CAP (ABRET) key terms

The leadership structure, decision rights, and accountability arrangements an organization uses to direct and oversee how security and privacy objectives are set, resourced, monitored, and enforced across the enterprise.

The senior executives or board-level group with authority to approve security and privacy strategy, accept residual risk, and hold management accountable for outcomes on behalf of stakeholders.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed as a statement or thresholds that guide control selection and risk treatment decisions.

The acceptable variation around a specific risk objective, often expressed as quantitative limits or bands that determine when escalation or corrective action is required.

An accountability structure in which operational management owns risk, an independent risk and compliance function oversees it, and internal audit provides independent assurance to the governing body.

The documented set of policies, roles, processes, monitoring activities, and reporting mechanisms an organization maintains to meet its legal, regulatory, contractual, and internal security and privacy obligations.

A specific requirement imposed by law, regulation, contract, standard, or internal policy that the organization must satisfy and be able to demonstrate satisfaction of.

The practice of tracing each external requirement to the internal controls and policies that address it, so the organization can show coverage and detect gaps or duplication.

The coordinated activities used to identify, analyze, evaluate, treat, monitor, and communicate risk so that it stays within the organization's stated appetite and supports its objectives.

A structured process that identifies threats and vulnerabilities, estimates likelihood and impact, and determines which risks require treatment or acceptance.

A maintained record of identified risks, each with an owner, rating, treatment decision, and status, used to track and report risk posture over time.

The estimated probability that a threat event will exploit a vulnerability and produce a loss within a defined period, given existing conditions and controls.

The magnitude of harm to operations, assets, individuals, or mission if a risk event occurs, often rated on financial, reputational, legal, or safety dimensions.

The level of risk that exists before any controls are applied, used as a baseline to judge how much risk reduction controls actually deliver.

The risk remaining after controls and other treatments have been applied, which must be compared with risk appetite and formally accepted where it exceeds tolerance.

The selection and application of options such as mitigating with controls, transferring, avoiding, or accepting a risk, together with planning and tracking of the chosen response.

A documented decision by an authorized owner to retain a risk without further treatment, typically recorded with rationale, compensating measures, and an expiry or review date.

The defined edge of the system under consideration, specifying which components, data flows, users, interfaces, and environments are inside the assessment scope and which are outside.

The documented description of what the compliance effort covers, including business processes, technology, locations, and third parties, agreed before control selection begins.

The set of system components that are authorized to operate together under a single approval, including connected components that process, store, or transmit the protected data.

A visual model showing where sensitive data originates, how it moves between components and parties, where it is stored, and where it leaves the defined boundary.

The assignment of sensitivity labels to information assets so that handling, access, retention, and protection requirements can be applied consistently according to risk.

A documented connection between the system in scope and an external system or provider, including the security and privacy responsibilities each party retains.

A recorded judgment about whether a component, location, or service is included in or excluded from the assessment, with the rationale and approver noted.

A structured catalogue of security and privacy controls, organized by domain or family, that provides common language and a reference set for selecting safeguards.

A starting set of controls chosen for a defined impact level or risk profile, from which organization-specific additions and removals are then made through tailoring.

The documented adjustment of a baseline, adding, strengthening, weakening, or removing controls to fit the system's mission, risk, and operating environment, with justification recorded.

A pre-tailored set of control specifications for a community, technology, or regulatory context that can be applied on top of a baseline to speed consistent selection.

A mapping that shows how requirements in one framework correspond to those in another, supporting reuse of evidence and identification of coverage gaps.

The documented linkage between a specific control and the requirements, risks, or policies it addresses, enabling traceability from obligation to safeguard to evidence.

A safeguard or countermeasure, whether technical, administrative, or physical, designed to reduce risk or satisfy a requirement, and typically expressed as a statement with assessment criteria.

A description of how a selected control is actually carried out in the system, including the mechanisms used, responsible parties, and the evidence produced.

An alternative safeguard used when the specified control cannot be applied as written, providing equivalent or comparable risk reduction that must be justified and assessed.

The recorded state of a control, such as implemented, partially implemented, planned, alternative, or not applicable, which drives remediation and reporting priorities.

A tracked record of known control weaknesses with the remediation steps, responsible owner, resources, and target dates needed to close each gap.

The process of examining evidence and testing controls to determine whether they are designed and operating as intended against defined criteria.

The technique used to gather evidence, such as interviewing personnel, examining documents and configurations, or testing operation through observation or automated checks.

The artifacts, observations, and records collected during an assessment that support a conclusion about whether a control is implemented and effective.

The degree to which a control, as designed and operated, achieves its intended risk reduction or compliance objective over the period examined.

A time-ordered record of activity and changes that allows an assessor to reconstruct what happened, who acted, and whether controls operated throughout the period.

The state in which a system meets its applicable security and privacy requirements, supported by an authorization decision and documented accepted residual risk.

The formal determination by an accountable official that a system may operate, based on assessment results, residual risk, and planned remediations.

The ongoing collection and analysis of control and risk data so that changes in posture are detected and acted on between formal assessments.

A maintained approval to operate that is refreshed through continuous monitoring and periodic review rather than relying solely on a one-time assessment.

The controlled process for reviewing, approving, and recording modifications to systems or processes so that compliance impact is assessed before and after change.

The approved and documented settings for a system's components, used as the reference against which drift and unauthorized change are detected.

Scheduled and event-driven checks that confirm obligations continue to be met, producing metrics and findings that feed governance reporting and remediation.

The corrective work undertaken to close an identified gap or weakness, tracked to completion and verified so the finding can be formally closed.

The risk introduced by vendors, service providers, and partners whose access to data or systems can affect the organization's compliance posture and must be assessed and monitored.

An independent function that evaluates the design and operation of controls and governance, reporting assurance findings to the governing body.