CISSP key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed qualitatively or quantitatively and used to guide decisions about how risk will be treated.

A quantitative risk metric calculated by multiplying the single loss expectancy of an incident by its annualized rate of occurrence, giving an expected yearly financial loss for an asset and threat pair.

A structured process that identifies critical business functions and measures how disruption affects them over time, producing recovery priorities and timeframes that drive continuity and recovery planning.

The ongoing investigation and verification an organization performs to confirm that controls, vendors, and processes actually meet stated requirements and that risks are understood before decisions are made.

A control that divides a sensitive task among multiple people so that no single individual can complete a critical transaction alone, reducing undetected error or fraud.

The process of labeling information by sensitivity and criticality so protection requirements match its value, and so users know how each asset must be handled, stored, and shared.

Residual data left on storage media after deletion or formatting that may still be recoverable, driving requirements for overwriting, degaussing, or destruction before media is reused or released.

The senior manager accountable for a specific information asset who decides its classification, approves access, and accepts the risk associated with how that data is used and protected.

Layering independent controls across people, process, and technology so the failure of one safeguard does not expose the asset; an attacker must defeat multiple, diverse barriers.

The totality of hardware, firmware, and software components that enforce a system's security policy; only a correct and protected TCB can be relied upon to keep the system secure.

An abstract machine concept describing the part of a system that mediates every access request, cannot be bypassed or altered, and is small enough to be verified.

A formal confidentiality model enforcing no read up and no write down, so subjects cannot read data above their clearance or leak information to lower classification levels.

An international standard for specifying and evaluating IT security functionality, producing assurance levels that let buyers compare products against a documented protection profile.

A design principle stating that access decisions should default to denial, with permissions granted only by explicit exception, so a control failure leaves the asset protected rather than exposed.

A communication path that lets information flow between parties in a way the security policy does not intend, often by encoding data in timing or storage side effects.

An architecture that treats every request as untrusted regardless of network location, verifying identity and device health and granting least-privilege access per session instead of trusting the perimeter.

A seven-layer reference framework describing how data moves from application logic to physical transmission, used to reason about where protocols, controls, and attacks sit in the stack.

A logical segmentation of a switch fabric that groups ports into separate broadcast domains, limiting lateral traffic and letting security controls be applied per group rather than per physical location.

A suite of protocols that authenticates and encrypts IP traffic at the network layer, commonly used to build site-to-site VPNs and protect host-to-host communication in tunnel or transport mode.

A cryptographic protocol providing confidentiality, integrity, and server authentication for application traffic such as HTTPS, using certificates and negotiated session keys between client and server.

A segmented network zone hosting externally reachable services and separating them from the internal network, so a compromised public-facing host does not give direct access to internal systems.

A technique applying granular, workload-level security policy inside a data center or cloud environment, permitting only explicitly allowed flows between individual hosts regardless of subnet boundaries.

A ticket-based authentication protocol in which a trusted key distribution center issues time-limited tickets that let clients prove identity to services without resending passwords across the network.

An arrangement in which multiple organizations trust a common identity provider, letting a user authenticate once and reach partner resources through assertions rather than separate credentials.

Authentication requiring two or more different factor types, such as something you know, have, or are, so a single compromised credential like a password is not enough to gain access.

An access control model that assigns permissions to job roles rather than individuals, so users gain rights by being placed in a role, simplifying administration and supporting least privilege.

The tools and processes that control, monitor, and record use of highly privileged accounts, typically through credential vaulting, session brokering, and time-limited elevation.

An automated assessment comparing systems against known weakness signatures and configuration checks, producing a list of potential exposures that must then be validated and prioritized.

An authorized, goal-driven attack simulation that chains real weaknesses together to demonstrate business impact, going beyond scanner output to prove whether vulnerabilities are exploitable.

A written agreement defining the scope, timing, targets, constraints, and permitted techniques for a security test, protecting both the testers and the organization from unintended harm.

A documented, unbroken record of who handled evidence, when, and for what purpose, from collection through presentation, so its integrity can be defended in legal or disciplinary proceedings.

The repeatable phases followed when handling a security event, including preparation, detection and analysis, containment, eradication, recovery, and lessons learned, so response is consistent rather than improvised.

The maximum acceptable elapsed time to restore a business function after disruption, driving recovery architecture choices and established through business impact analysis rather than by IT preference.

A platform that collects and correlates logs and event data from many sources in real time, generating alerts and supporting investigation, reporting, and retention for security monitoring.

A controlled process for requesting, reviewing, approving, testing, and recording changes to systems, intended to prevent outages and preserve the security posture of the environment.

A documented, approved set of settings for a system representing a known secure state, used as the reference for hardening checks and for detecting unauthorized drift.

The structured phases used to build software, from requirements and design through development, testing, deployment, and maintenance, where security activities must be embedded at each stage rather than added at the end.

A coding practice that checks and constrains all data entering a system against expected format, type, and range, blocking injection and malformed-input attacks before the data is processed.

An approach that automates security checks inside continuous integration and delivery pipelines, so scanning, testing, and policy enforcement happen with every build rather than in a separate late review.