CISM flashcards
CISM · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Security governance
- The set of policies, roles, processes, and oversight activities that align information security with business objectives and ensure accountability at senior management and board level.
- Security steering committee
- A cross-functional oversight body that prioritizes security initiatives, resolves conflicts between security and business needs, and monitors risk treatment and program performance.
- Security policy
- A high-level management statement that defines intent, principles, and mandatory requirements for protecting information assets and directs lower-level standards and procedures.
- Security standard
- A mandatory, measurable requirement that specifies how policy is implemented, such as configuration baselines, encryption strengths, or access control rules.
- Security procedure
- A documented sequence of steps that specifies how to perform a security process consistently, including responsible roles, inputs, actions, and expected outputs.
- Security guideline
- Non-mandatory guidance that recommends good practices and suggests approaches for meeting policy and standards where specific requirements are not prescribed.
- Key performance indicator
- A metric that measures how effectively a security process or control is performing against a defined target, used for management reporting and continual improvement.
- Security charter
- A formal document that establishes the security function's authority, scope, responsibilities, reporting lines, and relationship to business units and oversight bodies.
- Risk assessment
- The process of identifying, analyzing, and evaluating risk by combining likelihood and impact to determine which risks require treatment and prioritization.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of its objectives, established by senior leadership and expressed qualitatively or quantitatively.
- Risk tolerance
- The acceptable variation or deviation from the risk appetite that can be tolerated for a specific risk, process, or business unit before action is required.
- Inherent risk
- The level of risk that exists before considering the effect of existing controls, used to understand exposure and prioritize where controls are needed.
- Residual risk
- The remaining risk after existing controls have been applied, which must be compared with risk appetite and accepted by the accountable business owner.
- Risk treatment
- The selection and implementation of options to modify risk, including mitigation, transfer, avoidance, or acceptance, with ownership and target dates documented.
- Risk register
- A structured record of identified risks containing descriptions, owners, likelihood and impact ratings, treatment plans, status, and review dates for monitoring.
- Business impact analysis
- A process that identifies critical business functions and quantifies the operational and financial effects of disruption, deriving recovery time and recovery point objectives.
- Security program
- The coordinated set of projects, controls, processes, and roles established to implement security strategy, manage risk, and meet compliance obligations across the organization.
- Segregation of duties
- A control that divides critical tasks and approvals among different people to reduce the risk of error or fraud by preventing one person from controlling an entire process.
- Least privilege
- The principle of granting users and systems only the access rights necessary to perform their assigned tasks, for the minimum time required.
- Security awareness training
- A role-based education program that teaches employees security responsibilities and safe behaviors, measured through phishing simulations, assessments, and observed behavior rather than completion alone.
- Control cost-benefit analysis
- A comparison of the cost to implement and operate a control against the expected reduction in risk and potential loss, used to justify control selection.
- Asset inventory
- A maintained record of information assets, owners, locations, classifications, and dependencies that provides the foundation for risk assessment and control implementation.
- Third-party risk management
- A lifecycle process for assessing, contracting with, monitoring, and terminating vendor relationships based on the risk posed by their access to data and systems.
- Security exception process
- A formal workflow for requesting, reviewing, approving, time-limiting, and documenting deviations from security policy, with business risk acceptance and compensating controls recorded.
- Incident response plan
- A documented set of roles, procedures, communication paths, and resources that guides an organization in detecting, responding to, and recovering from security incidents.
- Event versus incident
- An event is any observable occurrence in a system; an incident is an event that actually or potentially compromises confidentiality, integrity, or availability and requires response.
- Incident classification
- The process of assigning severity based on business impact, scope, data sensitivity, and urgency to determine escalation, resources, and notification requirements.
- Containment
- The immediate action taken to limit the scope and damage of an incident, such as isolating systems or blocking access, while preserving evidence and maintaining critical operations.
- Chain of custody
- A documented, chronological record of who handled evidence, when, where, and why, used to preserve its integrity and admissibility in legal or disciplinary proceedings.
- CSIRT
- A team with defined roles and authority responsible for coordinating incident detection, analysis, containment, eradication, recovery, and communication across the organization.
- Post-incident review
- A structured, blameless analysis after an incident that identifies root causes, evaluates response effectiveness, and produces corrective actions to improve controls and plans.
- Notification requirements
- Legal, regulatory, contractual, or internal obligations that define what incidents must be reported, to whom, within what timeframe, and with what content.