CEICC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Binding law vs. framework

Law and regulation are enforceable obligations; frameworks are voluntary guidance unless adopted through contract, certification scope, or regulator expectation, which converts them into requirements.

ISO/IEC 27001

A certifiable international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system, including risk assessment and a Statement of Applicability.

SOC 2 Type II

An independent attestation report on the operating effectiveness of controls against Trust Services Criteria over a defined period, typically three to twelve months, unlike a point-in-time Type I.

NIST CSF functions

The Cybersecurity Framework organizes outcomes into Identify, Protect, Detect, Respond, and Recover, with Govern added in version 2.0 to address organizational context and risk strategy.

Statement of Applicability

An ISO 27001 document listing applicable controls, justification for inclusion or exclusion, and implementation status, demonstrating that control selection followed the risk assessment.

GDPR lawful bases

Processing requires one of six bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The chosen basis must be documented and appropriate to context.

Controller versus processor

A controller determines the purposes and means of processing; a processor acts on documented instructions. Joint controllers share responsibility for common processing decisions and obligations.

GDPR 72-hour notification

Controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to result in a risk to individuals.

Data minimization principle

Personal data collected must be adequate, relevant, and limited to what is necessary for the specified purpose, reducing exposure and supporting retention limits.

Cross-border transfer mechanisms

Tools such as adequacy decisions, standard contractual clauses, and binding corporate rules permit international data transfers; many regimes also require a transfer impact assessment.

Data Protection Impact Assessment

A structured assessment required for high-risk processing, such as large-scale special-category data or systematic monitoring, identifying risks and mitigations before processing begins.

Residual risk formula

Residual risk equals inherent risk reduced by the effectiveness of applied controls. It is the risk remaining after treatment and must be compared against risk appetite.

Risk treatment options

Organizations mitigate, transfer, avoid, or accept risk. Acceptance requires documented rationale, an accountable owner, and a defined review or expiry date.

Three lines model

Operational management owns risk (first line), risk and compliance functions provide oversight (second line), and internal audit gives independent assurance (third line).

NIST RMF steps

Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor form the Risk Management Framework lifecycle for managing security and privacy risk.

RTO and RPO

Recovery Time Objective is the maximum acceptable downtime; Recovery Point Objective is the maximum acceptable data loss measured in time. Both guide continuity and backup design.

Key risk indicators

Measurable metrics with defined thresholds that signal whether risk exposure is drifting from appetite, reviewed on a set cadence and reported to governance bodies.

Control categories

Controls are classified as preventive, detective, corrective, deterrent, or compensating, and as administrative, technical, or physical, enabling layered and complementary safeguards.

Least privilege

Users and systems receive only the access necessary for their function, limiting the impact of compromise and supporting separation of duties and auditability.

AAA model

Authentication verifies identity, authorization grants permissions, and accounting logs activity. Together they enforce and evidence access control decisions.

Multi-factor authentication

Authentication combining two or more factors from different categories: something you know, something you have, or something you are. Two passwords do not satisfy MFA.

CVSS prioritization

The Common Vulnerability Scoring System rates severity, and remediation priority combines that score with exploitability and asset criticality rather than relying on score alone.

Defense in depth

Layering preventive, detective, and corrective controls so no single control failure results in full compromise, increasing attacker cost and detection likelihood.

Incident response lifecycle

Preparation, detection and analysis, containment, eradication and recovery, and post-incident activity structure response and ensure lessons feed back into controls.

Breach notification triggers

Notification duties typically arise when a breach creates a risk of harm to individuals; the risk assessment supporting notify or no-notify decisions must be documented.

Chain of custody

Documented control over evidence from collection through storage and analysis, establishing integrity and admissibility for investigations, regulators, and litigation.

Incident severity tiers

Predefined classifications based on impact, data sensitivity, and scope that determine escalation paths, notification obligations, and resource allocation during response.

Vendor tiering

Classifying third parties by data sensitivity and operational criticality to set proportionate due diligence depth, contract terms, and reassessment frequency.

Fourth-party risk

Risk arising from subprocessors and downstream providers of direct vendors, requiring visibility into the extended supply chain beyond first-tier contracts.

Right-to-audit clause

A contract provision granting the customer rights to assess vendor controls, specifying scope, notice, frequency, and whether independent auditors may perform the assessment.

Audit evidence sufficiency

Evidence must be sufficient, reliable, and relevant; system-generated logs and independent observation are stronger than self-reported attestations, and sampling introduces risk.

Continuous control monitoring

Automated collection and testing of control evidence that flags exceptions for human review, detecting control drift between periodic audits and reducing manual testing effort.