to protect assets and people, judged against what a comparable organization would do.

Failure to exercise the level of care a reasonable party would use, which can create legal liability when that failure causes harm.

Legal responsibility for harm or loss, which may be assigned through statute, contract, or court judgment and can be shared among multiple parties.

A contractual promise by one party to compensate another for specified losses or third-party claims, shifting financial responsibility.

A documented set of roles, procedures, and communication paths that guides an organization through detecting, containing, eradicating, and recovering from a cyber incident.

An event that actually or potentially compromises the confidentiality, integrity, or availability of information systems or the data they hold.

A plan describing how essential functions will keep operating during and after disruption, including alternate arrangements for people, processes, and technology.

A plan focused on restoring IT systems and data after a major outage, including backup restoration, recovery priorities, and target restoration times.

The maximum acceptable time to restore a function or system after disruption, used to set recovery priorities and investment levels.

The maximum acceptable amount of data loss measured in time, which determines how frequently backups or replication must occur.

The entity that determines the purposes and means of processing personal data and bears primary legal responsibility for complying with privacy obligations.

An entity that processes personal data on behalf of and under the instructions of a controller, typically bound by a written processing agreement.

Information relating to an identified or identifiable individual, including identifiers and data that can be linked back to a person.

Legal entitlements of individuals over their personal data, such as access, correction, deletion, portability, and objection to certain processing.

A legal or contractual duty to inform regulators and affected individuals within defined timeframes when personal data is compromised.

Movement of data between jurisdictions, often restricted unless a lawful mechanism such as adequacy, standard contractual clauses, or consent applies.

A legal requirement that certain data be stored or processed within a country's borders, often justified by security or sovereignty claims.

The principle that data is subject to the laws and governance of the jurisdiction where it is collected or stored, which shapes international data policy.

A structured, often formalized collaboration between government and private entities to share responsibility, resources, and information for a public cyber objective.

A sector-based or regional body where members exchange threat intelligence, incidents, and mitigation practices under agreed trust and handling rules.

A labeling scheme (red, amber, green, clear) that tells recipients how shared information may be further distributed, protecting trust among sharing partners.

The timely exchange of threat, vulnerability, and incident data among trusted parties to improve collective detection and response.

A transparency step such as sharing doctrine or hosting exchanges that reduces miscalculation and tension between states in cyberspace.

A shared, non-binding expectation of appropriate state behavior that guides conduct and helps identify departures from accepted practice.

Influencing an adversary's decisions by convincing them that the costs or risks of an action outweigh expected gains, through punishment, denial, or norms.

The process of identifying the actor responsible for a cyber operation, which is a prerequisite for public naming, sanctions, or other responses.

Coercive measures such as asset freezes or travel bans imposed on states or individuals to punish or deter prohibited cyber conduct.

The expectation that states act consistently with international law and agreed norms, including due diligence and restraint in cyberspace.

Policies, standards, and oversight mechanisms that direct how AI systems are developed, deployed, and monitored to manage safety, bias, and accountability risks.

The principle that organizations can explain, justify, and answer for how automated systems make or support decisions affecting people.

A cloud arrangement that divides security duties between provider and customer, clarifying who secures the physical infrastructure versus configurations and data.

Exposure arising from vendors, software components, and service providers whose weaknesses or compromises can harm an organization's systems and data.

The risk an organization faces from external parties it relies on, managed through due diligence, contractual controls, and ongoing monitoring.

Networked physical devices with embedded sensors and software whose limited security features create large-scale exposure and policy challenges.

A controlled process for acquiring, testing, deploying, and verifying software updates that close known vulnerabilities in a timely way.

A contract that specifies measurable performance, availability, and security commitments between a provider and a customer, including remedies for shortfalls.

A contract between controller and processor that sets out processing instructions, security duties, subprocessor rules, and breach notification obligations.

A formal finding by one jurisdiction that another jurisdiction provides essentially equivalent data protection, allowing transfers without extra safeguards.

A legal instrument that sets a binding objective which member states must implement through their own national laws, allowing some flexibility.

The capacity of systems and organizations to anticipate, absorb, adapt to, and recover from disruption while maintaining essential functions.