CISAW Risk Management key terms

A model that describes the three core goals of information security: confidentiality (keeping data secret), integrity (keeping data accurate and unaltered), and availability (ensuring data and systems are accessible when needed).

The property that information is not disclosed to unauthorized individuals, processes, or devices. It is achieved through encryption, access controls, and proper handling procedures.

The property that data has not been altered or destroyed in an unauthorized manner. It ensures data is accurate, complete, and trustworthy throughout its lifecycle.

The property that systems and data are accessible and usable by authorized users when required. It is supported by redundancy, backups, and resilience measures.

A security strategy that uses multiple layers of controls (physical, technical, and administrative) so that if one layer fails, others still protect the asset.

The leadership, structures, and processes that ensure IT supports enterprise strategy, objectives, and risk appetite while using resources responsibly.

An organization-wide approach to identifying, assessing, responding to, and monitoring risks that could affect strategic objectives. It aligns risk management with strategy and governance.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, often expressed as qualitative statements or quantitative limits.

The acceptable variation in outcomes around a risk appetite, often expressed as thresholds or limits for specific risk categories.

A governance model separating management (first line), risk and compliance oversight (second line), and independent internal audit (third line).

The tone and structure set by leadership that influences risk awareness, integrity, ethical values, and the effectiveness of internal controls.

Dividing tasks and approvals so no single person can initiate, authorize, record, and review a transaction without detection.

The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.

The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.

A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.

The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.

The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.

The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.

The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.

The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.

A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.

A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.

A weakness in a process, system, or control that could be exploited by a threat to cause harm.

The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.

The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.

A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.

The action taken to modify risk by avoiding, reducing, sharing, or accepting it, based on cost, benefit, and appetite.

A response that eliminates the activity or condition giving rise to a risk rather than trying to control it.

A response that shifts the financial consequences of a risk to another party, such as through insurance or contractual arrangements.

A response in which management acknowledges a risk and decides not to act, provided the exposure remains within tolerance.