CNITSEC CISM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk

The potential for loss or harm resulting from a threat exploiting a vulnerability, commonly expressed as likelihood multiplied by impact on an asset.

Residual Risk

The risk remaining after controls have been implemented; it must be formally accepted by the asset or business owner within the organization's risk tolerance.

Risk Appetite

The total amount and type of risk an organization is willing to pursue or retain in order to achieve its business objectives, set by senior leadership.

Annualized Loss Expectancy

ALE equals Single Loss Expectancy multiplied by Annualized Rate of Occurrence; it estimates expected yearly financial loss for a given risk.

Risk Register

A structured record of identified risks including description, asset, threat, vulnerability, existing controls, likelihood, impact, rating, treatment, owner, and residual risk.

Threat Modeling STRIDE

A design-phase technique classifying threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Statement of Applicability

A mandatory ISMS document listing every Annex A control, whether it applies, the justification, and its implementation status, reviewed during certification audits.

PDCA Cycle

The continuous improvement model underlying ISO/IEC 27001: Plan establishes the ISMS, Do implements controls, Check monitors and audits, Act corrects and improves.

Management Review

A periodic review led by top management covering audit results, risk status, incidents, and legal changes, producing decisions on improvement and resources.

Internal Audit

An independent, planned examination of ISMS processes and controls performed by personnel not responsible for the audited activity, feeding corrective action.

Nonconformity

A failure to meet a requirement; corrective action must address root cause and verify effectiveness, distinct from a simple correction of the observed symptom.

ISMS Scope

The defined boundaries of the management system, considering internal and external issues, interested parties, interfaces, and dependencies; changes require risk reassessment.

ISO/IEC 27001

The international standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system.

ISO/IEC 27002

A guidance standard providing implementation advice for information security controls; it supports but does not replace the requirements of ISO/IEC 27001.

Three Lines Model

A governance structure where operational management owns risk, oversight functions monitor and advise, and internal audit provides independent assurance.

Security Policy

A mandatory high-level statement approved by top management defining security objectives, commitments, responsibilities, and the framework for continual improvement.

Segregation of Duties

A control separating incompatible responsibilities, such as development and production operations or approval and execution, to reduce fraud and error risk.

CIA Triad

The core security objectives of Confidentiality, Integrity, and Availability, extended by properties such as non-repudiation, accountability, and authenticity.

Key Risk Indicator

A metric that signals changes in risk exposure over time, enabling governance bodies to monitor trends and take timely decisions.

Business Alignment

The principle that information security strategy and investment must support and be justified by business objectives and risk reduction value.

Risk Treatment Options

The four responses to risk: mitigate by applying controls, transfer via insurance or contract, avoid by eliminating the activity, or accept with owner approval.

Defense in Depth

Layering complementary preventive, detective, and corrective controls so that failure of any single control does not compromise the asset.

Role-Based Access Control

An access control model granting permissions to roles rather than individuals, with users assigned to roles based on least privilege and need-to-know.

Multi-Factor Authentication

Authentication using two or more factors from different categories: something you know, something you have, and something you are.

Digital Signature

A cryptographic mechanism using asymmetric keys that provides integrity, authentication of origin, and non-repudiation, but not confidentiality of content.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design for recovery planning.

Incident Response Phases

NIST SP 800-61 phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity including lessons learned.

Chain of Custody

Documented record of who handled evidence, when, where, and how, preserving admissibility; forensic images require write protection and hash verification.

Incident Severity Classification

Assigning incident levels based on impact scope, data sensitivity, business disruption, and legal reporting obligations, which determine escalation and response times.

Problem Management

A process focused on identifying and eliminating root causes of recurring incidents, distinct from incident management's goal of rapid service restoration.

Data Classification

Assigning sensitivity levels to information so that handling, access, retention, and protection controls are proportionate and consistently applied.

Personal Information Protection Law

Chinese legislation requiring lawful basis, notice and consent, minimum necessity, separate consent for sensitive data, and impact assessments for processing.