CISEC-IT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Three lines model

First line owns and manages risk operationally; second line sets frameworks and monitors compliance; third line is internal audit providing independent assurance to the board.

Security steering committee

Cross-functional governance body chaired by the CISO with business, IT, legal, risk, and HR representation that prioritizes security initiatives, resolves conflicts, and records decisions with owners.

Policy versus standard

A policy states mandatory intent approved by executive leadership; a standard specifies measurable, enforceable requirements that implement the policy. Procedures give step-by-step instructions.

Risk appetite statement

A formal declaration of how much risk the organization is willing to pursue to meet objectives, expressed in qualitative categories or quantitative limits and approved by the board.

Residual risk

The risk remaining after controls are applied. It is scored only when control effectiveness is evidenced, and it must be accepted by an accountable owner within appetite.

Annualized loss expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. It converts risk into a monetary figure usable for comparing treatment options and funding requests.

Risk treatment options

Exactly four choices: mitigate by adding controls, transfer through insurance or contract, avoid by stopping the activity, or accept with documented owner sign-off.

GDPR breach notification window

Controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless the breach is unlikely to result in a risk to individuals.

Controller versus processor

The controller determines the purposes and means of processing personal data; the processor acts only on the controller's documented instructions and requires a binding Article 28 contract.

Material weakness

A deficiency, or combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility a material misstatement will not be prevented or detected timely.

Legal hold

A directive to suspend scheduled destruction of records and data relevant to anticipated or active litigation, investigation, or audit to avoid spoliation sanctions.

Zero trust architecture

A model that removes implicit trust from the network and evaluates every request based on identity, device posture, and policy, per NIST SP 800-207 pillars.

Cloud shared responsibility

The provider secures the cloud infrastructure such as facilities and hypervisor; the customer secures what runs in the cloud, including identity, configuration, and data.

Architecture review gate

A mandatory security sign-off stage in the development lifecycle before production release; exceptions require documented, time-bound risk acceptance by an accountable owner.

Cryptoperiod

The defined period during which a cryptographic key is authorized for use before rotation, balancing exposure reduction against operational cost of re-encryption.

Recovery time objective

The target duration within which a business process or system must be restored after disruption. It must be less than or equal to the maximum tolerable downtime.

Recovery point objective

The maximum acceptable amount of data loss measured in time before the disruption; it drives backup frequency and replication design.

Tabletop exercise

A discussion-based simulation of a scenario that tests decision-making, escalation, and communications without touching production systems, often used for executive crisis readiness.

Chain of custody

Documented chronological record of who handled evidence, when, and how, required to preserve admissibility and integrity during forensic investigation.

Least privilege

Granting each identity only the access required to perform its function, for the minimum necessary duration, reviewed periodically and removed when no longer needed.

Access recertification

A periodic review where business managers confirm or revoke entitlements. Privileged and sensitive-data access is reviewed more often than general access.

Privileged access management

Controls over administrative accounts including credential vaulting, just-in-time elevation, session recording, and separation of admin accounts from daily-use accounts.

Data classification tiers

Labels such as public, internal, confidential, and restricted assigned by the data owner that determine handling, encryption, retention, and sharing requirements.

SOC 2 Type II

An independent attestation covering the design and operating effectiveness of controls over a period, typically six to twelve months, against trust services criteria.

Vendor risk tiering

Classifying suppliers by data sensitivity, system criticality, and regulatory exposure, with the highest tiers requiring deeper due diligence and more frequent reassessment.

Fourth-party risk

Risk arising from a vendor's own subcontractors and suppliers who may access or host the organization's data, requiring identification and assessment beyond the direct vendor.

Right to audit clause

A contract provision allowing the organization, or its designated independent assessor, to examine the vendor's controls and evidence, including after a security incident.

Phishing report rate

The percentage of recipients who report a simulated phishing message. It measures positive security behavior better than click rate alone.

Role-based security training

Training tailored to job function: secure coding for developers, privileged access hygiene for administrators, and social engineering awareness for executives and finance staff.

Key risk indicator

A leading metric that signals increasing risk exposure before losses occur, such as growth in unpatched critical systems or rising third-party concentration.

Security budget run-grow-transform

A budgeting structure splitting spend into run (licenses, staff, maintenance), grow (new capability, remediation), and transform (architecture change) to show risk-reduction intent.

Board security reporting

A concise, trend-oriented summary showing top risks with owners, material changes since last report, and specific decisions requested, rather than raw operational dashboards.