C-ACYFSW cheat sheet

Cyber resilience = availability + integrity + confidentiality maintained through disruption; measured by recovery time (RTO) and maximum tolerable data loss (RPO).

Governance hierarchy: board-approved policy > standards (mandatory, measurable) > procedures (step-by-step) > guidelines (recommended). Policy states intent; standards state requirements.

RACI assigns one Accountable per activity; multiple Responsible parties are permitted; Consulted is two-way, Informed is one-way.

Three lines model: line 1 owns and operates controls, line 2 sets frameworks and monitors, line 3 (internal audit) provides independent assurance to the board.

Risk appetite is the amount of risk the organization accepts in pursuit of objectives; risk tolerance is the acceptable deviation around that appetite for a specific category.

Resilience frameworks: NIST CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond, Recover; ISO 22301 covers business continuity management systems.

Key performance indicator measures control effectiveness (e.g., patch latency); key risk indicator measures exposure trend (e.g., rising unpatched critical hosts).

Materiality thresholds determine escalation: incidents crossing financial, regulatory, or data-volume thresholds require executive and board notification within defined hours.

Qualitative risk = likelihood x impact on a defined scale; quantitative risk uses annualized loss expectancy: ALE = single loss expectancy (SLE) x annualized rate of occurrence (ARO).

Risk treatment options are mitigate, transfer, avoid, and accept; residual risk is what remains after treatment and must be formally accepted by a risk owner.

Threat modeling with STRIDE maps spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege to trust boundaries in a data-flow diagram.

Attack surface analysis enumerates entry points; kill-chain and MITRE ATT&CK mapping link observed tactics to detection coverage gaps.

Threat intelligence tiers: strategic (executive trends), operational (campaign context), tactical (TTPs), technical (indicators such as hashes and domains).

Vulnerability scoring uses CVSS base, temporal, and environmental metrics; exploitability plus business context determines remediation priority, not base score alone.

Risk register fields: asset, threat, vulnerability, likelihood, impact, inherent risk, controls, residual risk, owner, treatment plan, review date.

Bow-tie analysis separates threats and preventive barriers from consequences and recovery barriers around a single top event.

Defense in depth layers preventive, detective, and corrective controls so no single failure exposes the asset; zero trust replaces implicit network trust with per-request verification.

Security control types: preventive, detective, corrective, deterrent, compensating; categories are technical, managerial, and operational.

Shared responsibility: infrastructure-as-a-service leaves patching of guest OS and data to the customer; SaaS shifts most operational controls to the provider.

Cryptography rules: symmetric (AES) is fast for bulk data, asymmetric (RSA, ECC) handles key exchange and signatures; hash functions are one-way and must be collision-resistant.

TLS provides confidentiality and integrity in transit; certificates bind identity to a public key and must be validated against a trusted chain and revocation status.

Data states: at rest (encryption, tokenization, masking), in transit (TLS, IPsec), in use (confidential computing, secure enclaves).

Fail-safe defaults and least privilege are design principles; separation of duties prevents one identity from completing a sensitive transaction alone.

Reference architectures: SABSA for business-driven security architecture, TOGAF for enterprise architecture, NIST SP 800-53 and 800-207 for control and zero-trust baselines.

Authentication factors: something you know, have, or are; multifactor requires at least two distinct factor types, not two instances of one type.

Access models: RBAC grants by role, ABAC evaluates attributes and policy, MAC enforces labels; least privilege and need-to-know constrain every grant.

Federation standards: SAML for browser single sign-on with XML assertions, OAuth 2.0 for delegated authorization, OpenID Connect adds an identity layer on OAuth.

Privileged access management requires vaulting, session recording, just-in-time elevation, and periodic recertification of standing admin rights.

Identity lifecycle stages: joiner, mover, leaver; access must be revoked at termination and re-baselined on role change.

Data classification tiers (public, internal, confidential, restricted) drive handling, retention, and encryption requirements.

Data loss prevention inspects content in motion, at rest, and in use; tokenization replaces sensitive values with non-reversible surrogates, unlike encryption.

Privacy principles: purpose limitation, data minimization, storage limitation, and lawful basis; subject rights include access, correction, and erasure.

Network segmentation limits lateral movement; a demilitarized zone hosts internet-facing services separate from internal zones.

Firewall rule hygiene: default deny, explicit allow, documented business justification, and periodic recertification of rules.

IDS detects and alerts passively; IPS sits inline and can block. Signature detection catches known patterns; anomaly detection baselines normal behavior.

Endpoint detection and response collects process, file, and network telemetry, enables hunting, and supports isolation of a compromised host.

Log sources for monitoring: endpoint, network flow, DNS, identity provider, cloud control plane, and application logs; time synchronization is required for correlation.

SIEM correlates and alerts; SOAR automates response playbooks. Detection engineering tunes rules to reduce false positives and cover ATT&CK techniques.

Patch management cycle: inventory, assess, prioritize by exploitability and exposure, test, deploy, verify; compensating controls cover unpatchable assets.

Email defenses: SPF authorizes sending hosts, DKIM cryptographically signs messages, DMARC aligns SPF/DKIM with the visible From domain and sets policy.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Containment choices: isolate the host, block the indicator, segment the network, or power down; powering off can destroy volatile evidence such as memory-resident malware.

Order of volatility for evidence collection: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media.

Chain of custody documents who handled evidence, when, and why; forensic images are hashed to prove integrity.

Severity classification drives escalation; declare an incident when scope or business impact crosses predefined thresholds.

Communication during incidents: single incident commander, predefined stakeholder cadence, legal and regulatory notification timelines, and a documented crisis channel.

Recovery validates restoration against RTO and RPO, confirms backups are clean before restore, and monitors for re-infection.

Post-incident review produces root cause, control gaps, and tracked corrective actions with owners and due dates.

Vendor due diligence tiers by criticality: data sensitivity, system access, and business dependency determine assessment depth and frequency.

Contract clauses to require: right to audit, breach notification timelines, data ownership and return, subcontractor disclosure, and termination assistance.

Concentration risk arises when many services depend on one provider or one shared component; map fourth parties and single points of failure.

Ongoing monitoring uses security ratings, attestation currency (SOC 2 Type II, ISO 27001), and periodic reassessment rather than one-time onboarding.

Software supply chain controls: software bill of materials, signed artifacts, dependency scanning, and provenance verification.

Fourth-party risk is risk introduced by a vendor's own suppliers; flow-down obligations must be contractually enforced.

Offboarding a vendor requires access revocation, data return or destruction with certification, and archival of records per retention policy.

Regulatory expectations increasingly require inventory of critical third parties and tested exit or substitution plans.

Control evidence must be current, attributable, and reproducible; an auditor samples evidence to test design and operating effectiveness.

Frameworks vs regulations: frameworks (NIST, ISO, CIS) are voluntary guidance; regulations (GDPR, HIPAA, PCI DSS) are enforceable with penalties.

Audit types: internal (first party), external certification (second party or accredited third party), and independent assessment; findings are rated by severity.

Compliance mapping crosswalks one control to multiple frameworks to avoid duplicate evidence collection.

Security awareness metrics: phishing simulation click rate, report rate, and time to report; completion rate alone does not demonstrate behavior change.

Training must be role-based: developers need secure coding, finance needs payment fraud awareness, executives need governance and decision duties.

Policy exceptions require documented risk acceptance, an expiry date, compensating controls, and approval at the appropriate authority level.

Record retention schedules align legal, regulatory, and operational needs; evidence must survive the retention window to support future audits.

AI/ML risk categories: data poisoning, model evasion, prompt injection, model theft, and hallucination; governance requires documented model inventory and human oversight.

Generative AI usage controls: prohibit sensitive data in prompts, classify approved tools, log usage, and validate outputs before operational use.

Cloud-native risk shifts to identity: misconfigured storage, over-privileged service accounts, and exposed APIs are leading breach causes.

IoT and OT constraints: long patch cycles and availability priority mean compensating network controls and segmentation replace endpoint agents.

Workforce security: role-based competency models, succession planning for scarce skills, and cross-training reduce single-person dependency.

Insider threat programs combine least privilege, behavior analytics, and clear acceptable-use policy with proportional monitoring.

Remote and hybrid work controls: device posture checks, conditional access, and endpoint encryption rather than perimeter reliance.

Emerging tech adoption gate: threat model the technology, define acceptable use, assign ownership, and set review intervals before production use.