CCRTS flashcards
CCRTS · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Cyber resilience definition
- The ability to anticipate, withstand, recover from, and adapt to adverse cyber conditions, measured by reduced outage duration and data loss rather than by control counts.
- Risk appetite statement
- A governance document defining how much risk the organization is willing to accept, expressed in qualitative or quantitative thresholds that guide treatment decisions and escalation.
- System criticality tiering
- Classifying systems by business impact so that recovery objectives, control strength, and test frequency scale with tier, typically Tier 1 through Tier 3.
- Recovery time objective
- The maximum acceptable elapsed time to restore a process or system after disruption. It must not exceed the maximum tolerable downtime for that process.
- Recovery point objective
- The maximum tolerable amount of data loss, expressed as time. It determines backup frequency and whether replication must be synchronous or asynchronous.
- Maximum tolerable downtime
- The total time a process can be unavailable before impact becomes unacceptable. RTO plus work recovery time must fit inside this limit.
- Work recovery time
- The period after technical restoration needed to verify data, restart business processing, and clear backlogs, so total RTO equals technical recovery plus this time.
- Business impact analysis
- A structured assessment of process dependencies and the financial, operational, regulatory, and reputational impact of outage durations, used to derive recovery objectives.
- 3-2-1-1-0 backup rule
- Keep three copies of data, on two media types, with one offsite, one immutable or offline, and zero errors confirmed through restore testing.
- Immutable backup storage
- Storage configured so written data cannot be altered or deleted before retention expires. Compliance mode prevents even administrators from early deletion.
- Air-gapped backup copy
- A backup copy with no standing network connection to production, so malware or stolen credentials cannot reach and encrypt or delete it.
- Replication versus backup
- Replication copies current state continuously, including corruption and deletions. Backup preserves prior point-in-time copies, so replication alone is not a recoverable backup.
- Synthetic full backup
- A full backup image assembled from an earlier full plus subsequent incremental backups, reducing production load while providing a complete restore point.
- NIST incident response lifecycle
- Four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, as described in NIST SP 800-61.
- Incident commander role
- The single authority who sets priorities, approves containment decisions, and coordinates the response team. The commander does not perform hands-on troubleshooting.
- Breach notification clock
- A regulatory deadline to notify authorities or affected parties after a confirmed breach. Under GDPR it is 72 hours from awareness, with contractual rules sometimes shorter.
- Order of volatility
- The forensic principle of collecting the most perishable evidence first: processor state and memory, then network connections, then disk, then logs and archives.
- Chain of custody
- A documented record of who collected, handled, and transferred each piece of evidence, with timestamps and hashes proving it was not altered.
- Disaster declaration authority
- The named role empowered to activate the disaster recovery plan, together with objective triggers such as site loss beyond a stated duration.
- Warm recovery site
- An alternate facility with power, network, and some pre-installed equipment but no live data, requiring restore from backup before processing can resume.
- Recovery runbook
- A step-by-step procedure for restoring a specific system, including prerequisites, commands, expected outputs, and verification checks confirming successful recovery.
- Return-to-normal criteria
- Predefined conditions and reconciliation steps, including data synchronization and business sign-off, required before leaving the alternate operating mode.
- Double extortion
- A ransomware tactic combining encryption with threatened release of stolen data, so paying does not prevent disclosure and exfiltrated data must be assumed public.
- Recovery plane protection
- Treating backup infrastructure, identity systems, and hypervisors as top-tier assets with separate credentials, network isolation, and immutable storage.
- Ransomware encryption indicator
- Detection signals such as mass file renames, entropy spikes, backup retention changes, or disabled security agents that suggest active destructive activity.
- Wiper malware
- Destructive code that erases or overwrites data and boot records without offering recovery, often targeting backups and identity systems before production.
- Shared responsibility model
- The division where a cloud provider secures the underlying infrastructure while the customer remains responsible for data, identity configuration, and backup.
- Fourth-party risk
- Risk arising from a vendor's own subcontractors and dependencies, which can disrupt service even when the primary provider's controls appear adequate.
- Concentration risk
- Exposure created when multiple critical services depend on one provider, region, identity system, or DNS service that could fail all at once.
- Tabletop exercise
- A discussion-based session where participants walk through a scenario and injects against the plan, revealing decision, communication, and dependency gaps without touching production.
- Full interruption test
- The most rigorous exercise, actually shutting down a primary system or site to validate real failover and recovery, requiring change control and abort criteria.
- After-action report
- A dated document recording exercise or incident objectives, observed timeline, gaps found, metrics versus targets, and corrective actions with owners and due dates.
- Blameless post-incident review
- A structured review focused on timeline facts, contributing factors, and control gaps rather than individual fault, producing prioritized corrective actions that feed back into plans.