ACRM key terms

A person or group that intentionally seeks to compromise systems, data, or operations for money, ideology, espionage, or disruption. Understanding motives and capability helps organizations prioritize defenses and insurance exposure.

Malicious software that encrypts or steals data and demands payment to restore access or prevent disclosure. Modern incidents often combine encryption, data theft, and pressure tactics against victims and their customers.

A social engineering attack that tricks people into revealing credentials, approving payments, or opening malicious files through deceptive messages. It often serves as the initial access route for broader intrusions and fraud.

An intrusion that reaches a victim through a compromised vendor, software component, or service provider. Because trusted relationships are abused, these attacks can spread widely and are difficult to detect early.

A weakness in software, hardware, configuration, or process that an attacker could exploit. Vulnerabilities vary in severity and may be technical flaws, missing controls, or unsafe human workflows.

A previously unknown software flaw for which no vendor patch exists. Attackers can exploit it before defenders have warning, making detection difficult and response dependent on compensating controls.

A fraud scheme in which attackers impersonate executives, vendors, or colleagues to persuade employees to transfer funds or disclose sensitive information. It often relies on social engineering rather than malware.

Risk arising from employees, contractors, or partners who misuse authorized access, whether intentionally for harm or unintentionally through error. Controls include monitoring, least privilege, and clear policies.

The amount and type of cyber risk an organization is willing to accept while pursuing its objectives. It guides investment, control decisions, insurance purchasing, and escalation when exposures exceed stated tolerances.

A structured record of identified risks, their owners, likelihood, impact, controls, and treatment status. It supports prioritization, reporting, and tracking of remediation over time.

A quantitative risk analysis method that models risk as the probable frequency and magnitude of future loss. It separates asset, threat, vulnerability, and control factors to support defensible risk decisions.

The expected yearly financial loss from a risk, calculated by multiplying the estimated loss per event by the estimated number of events per year. It supports comparing controls and insurance options.

A graph showing the probability that losses will exceed different amounts in a given period. It helps decision-makers understand tail risk, set retention levels, and size insurance limits.

A method that explores plausible future cyber events and their consequences under stated assumptions. It helps identify dependencies, test resilience, and estimate financial or operational impacts.

The process of labeling information by sensitivity, value, and regulatory requirements so appropriate handling controls can be applied. It underpins access control, retention, encryption, and incident response decisions.

A specialty insurance contract that transfers financial losses from cyber events, such as data breaches, ransomware, network interruption, and liability claims. Coverage terms, exclusions, and conditions vary widely.

Insurance protection for the policyholder's own losses, including incident response costs, data restoration, business interruption, extortion payments, and notification expenses. It responds to direct financial harm from a covered event.

Coverage for claims alleging that the insured caused harm to others through a cyber event, such as data breach, privacy violation, or network security failure. It may include defense costs and damages.

The amount of loss an insured must bear before insurance responds, similar to a deductible. Higher retentions lower premium but increase the organization's retained financial exposure.

A coverage cap within a policy that limits payment for a specific loss type or category, such as ransomware or regulatory investigations. Sublimits may be lower than the overall policy limit.

A policy condition under which coverage applies to claims first made against the insured during the policy period, regardless of when the incident occurred, subject to any retroactive date.

A policy provision excluding losses caused by declared or sometimes undeclared war, hostilities, or state-sponsored attacks. Its scope is heavily negotiated because attribution and state involvement are often disputed.

Insurance that reimburses lost income and extra expenses when a covered cyber event disrupts operations. It typically requires proof of loss, a waiting period, and defined restoration assumptions.

Coverage for costs related to extortion threats, such as ransomware demands, negotiation services, and sometimes payment itself where lawful. It often carries sublimits and strict consent conditions.

A layered security strategy using multiple independent controls so failure of one does not expose the whole environment. Layers may include identity, network, endpoint, data, monitoring, and recovery controls.

The practice of granting users and systems only the access needed for their tasks and only for as long as needed. It limits damage from compromised accounts and insider misuse.

An access control requiring two or more independent evidence types, such as a password plus a device or biometric. It reduces account takeover risk from stolen credentials and phishing.

A repeatable process for identifying, testing, deploying, and verifying software updates that fix vulnerabilities. Effective programs prioritize internet-facing and high-impact systems while managing operational risk.

A documented set of roles, steps, and communications for detecting, containing, eradicating, and recovering from cyber incidents. It should be tested, maintained, and aligned with legal and business obligations.

A discussion-based simulation in which participants walk through a hypothetical incident and make decisions. It tests plans, clarifies roles, and reveals gaps without disrupting live systems.

A backup copy that cannot be altered or deleted during a defined retention period, even by an attacker with administrative access. It supports recovery from ransomware and destructive incidents.

A legal requirement to inform regulators, affected individuals, or other parties about a data breach within specified timeframes. Triggers, content, and penalties vary by jurisdiction and data type.

The European Union's data protection regulation governing personal data processing, security, breach notification, and individual rights. It imposes significant fines and applies broadly to organizations handling EU residents' data.

A United States law protecting health information through privacy and security rules, including breach notification requirements. Covered entities and business associates face civil and criminal penalties for violations.

The significance of an event or fact to reasonable investors or decision-makers. In cyber disclosure and securities contexts, materiality determines whether and when information must be reported.

A process requiring preservation of documents and data relevant to anticipated litigation, investigation, or regulatory action. It suspends routine deletion and must be communicated and monitored.

Documentation tracking who collected, handled, and stored evidence, and when, to preserve its integrity. It is important for forensic investigations, legal proceedings, and regulatory inquiries.