CITP key terms

The system of policies, roles, and decision rights that directs how an organization plans, funds, and monitors information technology so that IT outcomes support business objectives and manage risk.

A framework from ISACA that organizes governance and management objectives for enterprise IT into domains and processes, each with maturity and capability assessments, helping auditors and managers structure control reviews.

A widely adopted set of best-practice guidance for IT service management, covering service strategy, design, transition, operation, and continual improvement, with processes such as incident, problem, and change management.

A cross-functional executive body that prioritizes IT investments, resolves conflicts over resources, and oversees major projects, providing the link between business strategy and technology decisions.

A documented commitment between a service provider and a customer that specifies measurable performance targets such as availability, response time, and support hours, along with remedies for missing those targets.

A quantifiable measure chosen to gauge how well an activity or process achieves a stated objective, used in governance reporting to show trends and support corrective action.

A performance measurement approach that tracks financial, customer, internal process, and learning perspectives together, adapted for IT to demonstrate business value beyond cost and uptime statistics.

Specific, verifiable statements describing the desired result of a control activity, used as benchmarks when designing tests of controls and evaluating whether safeguards operate effectively.

A control principle that divides incompatible tasks, such as authorizing a transaction, recording it, and safeguarding the related assets, among different people to reduce the risk of error or fraud.

The policies, procedures, and organizational structures designed to provide reasonable assurance that operations are effective, financial reporting is reliable, and laws and regulations are followed.

The process of identifying threats and vulnerabilities, estimating likelihood and impact, and ranking exposures so that limited resources are directed to the most significant risks first.

The chosen response to an identified risk, typically accepting, avoiding, transferring, or mitigating it, documented with an owner and a target date for the selected action.

A blueprint describing business processes, applications, data, and technology infrastructure and the relationships among them, used to guide standards and coordinated change across the organization.

Technology that lets one physical server host multiple isolated logical machines, each with its own operating system, improving hardware utilization, provisioning speed, and disaster recovery flexibility.

Software that creates and runs virtual machines, allocating physical CPU, memory, and storage among guests and enforcing isolation between them; it may run directly on hardware or atop a host OS.

Delivery of computing resources such as servers, storage, and applications over a network on demand, characterized by elasticity, measured service, and reduced need for owned data-center capacity.

A cloud delivery model in which a provider hosts and maintains an application and customers access it over the internet, shifting patching and infrastructure duties to the vendor.

Dividing a network into separate zones with controlled traffic between them, limiting how far an intruder or malware can spread and simplifying enforcement of access rules.

A device or software that inspects network traffic and permits or blocks it according to configured rules, forming a boundary between trusted internal networks and less trusted ones.

A service that creates an encrypted tunnel over a public network, allowing remote users or branch sites to reach private resources as though directly connected.

Documented procedures for restoring critical systems and data after an outage, including recovery time and recovery point targets, alternate sites, and the order in which services return.

A study that identifies critical business functions and estimates the operational and financial harm of their loss over time, producing recovery priorities and tolerance thresholds for outages.

A broader organizational plan for keeping essential operations running during and after a disruption, covering people, facilities, suppliers, and communications as well as technology recovery.

Transforming readable data into ciphertext using an algorithm and key so that only holders of the correct key can reverse the process and read the original content.

The policies, roles, and systems that issue, distribute, validate, and revoke digital certificates, binding public keys to identities so parties can authenticate each other and exchange encrypted data.

Requiring two or more independent credential types, such as a password plus a one-time code or hardware token, so that a stolen password alone does not grant access.

Granting users and processes only the access rights needed to perform their assigned tasks, and no more, to shrink the damage possible from accident or compromised accounts.

A monitoring tool that inspects network or host activity for known attack patterns or anomalies and raises alerts, helping responders notice incidents that preventive controls failed to stop.

A social-engineering attack that impersonates a trusted party through email, messaging, or a fake site to trick recipients into revealing credentials, approving payments, or running malicious files.

Malicious software that encrypts or locks access to data and demands payment for restoration, often after stealing copies for extortion; reliable offline backups are a primary defense.

Recurring education that teaches staff to recognize social engineering, handle data properly, and report suspicious activity, reducing the human errors that attackers most often exploit.

The structured process for detecting, logging, containing, eradicating, and recovering from security or service events, including communication, evidence handling, and lessons-learned review afterward.

Stored information that is not currently moving across a network, such as files on disks, databases, or backups, which requires protection against unauthorized local or physical access.

Requirements and practices governing which geographic location stores or processes particular data, driven by legal mandates, contractual terms, and privacy obligations that restrict cross-border transfer.

A structured review performed before a new system or data practice begins, identifying personal information collected, legal basis, retention, sharing, and safeguards, and recommending mitigations.

Assigning labels such as public, internal, confidential, or restricted to information so that handling, storage, transmission, and retention rules are applied consistently and proportionately.

The phased process for building or changing information systems, typically including planning, requirements, design, development, testing, implementation, and maintenance, with control gates between phases.

A final validation phase in which business users exercise the system against agreed requirements and realistic scenarios, formally approving it before go-live or reporting defects for correction.

A document that authorizes a project, naming its sponsor and manager, stating objectives, scope, key deliverables, budget, milestones, and success criteria, and establishing the manager's authority.

The disciplined selection and oversight of an organization's collection of projects and programs, balancing risk, cost, and strategic contribution and eliminating duplicated or low-value initiatives.

The controlled process for requesting, reviewing, approving, testing, and recording modifications to production systems, so that changes are authorized and can be reversed if they fail.