CISAW Risk Management flashcards
CISAW Risk Management · Build recall with a focused review session.
30 cards. Read the term and the definition here. The deck at the top of this page is optional.
- CIA Triad
- A model that describes the three core goals of information security: confidentiality (keeping data secret), integrity (keeping data accurate and unaltered), and availability (ensuring data and systems are accessible when needed).
- Confidentiality
- The property that information is not disclosed to unauthorized individuals, processes, or devices. It is achieved through encryption, access controls, and proper handling procedures.
- Integrity
- The property that data has not been altered or destroyed in an unauthorized manner. It ensures data is accurate, complete, and trustworthy throughout its lifecycle.
- Availability
- The property that systems and data are accessible and usable by authorized users when required. It is supported by redundancy, backups, and resilience measures.
- Defense in Depth
- A security strategy that uses multiple layers of controls (physical, technical, and administrative) so that if one layer fails, others still protect the asset.
- IT governance
- The leadership, structures, and processes that ensure IT supports enterprise strategy, objectives, and risk appetite while using resources responsibly.
- Enterprise risk management
- An organization-wide approach to identifying, assessing, responding to, and monitoring risks that could affect strategic objectives. It aligns risk management with strategy and governance.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of its objectives, often expressed as qualitative statements or quantitative limits.
- Risk tolerance
- The acceptable variation in outcomes around a risk appetite, often expressed as thresholds or limits for specific risk categories.
- Three lines model
- A governance model separating management (first line), risk and compliance oversight (second line), and independent internal audit (third line).
- Control environment
- The tone and structure set by leadership that influences risk awareness, integrity, ethical values, and the effectiveness of internal controls.
- Segregation of duties
- Dividing tasks and approvals so no single person can initiate, authorize, record, and review a transaction without detection.
- Risk Assessment
- The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.
- Risk Management
- The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.
- Security Audit
- A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.
- Risk
- The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.
- Inherent risk
- The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.
- Residual risk
- The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.
- Risk analysis
- The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.
- Risk evaluation
- The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.
- Risk register
- A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.
- Threat
- A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.
- Vulnerability
- A weakness in a process, system, or control that could be exploited by a threat to cause harm.
- Likelihood
- The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.
- Impact
- The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.
- Control
- A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.
- Risk response
- The action taken to modify risk by avoiding, reducing, sharing, or accepting it, based on cost, benefit, and appetite.
- Risk avoidance
- A response that eliminates the activity or condition giving rise to a risk rather than trying to control it.
- Risk transfer
- A response that shifts the financial consequences of a risk to another party, such as through insurance or contractual arrangements.
- Risk acceptance
- A response in which management acknowledges a risk and decides not to act, provided the exposure remains within tolerance.