CASp key terms

A structured set of policies, processes, and roles an organization uses to identify, assess, respond to, and monitor risk to its information and systems, aligned with its mission and legal obligations.

The process of identifying threats and vulnerabilities, estimating the likelihood and impact of harm, and determining the resulting level of risk so it can be compared against tolerance.

The management decision to accept, avoid, mitigate, share, or transfer a risk, chosen after comparing assessed risk against the organization's tolerance and mission needs.

The amount of risk an organization's leadership is willing to accept in pursuit of its objectives, expressed in a way that guides decisions about whether controls are needed.

The person, group, or natural event with the intent and capability to exploit a vulnerability and cause harm to an organization's information or operations.

A weakness in a system, control, process, or facility that a threat source could exploit to gain unauthorized access or cause damage.

The defined set of system components, people, processes, and data that an authorization decision covers, separating what is in scope from connected systems outside it.

The process of assigning an impact level (low, moderate, or high) to a system based on the potential harm to confidentiality, integrity, and availability if it were compromised.

The recorded rating for a system's confidentiality, integrity, and availability, often written as a three-part expression such as moderate-moderate-low, that drives control selection.

The degree of harm-low, moderate, or high-that unauthorized disclosure, alteration, or loss of availability could cause to organizational operations, assets, individuals, or other organizations.

A category of data, such as personnel records or mission plans, whose sensitivity is analyzed during categorization to determine the appropriate protection level.

A pre-defined set of security controls and enhancements judged sufficient for a given impact level, used as a starting point that organizations tailor to their specific system.

The process of reviewing a baseline and adjusting it-adding, removing, or modifying controls-to fit a system's mission, environment, and assessed risk, with documented justification.

An alternative safeguard used in place of a required control when the original is not feasible, providing equivalent or acceptable protection for the same risk.

An additional or strengthened requirement attached to a base security control that increases its rigor, often selected for systems with higher impact levels or specific threats.

A safeguard managed by an organization or provider that supports multiple systems, allowing those systems to inherit the protection rather than implement it individually.

The practice by which a system relies on controls implemented and assessed elsewhere, such as enterprise identity management, and documents that reliance in its security plan.

A safeguard or countermeasure-technical, operational, or managerial-designed to protect the confidentiality, integrity, and availability of a system and its information.

The work of putting selected controls into operation, including configuring technology, writing procedures, assigning responsibility, and recording how each requirement is met.

The document describing a system's boundary, categorization, selected controls, how each is implemented, and the evidence supporting the authorization decision.

The disciplined process of establishing, tracking, and controlling changes to system settings and components so that approved configurations are maintained and unauthorized changes are caught.

The independent examination of whether implemented controls are in place, operating as intended, and producing the desired outcome, using methods such as interviews, observation, and testing.

The defined method and objects of examination used to evaluate a control, specifying what to inspect, interview, or test and what evidence demonstrates the control works.

Records, artifacts, observations, or test results collected during an assessment that demonstrate whether a control is implemented and operating effectively.

The document that records assessment findings, including which controls passed or failed, the severity of weaknesses, and recommendations for remediation.

A management record listing known weaknesses, the planned corrective actions, responsible parties, resources, and scheduled completion dates for resolving each finding.

The formal judgment by a senior official that a system may operate, based on the assessed risk, the security plan, and the organization's willingness to accept remaining risk.

The senior leader with the authority and accountability to accept the risk of operating a system and to grant, deny, or revoke its authorization to operate.

A time-limited approval allowing a system to run in production, conditioned on the assessed controls, accepted residual risk, and commitment to ongoing monitoring.

The risk that remains after controls have been applied and assessed, which the authorizing official must knowingly accept before a system is allowed to operate.

An ongoing program of monitoring controls, configurations, vulnerabilities, and risk indicators so that changes in security posture are detected and acted on between formal assessments.

The practice of maintaining an authorization through continuous monitoring and periodic review, rather than treating approval as a one-time event.

A connection between two systems, such as shared data exchange or network links, that requires documented agreements and security consideration because it extends risk across boundaries.

A safeguard implemented and assessed for one particular system rather than inherited from an organization-wide source, often because of unique mission or technical needs.