C-ACYFSW key terms

The ability of an organization to anticipate, withstand, absorb, recover from, and adapt to cyber disruptions so that critical services keep functioning during and after an attack.

The amount and type of cyber risk leadership is willing to accept in pursuit of business goals, expressed as a statement that guides decisions about controls, spending, and exception approvals.

The acceptable variation around the risk appetite, giving concrete thresholds or limits that individual systems, teams, or processes may operate within without escalation to senior management.

The risk that remains after existing controls and mitigations are applied, which must be compared against tolerance and either accepted, transferred, further treated, or avoided.

A structured method of identifying assets, entry points, adversaries, and attack paths early in design so that controls can be built in before systems are deployed.

The full set of points where an adversary could try to enter or influence a system, including exposed services, credentials, APIs, endpoints, supply chain links, and human users.

Layering independent preventive, detective, and corrective controls so that failure of any single safeguard does not lead directly to compromise of critical assets.

A design approach that removes implicit trust based on network location and instead verifies every user, device, and request continuously using identity, device health, and policy signals.

Granting each user, service, or process only the permissions needed to perform its assigned task, for only as long as needed, to limit damage from misuse or compromise.

Controls and tooling that vault, rotate, monitor, and approve use of high-power accounts such as administrators and service accounts, reducing the impact of stolen credentials.

Requiring two or more independent evidence types, such as a password plus a hardware token, before granting access, so a single stolen secret is not enough to log in.

An arrangement where a trusted identity provider asserts a user's identity to other applications using standards like SAML or OIDC, so credentials are not duplicated across systems.

Assigning labels such as public, internal, confidential, or restricted to information so handling, storage, and access rules can be applied consistently based on sensitivity.

Technology and policy that detect and block unauthorized movement of sensitive data across endpoints, email, web, and cloud channels using content and context inspection.

Protecting stored data by converting it to ciphertext with keys managed separately, so stolen disks, backups, or cloud storage objects are unreadable without the key.

The lifecycle of cryptographic keys, including generation, distribution, rotation, storage, and destruction, performed in controlled systems so encryption remains trustworthy.

The policies, roles, and certificate authority systems that issue, validate, renew, and revoke digital certificates used to bind public keys to verified identities.

A platform that collects, normalizes, correlates, and alerts on log events from many sources, giving analysts a central view for detection and investigation.

Agent-based monitoring on hosts that records process, file, and network behavior, enabling detection of malicious activity and remote containment of compromised devices.

A staffed function that monitors alerts, triages incidents, and coordinates response around the clock or during defined coverage windows using defined playbooks and escalation paths.

Dividing a network into small zones with policy-controlled traffic between workloads, so lateral movement from one compromised host is blocked by default.

Observable evidence such as malicious file hashes, domains, or registry keys that suggests a system has already been breached, used for detection and hunting.

A documented set of roles, phases, communication paths, and decision criteria that guides an organization from detection through containment, eradication, recovery, and lessons learned.

Procedures for keeping or restoring critical business functions during disruption, covering people, facilities, suppliers, and manual workarounds alongside technology recovery.

The technical component of continuity planning that specifies how systems, data, and infrastructure are restored, including backups, alternate sites, and restoration testing.

The maximum acceptable elapsed time to restore a process or system after disruption, which drives backup design, staffing, and continuity strategy choices.

The maximum acceptable amount of data loss measured in time, determining how frequently backups or replication must occur for each system.

A program for identifying, assessing, contracting with, and monitoring vendors and partners whose access or services could affect the organization's security posture.

Compromise introduced through a trusted supplier, such as malicious code in an update, a breached service provider, or tampered hardware, bypassing direct perimeter defenses.

A machine-readable inventory of components and dependencies in a software product, used to identify exposure when a library vulnerability is disclosed.

A repeating cycle of discovering assets, scanning for weaknesses, prioritizing by exploitability and business impact, remediating, and verifying that fixes worked.

The controlled process of testing, approving, deploying, and verifying software updates across systems within risk-based timeframes tied to severity.

An approved, documented set of settings for a system or device, against which drift can be detected and corrected to keep hardened configurations in place.

Recurring education that builds employee knowledge of threats and safe behavior, reinforced with simulations and metrics rather than a single annual presentation.

Authorized fake messages sent to employees to measure reporting and click behavior, followed by targeted coaching that improves recognition of real attacks.

Risk from employees or contractors who misuse legitimate access, whether maliciously or accidentally, requiring monitoring, segregation of duties, and offboarding controls.

Records, logs, screenshots, or reports that demonstrate a control operated as described during a defined period, gathered to support audits and compliance attestations.

Loss of sensitive information when employees paste proprietary content into external AI tools, or when model outputs expose data used in training or retrieval.

Use of artificial intelligence tools and services without organizational approval or visibility, creating unmanaged data exposure and compliance risk outside normal governance.