CGSP cheat sheet

Risk = likelihood × impact; inherent risk is assessed before controls, residual risk after controls.

Three lines model: first line owns and manages risk, second line provides independent oversight and compliance, third line (internal audit) gives independent assurance.

Risk appetite is the amount of risk an organization is willing to accept; risk tolerance is the acceptable variation around that appetite.

Control types: preventive stops an event, detective identifies it after occurrence, corrective remediates it; controls can be administrative, technical, or physical.

Compliance obligations arise from laws, regulations, contracts, and standards; a compliance register maps each obligation to an owner and a control.

COSO ERM components: governance and culture, strategy and objective-setting, performance, review and revision, information, communication and reporting.

Key risk indicator (KRI) thresholds use green/amber/red bands; a KRI must be measurable, monitored at a defined frequency, and linked to a decision trigger.

Segregation of duties requires that no single person can initiate, authorize, record, and reconcile the same transaction.

CIA triad: confidentiality protects against unauthorized disclosure, integrity against unauthorized modification, availability against loss of timely access.

Defense in depth layers controls so that failure of one layer does not expose the asset; no single control is assumed sufficient.

Authentication factors are knowledge, possession, and inherence; MFA requires factors from at least two different categories.

Least privilege grants the minimum access needed for a task; need-to-know limits access to information required for the role.

Vulnerability is a weakness, threat is a potential actor or event, risk is the combination of threat exploiting vulnerability and resulting impact.

Encryption at rest protects stored data; encryption in transit (TLS) protects data moving between systems; key management protects both.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Security awareness training frequency and phishing simulation results are common metrics for the human-control layer.

Personal data is any information relating to an identified or identifiable natural person; pseudonymized data remains personal data, anonymized data does not.

GDPR lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests; special-category data needs an additional Article 9 condition.

Data subject rights include access, rectification, erasure, restriction, portability, and objection; a request must be answered within one month under GDPR, extendable by two.

Privacy by design and by default requires data protection to be embedded in processing and only necessary data collected.

A data protection impact assessment (DPIA) is required for high-risk processing such as large-scale special-category data or systematic monitoring.

Cross-border transfers need a transfer mechanism such as an adequacy decision, standard contractual clauses, or binding corporate rules.

A personal data breach is reportable to the supervisory authority within 72 hours of awareness where it poses a risk to rights and freedoms.

Data minimization, purpose limitation, storage limitation, accuracy, integrity and confidentiality, accountability, lawfulness and fairness are core GDPR principles.

Data governance defines decision rights and accountability for data; data management executes those decisions.

A data owner is accountable for a data domain; a data steward is responsible for day-to-day quality and definition; a custodian operates the systems.

Data quality dimensions include completeness, accuracy, timeliness, consistency, validity, and uniqueness.

A data catalog records metadata such as owner, source, classification, lineage, and retention for each data asset.

Data classification tiers (for example public, internal, confidential, restricted) determine handling, access, and retention controls.

A business glossary standardizes terms and definitions; a data dictionary documents field-level structure and constraints.

Master data management creates a single trusted record for core entities such as customer, product, and supplier.

Retention schedules set minimum and maximum retention periods; legal hold suspends disposal for relevant data.

Audit evidence must be sufficient, reliable, relevant, and useful; evidence hierarchy ranks auditor observation above management representation.

Audit risk = inherent risk × control risk × detection risk; detection risk is managed by the auditor through sample size and procedures.

Sampling: attribute sampling tests a rate of occurrence, variable sampling estimates a monetary amount; confidence level and tolerable deviation drive sample size.

An audit finding states the condition, criteria, cause, effect, and recommendation; management responds with an owner and a due date.

Assurance is independent verification that controls operate as described; self-assessment is not independent assurance.

Incident severity classification drives escalation; severity is based on impact and urgency, not on who reported the incident.

Incident management lifecycle: identify, log, categorize, prioritize, contain, resolve, close, and review.

Root cause analysis tools include the 5 Whys and fishbone (Ishikawa) diagrams; corrective actions must address the cause, not the symptom.

Core ethical principles: integrity, objectivity, confidentiality, competence, and professional behavior.

A conflict of interest exists when personal interest could improperly influence professional judgment; it must be disclosed and managed.

Independence in fact is the actual state of mind; independence in appearance is how a reasonable third party perceives it; both are required.

A bribe is an offer or receipt of an undue advantage to influence action; a facilitation payment is a payment to expedite a routine action and is prohibited under many laws.

Whistleblower protections shield good-faith reporters from retaliation; reports should go to an independent channel.

Confidential information obtained during an engagement may not be used for personal benefit or disclosed without authority.

Professional competence requires maintaining knowledge and skills and declining work outside one's competence.

Ethical decision tests include the publicity test, the reversibility test, and the legal/regulatory test.