CAP (ABRET) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk treatment options

The four accepted responses to risk: mitigate (apply controls), transfer (insurance or contract), avoid (stop the activity), and accept (documented sign-off by an accountable authority with rationale and expiry).

Inherent versus residual risk

Inherent risk is scored before controls are applied; residual risk is scored after controls. The gap demonstrates control value, and residual risk is what an authorizing official formally accepts.

NIST SP 800-39 tiers

A three-tier risk model: Tier 1 organization, Tier 2 mission and business processes, Tier 3 information systems. Governance and risk tolerance sit at Tier 1; control implementation and assessment occur at Tier 3.

Segregation of duties

A governance principle that the person implementing a control should not be its sole assessor. Independent review preserves objectivity and prevents self-attestation from masking deficiencies.

Key risk indicators

Leading metrics that signal rising risk before loss occurs, such as age of open critical findings or patch latency. They are reported alongside trailing performance metrics to leadership on a fixed cadence.

Authorization boundary

The documented line separating what is inside the system (hardware, software, firmware, data flows) from what is outside. Anything crossing it is an interconnection requiring formal agreement.

FIPS 199 categorization

Rates confidentiality, integrity, and availability individually as low, moderate, or high. The highest single rating (high-water mark) sets the system's overall impact level and drives baseline rigor.

Inherited controls

Controls provided by a common provider such as a cloud platform or shared service. The system inherits the protection but must still document and verify that inheritance in its security plan.

Interconnection security agreement

A formal document stating what data two connected systems exchange and which controls each party applies. It converts a boundary gap into an accountable, auditable arrangement.

Data flow scoping

Mapping where sensitive data is stored, processed, and transmitted, including backups and archives. Scope is incomplete unless all three states and all copies are accounted for.

NIST CSF functions

The Cybersecurity Framework organizes outcomes into Identify, Protect, Detect, Respond, Recover, and Govern. It is outcome-oriented and often used as a program umbrella above a control catalog.

NIST SP 800-53 purpose

A comprehensive security and privacy control catalog organized into families such as AC, AU, CM, IA, RA, SC, SI, and PT. SP 800-53B supplies baseline sets by impact level.

Control tailoring

Adjusting a baseline through scoping (removing inapplicable controls), parameterization (setting organization-defined values), and supplementation (adding controls for unique risk). Each decision requires documented justification.

Privacy control selection

Privacy controls address notice, consent, minimization, data quality, and monitoring. They are selected alongside security controls using the NIST Privacy Framework and PT family, not appended afterward.

Baseline approval

A formal governance action in which the authorizing official approves the selected control baseline, tailoring decisions, and accepted residual risk before implementation begins.

Framework mapping limits

Cross-framework mappings such as ISO/IEC 27001 Annex A to SP 800-53 are rarely one-to-one. Partial and many-to-many relationships must be documented rather than assumed equivalent.

Control implementation statement

The security plan entry describing how a control is met: who implements it, the mechanism, its architectural location, and the evidence produced. Stating that a control exists is insufficient.

Hybrid control

A control with both a provider-supplied component and a local component. Both portions must be described and evidenced separately, since inheritance covers only the provider's part.

Compensating control

Applied when the primary control is infeasible. It must provide equivalent protection, carry documented rationale, and be reassessed on the same cadence as the control it replaces.

Configuration baselines

Hardening standards such as CIS Benchmarks or DISA STIGs that operationalize configuration management controls. Deviations require documented exceptions with risk acceptance and remediation dates.

Evidence-driven implementation

A control is only credibly implemented if logs, tickets, configuration exports, or screenshots can demonstrate it. Without producible evidence, the control fails audit even if technically present.

Assessment methods

Examine (review documents and configurations), interview (query personnel), and test (exercise the control). Robust assessments combine methods rather than relying on document review alone.

Assessment sampling

For controls that operate repeatedly, assess a sample sized to population and frequency. A single instance proves existence but not consistent operation across the assessment period.

Finding versus risk

A finding is a control deficiency; the risk is the potential impact if it persists or is exploited. Reports should present both and name the accountable risk owner.

Continuous monitoring

Per NIST SP 800-137, ongoing metrics and automated feeds replace point-in-time assurance. It is itself a control and does not eliminate the need for periodic independent assessment.

Assessment evidence attributes

Evidence must be dated, attributable to a person or system, tied to a specific control, and drawn from within the assessment window. Undated or out-of-window evidence proves nothing about current operation.

Plan of action and milestones

The POA&M tracks open weaknesses with description, severity, owner, resources, milestones, and completion date. An entry lacking a target date is itself an audit exception.

Compliance status categories

Typically compliant, compliant with exceptions, and non-compliant. Every exception must reference an approved risk acceptance or compensating control, with an owner and review date.

Attestation versus certification

An attestation is a management assertion, often with an independent opinion such as SOC 2. A certification is a formal third-party credential such as ISO/IEC 27001. They carry different evidentiary weight.

Re-authorization triggers

Reassessment is required at a defined interval, commonly annual for high-impact systems, and upon significant change: new data types, new interconnections, new hosting model, or a control-affecting breach.

Exception management lifecycle

Every exception carries an owner, justification, compensating control, expiry, and review date. Expired exceptions automatically convert into findings, preventing indefinite risk carryover.

Remediation severity SLAs

Tiered timelines by severity, for example critical within 30 days and high within 90. Missed SLAs escalate to the risk owner rather than silently rolling forward to the next cycle.