ACRM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Ransomware double extortion

An attack in which criminals encrypt victim systems and also exfiltrate data, then threaten to publish the stolen information unless a second payment is made.

Initial access broker

A criminal intermediary who obtains and sells footholds such as valid credentials or remote-access sessions into victim networks, which ransomware crews then purchase.

MITRE ATT&CK

A publicly maintained knowledge base of adversary tactics, techniques, and procedures observed in real intrusions, organized by attack phase and used to map detections and controls.

Supply chain attack

Compromise of a trusted vendor, software update channel, or service provider to reach its customers, producing broad correlated losses across many organizations from a single intrusion.

Hacktivist

A threat actor driven by political or social ideology who uses defacement, denial-of-service, or data leaks to draw attention to a cause rather than for financial gain.

Indicator of compromise

A forensic artifact such as a file hash, IP address, or domain suggesting a system has been breached; it is tactical in nature and easily changed by attackers.

Nation-state threat actor

A government-sponsored group conducting espionage, intellectual property theft, or pre-positioning for disruption, characterized by patience, substantial resources, and stealth.

FAIR model

Factor Analysis of Information Risk, a quantitative framework decomposing risk into threat event frequency, vulnerability, and loss magnitude, expressed financially with calibrated ranges.

Annualized loss exposure

The expected dollar loss from a risk scenario over one year, calculated as loss event frequency multiplied by loss magnitude; a core output of quantitative risk analysis.

Loss exceedance curve

A graph showing the probability that annual loss will exceed each given dollar amount; used to compare modeled risk against proposed retentions and insurance limits.

Monte Carlo simulation

A method that repeatedly samples input distributions, such as loss frequency and severity, to produce a distribution of total outcomes rather than a single point estimate.

Risk register

A structured inventory of identified risks recording owner, likelihood, impact, existing controls, treatment plan, and key risk indicators used for ongoing monitoring.

Primary versus secondary loss

Primary loss is the organization's own response and recovery cost; secondary loss includes fines, litigation, notification, and reputation damage that often exceeds it.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed either as narrative statements or quantitative thresholds.

Claims-made policy

Coverage that responds to claims reported during the policy period regardless of when the underlying act occurred, subject to any stated retroactive date.

Retroactive date

The earliest date on which a covered act may have occurred under a claims-made cyber policy; acts occurring before that date are excluded.

Silent cyber

Unintended cyber coverage arising from traditional property or liability policies that neither expressly grant nor exclude cyber loss; regulators press for affirmative clarity.

Business interruption waiting period

The hours of business interruption loss a policyholder retains before coverage begins, commonly 8 to 24 hours, functioning as a deductible measured in time.

Aggregation clause

Policy language defining what constitutes a single loss event, determining whether multiple claims share one limit or each receives its own separate limit.

Sublimit

A cap nested within the overall policy limit that restricts payment for a specific coverage, such as cyber extortion, data restoration, or regulatory defense.

NIST CSF functions

The framework's six core functions: Govern, Identify, Protect, Detect, Respond, and Recover; version 2.0 added Govern as a distinct function.

3-2-1 backup rule

Keep three copies of data, on two different media, with one copy stored offline or offsite, and verify that restoration from those copies actually works.

RTO versus RPO

Recovery time objective is the maximum acceptable downtime after disruption; recovery point objective is the maximum tolerable data loss measured in time.

Zero trust architecture

A security model that verifies every access request explicitly, grants least privilege, and assumes no implicit trust based on network location or prior authentication.

Tabletop exercise

A discussion-based rehearsal in which leaders walk through a simulated incident to test decision-making, communications, and gaps in the response plan.

CISA KEV catalog

A catalog of vulnerabilities known to be exploited in the wild; US federal agencies must remediate listed flaws by set deadlines, and it guides prioritization broadly.

GDPR 72-hour rule

Controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in risk.

SEC Item 1.05

Form 8-K disclosure of a material cybersecurity incident, due within four business days of determining materiality, describing its nature, scope, and material impact.

HIPAA breach notification

Covered entities must notify affected individuals, HHS, and media where more than 500 state residents are affected, without unreasonable delay and within 60 days.

Attorney-client privilege

Engaging outside counsel to direct a forensic investigation can shield reports from discovery, but privilege can be waived by broad distribution or business use.

CIRCIA

The 2022 Cyber Incident Reporting for Critical Infrastructure Act requires covered entities to report significant incidents within 72 hours and ransom payments within 24 hours.

NYDFS 500

New York's cybersecurity regulation for financial services requires 72-hour incident notification, periodic risk assessments, and annual certification of compliance by senior officers.