CGSP key terms

The system of rules, practices, and decision rights by which an organization directs and controls its activities and holds leadership accountable for outcomes.

The obligation of a named person to answer for decisions, actions, and results, including failures, to a defined authority.

A structure separating management's ownership of risk, independent risk and compliance oversight functions, and internal audit's independent assurance to governing bodies.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms.

The acceptable variation around a risk appetite level for a specific objective, often stated as measurable thresholds or limits.

A structured record of identified risks with owners, likelihood, impact, ratings, controls, and treatment plans, maintained and reviewed periodically.

The risk remaining after existing controls and treatments have been applied, compared against tolerance to decide whether further action is needed.

The level of risk before any controls or mitigations are applied, used as a baseline when evaluating control effectiveness.

The degree to which a designed control operates as intended and achieves its objective, tested through evidence rather than assumption.

A forward-looking metric tracked against thresholds to signal changes in risk exposure and prompt management action before losses occur.

Dividing incompatible tasks, such as authorizing, recording, and reviewing a transaction, among different people to reduce error and fraud risk.

Granting users and systems only the access needed to perform their assigned tasks, for only as long as required.

A periodic attestation in which owners confirm that users' access rights remain appropriate, with inappropriate rights removed and evidence retained.

Access rights that allow administrative control over systems, data, or configurations, requiring stronger authentication, monitoring, and tighter approval.

A structured method for identifying plausible threats, attack paths, and required controls against a system during design and change.

The repeatable cycle of discovering, prioritizing, remediating, and verifying technical weaknesses using risk-based timelines and tracked ownership.

The controlled process of testing, approving, deploying, and verifying software updates to close known vulnerabilities within defined timeframes.

Layering independent preventive, detective, and corrective controls so that failure of one layer does not expose the asset entirely.

Documented roles, phases, communication paths, and decision criteria used to detect, contain, eradicate, recover from, and learn from security incidents.

A confirmed or suspected event that compromises confidentiality, integrity, or availability of information systems or data and requires a coordinated response.

Assigning data to defined sensitivity tiers so that handling, access, retention, and protection requirements are proportionate and consistently applied.

Collecting and keeping only the personal data that is adequate, relevant, and necessary for the stated purpose.

Restricting use of personal data to purposes that were specified and lawful at collection, unless a compatible basis exists for new use.

A freely given, specific, informed, and unambiguous indication of a person's agreement to processing, withdrawable without detriment.

Entitlements of individuals over their personal data, such as access, correction, deletion, restriction, portability, and objection, subject to legal exceptions.

A structured assessment of privacy risks from a high-risk processing activity, documenting necessity, safeguards, and residual risk before processing begins.

Embedding privacy protections into systems, processes, and defaults from the outset rather than adding them after deployment.

Defined periods and disposal methods for keeping records, balancing legal, operational, and privacy obligations with defensible deletion.

A role accountable for the quality, definitions, and appropriate use of a defined data domain on behalf of the business owner.

The accountable role that decides classification, access, and permitted use for a data domain and approves related policy exceptions.

Documentation of where data originates, how it moves and transforms across systems, and who handles it along the way.

A tamper-evident, time-stamped record of activity and changes that supports reconstruction, investigation, and audit verification.

Information gathered and evaluated by auditors to support conclusions, judged on sufficiency and appropriateness.

A procedure that checks whether a control operated as designed during the period, typically through inspection, observation, inquiry, or reperformance.

The threshold at which an omission or misstatement could influence the decisions of users, guiding scoping, testing, and reporting judgments.

A documented conclusion that a condition differs from criteria, supported by evidence and stating risk, cause, and a recommended action.

Agreed actions, owners, and due dates to correct a finding, tracked to verified closure rather than reported completion.

The legal or contractual duty to inform regulators and affected individuals of a data breach within defined timeframes and content requirements.

Chronological documentation of who handled evidence, when, and how, preserving integrity for investigation or legal proceedings.

A situation where personal, financial, or other interests could improperly influence professional judgment, requiring disclosure and management.

Freedom from conditions that impair objectivity, including reporting lines, financial ties, and relationships that could bias conclusions.

The professional duty to protect information obtained through work, using it only for legitimate purposes and safeguarding it appropriately.

The level of diligence, competence, and prudence a reasonable professional is expected to apply to assigned responsibilities.

A controlled process for requesting, assessing, approving, testing, and recording changes to systems so that risk and traceability are maintained.