CSG flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, formally approved by executive management and used to guide all risk treatment decisions.

Three lines model

A governance structure where operational management owns risk, a risk and compliance function monitors it, and internal audit provides independent assurance to the board.

Separation of duties

A control that divides a sensitive task among multiple people so no single individual can both commit and conceal an error or fraud.

Security steering committee

A cross-functional body that prioritizes security investments, resolves conflicts between business and security objectives, and reports risk posture to executive leadership.

Security charter

A formally approved document defining the security function's mandate, scope, authority, reporting lines, and decision rights within the organization.

Board cyber oversight

The governing body's responsibility to approve risk appetite, oversee cyber risk reporting, and ensure adequate resources for the security program.

Governance versus management

Governance sets direction, accountability, and risk appetite; management executes controls and operations. Confusing the two produces accountability gaps.

Risk register

A structured record of identified risks with owners, likelihood, impact, existing controls, residual rating, treatment plans, and scheduled review dates.

Annualized loss expectancy

A quantitative risk metric calculated as single loss expectancy multiplied by annualized rate of occurrence, expressing expected yearly financial exposure for a risk scenario.

Residual risk

The risk remaining after existing controls are applied. Formal risk acceptance decisions apply to residual risk, not to inherent risk.

Risk treatment options

The four standard responses to risk: mitigate by applying controls, transfer via insurance or contract, avoid by ceasing the activity, or accept with documented sign-off.

Business impact analysis

An analysis identifying critical business processes and their dependencies, producing recovery time objectives and recovery point objectives that guide continuity planning.

Threat modeling

A structured design-time technique, such as STRIDE, that identifies threats, attack paths, and required mitigations before systems are built or changed.

Risk heat map

A visual grid plotting likelihood against impact to prioritize risks; risks with equal scores but different profiles may still need different treatments.

Inherent risk

The level of risk that exists before any controls are applied, used as a baseline to evaluate the effectiveness of proposed mitigations.

Recovery time objective

The maximum acceptable duration of downtime for a business process or system before the impact becomes unacceptable to the organization.

Compliance versus security

Compliance is conformance to external or internal requirements; security is actual protection. An organization can be compliant yet insecure, or secure yet noncompliant.

GDPR data minimization

A principle requiring that personal data collected be adequate, relevant, and limited to what is necessary for the stated purpose of processing.

Data subject access request

A request from an individual to access their personal data; controllers must respond within one month, extendable by two months for complex requests.

PCI DSS cardholder data environment

The people, processes, and technology that store, process, or transmit cardholder data, plus systems connected to or that could impact its security.

GDPR breach notification

The obligation to notify the supervisory authority of a personal data breach within 72 hours of becoming aware, where the breach is likely to result in risk.

Compliance control mapping

The practice of mapping a single implemented control to multiple framework requirements, reducing duplicate evidence collection and audit effort.

Audit evidence quality

Evidence must be current, attributable to an owner, dated, and retained for the required period; undated screenshots are generally insufficient for auditors.

SOX IT general controls

Controls over access management, change management, and IT operations that support reliable financial reporting for publicly traded companies in the United States.

Policy hierarchy

The document structure of policy (intent), standard (mandatory requirement), procedure (step-by-step execution), and guideline (advisory recommendation), each with different authority.

Policy exception process

A formal workflow requiring documented business justification, compensating controls, an authorized approver, and an expiry date for periodic re-review.

Acceptable use policy

A document defining permitted and prohibited use of organizational assets, monitoring notice, personal use boundaries, and consequences for violation.

Standard versus guideline

A standard is mandatory and measurable and uses "must"; a guideline is advisory and uses "should". Auditors test against standards, not guidelines.

Policy review cycle

The scheduled cadence, typically annual or triggered by significant change, at which policies are reassessed, reapproved, and version-controlled.

Policy acknowledgement record

Documented evidence that employees have read and agreed to a policy, commonly requested by auditors to demonstrate security awareness and enforcement.

Procedure testability

A quality criterion requiring that a documented procedure be repeatable by a trained person without undocumented knowledge, so it can be audited and verified.

Compensating control

An alternative safeguard applied when a required control cannot be implemented directly, intended to reduce risk to an acceptable level until remediation occurs.