CCSM Elite R82 key terms

The overall design that describes how security controls, processes, and technologies are arranged to protect an organization's information assets. It aligns technical implementation with business goals, risk tolerance, and compliance obligations across the entire enterprise.

An abstract security component that mediates every access request between subjects and objects, is always invoked, and is tamper-proof. Real implementations approximate these properties through a security kernel embedded in the trusted computing base.

The complete set of hardware, firmware, and software components that must be correct for a system's security policy to be enforced. A smaller TCB reduces the attack surface and is easier to verify formally.

The hardware and software elements of the trusted computing base that implement the reference monitor concept. It isolates security-critical functions so that all access mediation occurs in a small, verifiable, and protected code path.

A layered strategy that places multiple independent and overlapping controls across people, process, and technology so that failure of any single control does not expose the asset. Layers typically span perimeter, network, host, application, and data tiers.

A demarcation where data, identity assertions, or control passes between components with different levels of trust. Security architects place validation and mediation at these boundaries because that is where privilege and assurance assumptions change.

A design philosophy that treats no network location as inherently trusted and requires continuous verification of identity, device posture, and context before granting each resource access. It replaces perimeter-only defenses with per-request authorization and least-privilege enforcement.

The component that evaluates access requests against policy and returns an authorization decision. In zero trust designs it is logically separated from the policy enforcement point that actually permits or blocks the traffic.

The component that intercepts access requests and enforces the decision returned by the policy decision point. It may be a gateway, proxy, agent, or API layer positioned on the data path.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed by senior leadership. It sets boundaries for decisions, and any exposure exceeding it requires treatment, transfer, or avoidance.

The acceptable variance in risk exposure around the stated risk appetite for a specific asset, process, or business unit. It translates high-level appetite into practical thresholds that operational teams can monitor and act upon.

The risk remaining after existing controls and chosen treatments have been applied. It must be compared against risk tolerance and formally accepted by an accountable owner, because it can never be assumed to be zero.

The level of risk that exists before any mitigating controls are considered. Comparing it with residual risk shows the effectiveness and value of the controls currently in place.

The deliberate selection among mitigating, transferring, avoiding, or accepting a risk, followed by implementation and monitoring. Each option carries cost and trade-offs that should be documented and approved by the risk owner.

A living record of identified risks with owners, likelihood, impact, scores, treatment plans, and review dates. It supports prioritization, reporting to leadership, and evidence of due care during audits.

A forward-looking metric that signals increasing or decreasing exposure to a defined risk before losses occur. Effective KRIs are tied to thresholds derived from risk appetite and are reviewed on a regular cadence.

Assigning labels such as public, internal, confidential, or restricted to information based on sensitivity and business value. The label determines handling, access, retention, and protection requirements throughout the data lifecycle.

The accountable business role that decides the classification, access rules, and acceptable use of a data set. Ownership is usually assigned to a senior manager rather than to technical staff who operate the systems.

The role responsible for implementing and operating the technical and procedural controls that protect data according to the owner's requirements. Custodians handle backups, encryption, access provisioning, and storage maintenance but do not set classification policy.

The defined period during which records must be kept to satisfy legal, regulatory, contractual, or operational needs, followed by secure disposal. Retention schedules reduce storage cost and legal exposure from stale data.

Residual data that remains on storage media after deletion, formatting, or overwriting attempts. It drives requirements for sanitization, degaussing, cryptographic erasure, or physical destruction before media is reused or released.

Granting each user, service, or process only the permissions required to perform its current task, for only as long as needed. It limits blast radius when credentials are compromised and reduces accidental misuse.

Dividing a sensitive task among multiple people so that no single individual can complete a high-risk action alone. It deters fraud and error by requiring collusion, and is often paired with dual control for critical operations.

An access model that grants permissions to roles rather than individuals, with users assigned to roles based on job function. It simplifies administration and auditing, especially in organizations with many similar positions.

An access model that evaluates subject, resource, action, and environment attributes against policy to make decisions. It supports fine-grained, context-aware authorization such as time of day, device posture, or data sensitivity.

Providing elevated permissions only for a bounded window when a task requires them, then automatically revoking them. It reduces standing privilege and shrinks the window an attacker can exploit stolen credentials.

The tools and processes that control, vault, monitor, and record the use of administrative accounts and secrets. It typically includes credential vaulting, session recording, and approval workflows for elevated access.

Automated probing of systems and applications to identify known weaknesses, missing patches, and misconfigurations. Results are prioritized and fed into remediation workflows, and scans are often required for compliance reporting.

Authorized, goal-oriented simulated attacks that chain vulnerabilities to demonstrate real business impact. It differs from scanning by exploiting weaknesses and validating whether controls actually prevent compromise.

A written agreement defining the scope, timing, targets, allowed techniques, escalation paths, and legal authorization for a security test. It protects both the tester and the organization from unintended disruption or liability.

A finding reported as a vulnerability or alert when no real weakness or malicious activity exists. Excessive false positives waste remediation effort and erode trust in detection tooling, so tuning is essential.

A platform that centralizes logs, correlates events across sources, and generates alerts for analyst investigation. Modern deployments add user behavior analytics and automated response integrations.

A documented set of roles, phases, and procedures for detecting, containing, eradicating, and recovering from security incidents. It includes communication paths and is validated through regular tabletop and live exercises.

A documented, unbroken record of who handled evidence, when, and for what purpose from collection through disposal. It preserves evidentiary integrity for legal proceedings and internal disciplinary actions.

Integrating security activities such as threat modeling, secure coding standards, code review, and security testing into each phase of software development. It shifts defect prevention earlier, where fixes are cheaper than after release.

A structured exercise that identifies assets, entry points, threats, and mitigations before code is written or a system is deployed. Frameworks such as STRIDE help teams reason systematically about what can go wrong and how to reduce it.

Analyzing source code or binaries without executing the program to find insecure patterns such as injection flaws or hardcoded secrets. It finds issues early but can produce false positives that require triage.

Automated inventory and vulnerability checking of third-party libraries and dependencies in a codebase. It supports license compliance and rapid identification of exposure when a widely used component discloses a flaw.

Dividing a network into zones with controlled traffic between them, enforced by firewalls, VLANs, or microsegmentation. It limits lateral movement after compromise and supports compliance scoping for regulated data.

Decrypting, examining, and re-encrypting TLS traffic at a controlled gateway to detect threats hidden in encrypted sessions. It introduces privacy, performance, and certificate-management considerations that must be governed.