CISEC-IT key terms

The system of decision rights, accountability, and oversight that directs how an organization sets security objectives, allocates resources, and monitors performance against them.

The governing body's formal duty to approve security strategy and risk appetite, monitor material cyber risk, and hold executives accountable for outcomes.

A multi-year plan that states how security capabilities will be built and sequenced to support business goals, with measurable objectives and funding assumptions.

A time-phased sequence of initiatives, dependencies, and milestones that translates strategy into deliverable capability increments with owners and target dates.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative statements or quantitative thresholds approved by leadership.

The acceptable variation around a specific risk measure, such as maximum downtime or loss per event, that operational teams use to make day-to-day decisions.

A maintained record of identified risks with owners, likelihood and impact ratings, existing controls, treatment plans, and review dates used to track enterprise exposure.

Selecting and applying a response to a risk: mitigate with controls, transfer through insurance or contract, avoid the activity, or accept with documented approval.

The exposure that remains after existing controls and planned treatments are applied, and which leadership formally accepts against the stated appetite.

The level of exposure an activity would carry if no controls were in place, used as a baseline for judging whether controls are proportionate.

A forward-looking metric with defined thresholds that signals whether a risk is increasing or decreasing, enabling early intervention before losses occur.

An assessment of whether a control is designed appropriately and operating as intended, usually evidenced by testing, sampling, or continuous monitoring data.

A governance structure separating operational management, independent risk and compliance functions, and internal audit, each with distinct assurance responsibilities.

The practice of aligning internal controls to multiple external obligations so one control set can evidence compliance with several regulations simultaneously.

A catalog of applicable legal, regulatory, and contractual requirements with owners, applicability rationale, evidence sources, and review cycles.

Legal entitlements of individuals over their personal data, such as access, correction, deletion, portability, and objection, each with response deadlines.

A structured review of a processing activity's necessity and risks to individuals, performed before launch and used to design privacy safeguards.

Building privacy safeguards into systems and processes from the outset rather than retrofitting them, including data minimization and default protective settings.

The legal or contractual obligation to inform regulators and affected individuals within defined timeframes after discovering a qualifying data incident.

The structural design of security controls, trust boundaries, and reference patterns that guides how systems are built and integrated across the enterprise.

Layering independent controls across people, process, and technology so a single failure does not lead to compromise of critical assets.

An access model that verifies every request based on identity, device posture, and context rather than assuming trust from network location.

An approved, reusable blueprint of components and patterns that project teams adopt, reducing design variance and speeding secure delivery.

Deferred design or remediation work whose accumulated interest shows up as higher operating cost, slower change, and greater exposure over time.

A predefined scale that maps observed incident characteristics to response levels, escalation paths, and notification obligations.

Documented roles, phases, communication paths, and decision criteria that guide the organization from detection through recovery and lessons learned.

A facilitated discussion-based simulation that tests whether decision-makers, plans, and communications work under a realistic scenario without live systems.

An analysis identifying critical processes, their dependencies, and the harm caused by downtime, producing recovery time and recovery point objectives.

The maximum acceptable elapsed time to restore a process or system after disruption, which drives continuity architecture and investment decisions.

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design for each system.

The executive-level coordination of decisions, stakeholders, and external messaging when an event threatens the organization's viability or reputation.

Granting identities only the access needed for their current tasks, for only as long as needed, and removing it when the need ends.

Controls that vault, broker, record, and periodically review high-risk administrative accounts and sessions to limit abuse and support accountability.

An authorization approach that assigns permissions to job-derived roles and then assigns people to roles, simplifying reviews and provisioning.

A periodic, documented review in which managers or system owners confirm or revoke each user's entitlements to prevent privilege accumulation.

A scheme that labels information by sensitivity and value so handling, retention, and protection requirements can be applied consistently.

The exposure created when vendors, suppliers, or service providers hold data, connect to networks, or deliver functions the organization depends on.

Segmenting suppliers by criticality and data access so due diligence depth, contract terms, and monitoring frequency match actual risk.

A contractual clause allowing the customer to examine a supplier's controls, reports, or premises, or to accept independent attestations in lieu of onsite review.

Exposure arising from a supplier's own subcontractors and dependencies, which the primary vendor must disclose and manage on the customer's behalf.

A sustained effort combining training, simulations, and communications that changes everyday behavior and builds recognition of threats and reporting habits.

Authorized fake messages sent to measure and coach employee reporting and click behavior, with results used to target training rather than punish individuals.

The shared beliefs and norms that determine whether people prioritize, question, and speak up about security in daily work.

Embedded staff outside the security team who receive extra training and act as local advocates, reviewers, and escalation points within delivery teams.

Quantified measures of control coverage, program performance, and risk reduction that inform decisions and demonstrate progress against objectives.

A metric tied to a specific program objective that shows whether planned work is delivering the intended outcome, not merely activity volume.

Expressing risk in monetary or probabilistic terms, such as annualized loss exposure, so security investment can be compared with business alternatives.

The funded plan allocating money and staff across run, grow, and transform activities, defended by showing risk reduction and business enablement.

The concise, decision-oriented communication of risk posture, trends, incidents, and funding needs to directors in business language rather than technical detail.