CSG key terms

The system of oversight, accountability, and decision-making that directs how an organization protects information assets, aligning security activities with business goals and legal obligations.

A cross-functional body of senior leaders that sets security priorities, approves policies and budgets, and resolves conflicts between security and business objectives.

A high-level statement of management intent that defines the organization's security objectives, principles, and mandatory requirements without prescribing technical detail.

A mandatory, specific requirement that supports a policy, such as an approved encryption algorithm or a minimum password length.

A documented, step-by-step instruction for performing a security-related task consistently, often tied to a specific standard or control.

Recommended, non-mandatory advice that helps staff apply policies and standards; deviations are allowed with justification.

A minimum set of security controls or configuration settings that must be applied to a system or asset unless an approved exception exists.

A documented, time-bound approval to deviate from a policy, standard, or baseline, usually requiring compensating controls and senior sign-off.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively or quantitatively by senior management.

The acceptable variation in risk exposure around the risk appetite, often stated as thresholds or limits for specific risk categories.

A conscious decision by an authorized owner to retain a risk without further treatment, supported by documented rationale and review.

The risk that remains after controls, mitigation, or treatment actions have been applied.

The level of risk that exists before any controls or mitigation measures are applied.

The process of identifying, analyzing, and evaluating risk by considering likelihood and impact against defined criteria.

The part of risk assessment that examines the nature, causes, and consequences of identified risks, often estimating likelihood and impact.

The part of risk assessment that compares analysis results with risk criteria to decide whether a risk is acceptable or requires treatment.

The process of selecting and implementing measures to modify risk, such as avoidance, reduction, transfer, or acceptance.

A structured record of identified risks, their owners, ratings, treatment plans, and status, used to monitor and report risk.

The accountable person who has authority to manage a specific risk, approve treatment, and accept residual exposure within delegated limits.

A measurable metric that provides early warning that risk exposure is increasing or approaching tolerance limits.

An alternative safeguard used when a required control cannot be implemented, intended to reduce the associated risk to an acceptable level.

A safeguard or countermeasure that modifies risk by preventing, detecting, correcting, or compensating for a threat or vulnerability.

The state of conforming to applicable laws, regulations, contracts, and internal policies, verified through monitoring and evidence.

A legally binding obligation imposed by a government or regulator that the organization must meet, often with penalties for noncompliance.

A requirement established by legislation enacted by a legislative body, which the organization must follow.

An obligation arising from a contract, such as a service level agreement or data processing agreement, that the organization has agreed to meet.

Ongoing activities to verify that controls and processes meet requirements, including reviews, testing, and tracking of remediation.

An independent, systematic examination of records, controls, and practices against defined criteria, resulting in findings and recommendations.

Documentation or records that demonstrate a control is designed and operating effectively, used to support audits and compliance claims.

The process of evaluating whether a control operates as intended, often through inquiry, observation, inspection, or re-performance.

A control that divides sensitive tasks among different people to prevent fraud and errors, ensuring no single person controls an entire process.

The principle of granting users and systems only the minimum access rights needed to perform their assigned tasks, for only as long as needed.

The set of policies, procedures, and technical mechanisms that restrict who can use which resources and under what conditions.

The process of categorizing information by sensitivity and criticality so that appropriate handling, protection, and retention rules can be applied.

A policy that defines how information at each classification level must be stored, transmitted, shared, retained, and disposed of.

A policy that states how employees may use organizational systems and data, including prohibited activities and consequences of violations.

A program that educates staff about security risks, policies, and safe behaviors, often delivered at onboarding and periodically thereafter.

The stages a policy goes through from drafting, review, approval, publication, and training to periodic review and retirement.