ASIS APP key terms

Anything of value to an organization that requires protection, including people, property, information, reputation, and business processes. Identifying assets is the starting point for any security program because controls are chosen to protect specific things.

Any person, event, or condition with the potential to cause harm to an asset. Threats may be intentional, accidental, or natural, and are assessed separately from how exposed an asset happens to be.

A weakness in a control, process, design, or condition that a threat could exploit to cause loss. Vulnerabilities exist independently of whether anyone is currently trying to exploit them.

The likelihood that a threat will exploit a vulnerability and produce a measurable negative effect on an asset. Risk combines probability and consequence and is the central quantity security managers try to reduce.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, stated at the leadership level. It guides how much mitigation is enough and which residual risks can be tolerated.

The acceptable variation in risk exposure around the organization's appetite, often applied to specific activities or units. Tolerance translates a broad appetite statement into practical thresholds for day-to-day decisions.

The risk that remains after controls and countermeasures have been applied. It must be documented and formally accepted by an accountable manager rather than assumed to be zero.

A structured process of identifying assets and threats, evaluating vulnerabilities, and estimating likelihood and consequence to prioritize action. Results drive which controls are funded and where effort is concentrated.

Ranking risk using descriptive scales such as high, medium, and low based on judgment and experience. It is fast and useful when numerical data are scarce, but results depend heavily on the assessor's expertise.

Expressing risk in numeric terms, typically as annualized loss expectancy derived from asset value, exposure factor, and annual rate of occurrence. It supports cost-benefit comparisons but requires reliable historical data.

The expected yearly monetary loss from a specific threat, calculated as single loss expectancy multiplied by the annualized rate of occurrence. It helps compare the cost of a control against the losses it prevents.

The expected monetary loss from one occurrence of a threat event, calculated as asset value multiplied by exposure factor. It represents the impact side of a risk calculation before frequency is considered.

A living record listing identified risks, their owners, assessed ratings, planned treatments, and status. It provides traceability and supports reporting to governance bodies over time.

Action taken to reduce the likelihood or impact of a risk, such as adding controls, changing procedures, or redesigning a process. Mitigation is one of several treatment options alongside avoidance, transfer, and acceptance.

Shifting the financial consequence of a risk to another party, most commonly through insurance or contractual clauses. The underlying threat and operational responsibility usually remain with the original organization.

A specific safeguard or control implemented to prevent, detect, deter, or respond to a threat. Countermeasures are selected based on assessed risk and should be proportionate to the value of the asset protected.

Layering multiple independent controls so that failure of one does not expose the asset completely. Layers typically span deterrence, detection, delay, and response, forcing an adversary to defeat several barriers.

Designing the physical environment to reduce crime by shaping natural surveillance, access, territorial reinforcement, and maintenance. Often abbreviated CPTED, it applies architecture and landscaping as security tools.

Designing spaces so that legitimate users can easily see what is happening, increasing the chance that intruders or wrongdoing are noticed. Clear sightlines, lighting, and window placement are common techniques.

Using physical design elements such as fences, signage, landscaping, and surface changes to mark boundaries between public and private space. It encourages legitimate users to feel ownership and discourages intruders.

The set of policies, procedures, and technologies that determine who or what may enter a protected area or use a resource. It spans physical entry points as well as logical systems and is enforced at the point of entry.

The process of verifying that a claimed identity is genuine, using something the subject knows, has, or is. It answers who someone is before any decision about what they may do.

The process of deciding which resources or areas an authenticated subject may use, based on policy and assigned privileges. It answers what an identified person is permitted to do.

Granting individuals only the access needed to perform their assigned duties, for only as long as needed. It limits the damage a compromised or misused account can cause.

A principle limiting access to information to those whose work genuinely requires it, regardless of rank or clearance. It complements least privilege by focusing on information rather than systems.

Ensuring information is disclosed only to authorized people, processes, or systems. It is protected through classification, encryption, access controls, and handling procedures.

Ensuring information and systems remain accurate, complete, and unaltered except through authorized change. Controls include checksums, audit trails, version control, and segregation of duties.

Ensuring systems and information are accessible to authorized users when needed. It depends on redundancy, maintenance, backup, and protection against disruption such as power loss or attack.

A management-approved statement of intent that sets mandatory rules and responsibilities for protecting assets. Policies are high-level and durable, while standards, procedures, and guidelines provide detail beneath them.

A mandatory requirement that specifies how a policy must be implemented, such as a required encryption algorithm or badge format. Standards are more specific than policies but less detailed than procedures.

A step-by-step description of how to carry out a task in accordance with policy and standards. Procedures are operational documents that staff follow to produce consistent, repeatable results.

The structures, roles, and decision processes through which an organization directs and oversees its security program. Good governance assigns accountability, sets direction, and ensures oversight without managing daily operations.

The reasonable, documented effort an organization takes to identify and address risks before harm occurs. It demonstrates that management acted prudently and supports a defense against claims of negligence.

The ongoing practice of acting reasonably to protect assets once risks are known, such as maintaining controls and correcting deficiencies. Diligence is the assessment; care is the continuing response.

Failure to exercise the degree of care a reasonable person or organization would exercise under similar circumstances. In security, it often turns on whether known risks were left unaddressed.

A measure comparing the cost of a control against the losses it is expected to prevent, expressed as a ratio or percentage. It helps justify spending and compare competing security proposals.

The capability to keep critical functions running, or restore them quickly, during and after a disruption. It is planned broadly across the organization rather than limited to information systems.

The plans and resources focused on restoring technology infrastructure and data after a major outage or disaster. It is a subset of business continuity, narrower in scope and more technical.

Measures that protect people, facilities, and equipment from harm, intrusion, and environmental damage. It includes barriers, lighting, access control, surveillance, and guard operations.

Applying successive rings of protection from the property perimeter inward to the most sensitive assets. An intruder must defeat several different barriers, each of which buys detection and response time.

The outermost boundary controls of a site, such as fences, gates, bollards, lighting, and signage, intended to deter and delay unauthorized entry. It is the first layer in a layered physical design.

Verifying identity using two or more independent types of evidence, such as a password plus a hardware token. Combining factors from different categories makes impersonation substantially harder.