COBIT 2019 Foundation flashcards
COBIT 2019 Foundation · Build recall with a focused review session.
23 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Governance direction
- The evaluation, prioritization and oversight of intended enterprise information-and-technology outcomes, distinct from personally executing every operational management task.
- Goals cascade
- A framework relationship connecting stakeholder needs and enterprise/alignment goals to relevant governance objectives, requiring actual context rather than a universal fixed priority.
- Target capability
- An intended process-performance level chosen under a defined assessment context and actual enterprise need, not an automatic objective to maximize every score.
- Benefit owner
- The accountable role tracking whether an intended business outcome is realized, distinct from merely completing a technical implementation milestone.
- Risk Assessment
- The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.
- Risk Management
- The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.
- Security Audit
- A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.
- Risk
- The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.
- Inherent risk
- The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.
- Residual risk
- The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.
- Risk analysis
- The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.
- Risk evaluation
- The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.
- Risk register
- A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.
- Threat
- A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.
- Vulnerability
- A weakness in a process, system, or control that could be exploited by a threat to cause harm.
- Likelihood
- The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.
- Impact
- The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.
- Control
- A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.
- Security Information and Event Management (SIEM)
- A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.
- Incident Response
- A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.
- Business Continuity Plan (BCP)
- A document that outlines how an organization will continue critical operations during and after a disruption, including strategies for recovery and restoration.
- Disaster Recovery Plan (DRP)
- A plan focused on restoring IT infrastructure and operations after a disaster, including backup restoration and recovery time objectives.
- Backup
- The process of copying data to a secondary location or medium to enable recovery in case of data loss or corruption.