CGSP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Residual risk

The risk remaining after controls have been applied. It is compared with the risk appetite to decide whether further treatment is needed.

Three lines model

A governance structure where operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance.

Risk appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms.

Segregation of duties

A control that separates incompatible tasks such as initiation, authorization, recording, and reconciliation so no single person controls a transaction end to end.

Key risk indicator

A measurable metric monitored at a defined frequency with thresholds that signal when risk exposure is rising and action is required.

CIA triad

Confidentiality, integrity, and availability. These three properties define the core objectives of information security.

Defense in depth

Layering multiple independent controls so that the failure of one control does not expose the asset to an unacceptable level of risk.

Multi-factor authentication

Authentication using factors from at least two different categories: something you know, something you have, or something you are.

Least privilege

Granting users and systems only the minimum access rights required to perform their assigned tasks, and no more.

Vulnerability versus threat

A vulnerability is a weakness that can be exploited. A threat is a potential actor or event that could exploit it. Risk combines both with impact.

Incident response phases

Preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Each phase has defined activities and outputs.

Personal data

Any information relating to an identified or identifiable natural person. Pseudonymized data remains personal data; anonymized data does not.

Lawful basis

Under GDPR, processing needs one of six bases: consent, contract, legal obligation, vital interests, public task, or legitimate interests.

Data subject rights

Rights including access, rectification, erasure, restriction, portability, and objection. Requests must generally be answered within one month.

Privacy by design

Embedding data protection into systems and processes from the outset, with privacy-protective defaults and only necessary data collection.

Data protection impact assessment

A structured assessment required for high-risk processing, such as large-scale special-category data or systematic monitoring, to identify and mitigate risks.

Breach notification deadline

Under GDPR, a personal data breach posing a risk to rights and freedoms must be reported to the supervisory authority within 72 hours of awareness.

Data owner

The role accountable for a defined data domain, including classification, access approval, and quality outcomes. Stewards execute day-to-day responsibilities.

Data quality dimensions

Completeness, accuracy, timeliness, consistency, validity, and uniqueness. These dimensions are measured to assess fitness for purpose.

Data catalog

A metadata inventory of data assets recording owner, source, classification, lineage, and retention, used to support discovery and governance.

Data classification

Assigning data to tiers such as public, internal, confidential, or restricted, which then determine handling, access, and retention controls.

Master data management

Creating and maintaining a single trusted record for core entities such as customer, product, and supplier across the organization.

Legal hold

A directive that suspends normal disposal of data relevant to litigation or investigation, overriding retention schedules until released.

Audit risk model

Audit risk equals inherent risk times control risk times detection risk. The auditor manages detection risk through the nature, timing, and extent of procedures.

Audit evidence quality

Evidence must be sufficient, reliable, relevant, and useful. Evidence obtained directly by the auditor is generally more reliable than management representations.

Audit finding structure

A finding states the condition, criteria, cause, effect, and recommendation, with a management response naming an owner and due date.

Attribute sampling

A sampling approach that tests the rate at which a characteristic occurs, such as the percentage of transactions with proper approval.

Incident severity

A classification based on impact and urgency that drives escalation, notification, and resourcing decisions during incident response.

Root cause analysis

A method such as the 5 Whys or fishbone diagram used to identify the underlying cause of an incident so corrective action addresses the cause.

Independence in fact

The actual state of mind in which professional judgment is unbiased. It differs from independence in appearance, which is how others perceive it.

Conflict of interest

A situation where personal interest could improperly influence professional judgment. It must be disclosed and managed, not simply avoided.

Whistleblower protection

Legal and organizational safeguards that shield individuals who report misconduct in good faith from retaliation, including dismissal or demotion.