CISM key terms

The leadership structures and processes that align security activities with business objectives, assign accountability to senior management, and measure whether security is delivering the intended outcomes.

A cross-functional group of senior leaders that sets security direction, prioritizes funding, and resolves conflicts between business requirements and security constraints.

A high-level statement approved by senior leadership that states the organization's security intentions and mandatory requirements, leaving specific implementation details to standards and procedures.

A mandatory, measurable requirement such as a configuration baseline or minimum password length, derived from policy and used to define what compliance looks like.

A documented sequence of steps describing how a specific task is carried out so that a standard or policy requirement is met consistently.

Recommended, non-mandatory advice that suggests how to meet a policy or standard, allowing discretion where circumstances differ from the norm.

The continuing practice of acting reasonably and responsibly to protect organizational assets, showing that leadership has taken the measures a prudent organization would take.

A quantifiable metric showing how well a security process or activity is performing against its target, such as the percentage of systems patched on schedule.

A forward-looking metric that shows whether exposure to a given risk is rising or falling, used to trigger management action before losses occur.

The coordinated activities used to identify, assess, treat, and monitor risk so that exposure remains within the level the organization has chosen to accept.

The overall process of identifying risks, analyzing their likelihood and impact, and evaluating them against criteria to decide which need a response.

The part of risk assessment that examines the causes of a risk and estimates how likely and how damaging it would be, using qualitative or quantitative methods.

The amount and type of risk an organization is willing to accept in pursuing its objectives, set by senior leadership and approved at board level.

The acceptable variation around the risk appetite that a specific business unit, process, or system may operate within before action is required.

The level of risk that exists before any controls or risk responses are applied, used as a starting point for deciding what protection is needed.

The risk that remains after existing controls and the chosen risk responses have been applied; it is what leadership formally accepts.

A structured record of identified risks with owners, ratings, treatments, and status, used to track, prioritize, and report risk over time.

The process of selecting and implementing an option to modify risk, either by avoiding, reducing, transferring, or accepting it.

The accountable individual who has the authority and resources to manage a particular risk and to approve how it will be treated.

A process that identifies critical business functions and quantifies the effects of their disruption, providing the basis for recovery priorities and objectives.

The expected yearly monetary loss from a risk, calculated by multiplying the single loss expectancy by the annualized rate of occurrence.

The coordinated set of policies, projects, controls, and resources an organization uses to reach and sustain its security objectives over time.

The use of layered and complementary controls so that the failure or bypass of any single control does not expose the whole environment.

A safeguard or countermeasure, whether technical, administrative, or physical, that reduces the likelihood or impact of a threat exploiting a weakness.

The practice of labeling information by sensitivity and value so that handling, access, and protection requirements can be applied consistently.

The senior manager accountable for a data set who decides its classification, approves access rules, and accepts the risk associated with it.

Ongoing communication and training activities that build employees' knowledge and habits so they recognize, avoid, and report security problems.

The integration of security activities such as requirements, threat modeling, code review, and testing into every phase of software development.

The process of assessing, contracting, monitoring, and eventually terminating vendor relationships according to the risk each vendor poses to the organization.

An actual or suspected event that threatens confidentiality, integrity, or availability of information, or that violates policy or law.

A documented set of roles, decision criteria, and communication paths that guides staff through detecting, handling, and recovering from security incidents.

The repeating phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident activity used to manage incidents consistently.

A designated group with defined authority and responsibilities that coordinates the technical and management response to security incidents.

The process of raising an incident to more senior authority or additional resources when severity, scope, or elapsed-time thresholds are crossed.

Short-term action taken to stop an incident from spreading, such as isolating a host, disabling an account, or blocking network traffic.

A documented, unbroken record of who handled evidence, when, and for what purpose, so the evidence remains defensible in legal or disciplinary proceedings.

A structured examination after recovery of what happened, why, and how well the response worked, producing changes to prevent recurrence.

The legal or contractual duty to inform regulators, affected individuals, or business partners within set timeframes when protected information is compromised.

A discussion-based simulation in which participants walk through a hypothetical incident to test roles, decisions, and communication before a real event.