COBIT 2019 Foundation key terms

The evaluation, prioritization and oversight of intended enterprise information-and-technology outcomes, distinct from personally executing every operational management task.

A framework relationship connecting stakeholder needs and enterprise/alignment goals to relevant governance objectives, requiring actual context rather than a universal fixed priority.

An intended process-performance level chosen under a defined assessment context and actual enterprise need, not an automatic objective to maximize every score.

The accountable role tracking whether an intended business outcome is realized, distinct from merely completing a technical implementation milestone.

The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.

The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.

A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.

The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.

The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.

The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.

The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.

The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.

A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.

A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.

A weakness in a process, system, or control that could be exploited by a threat to cause harm.

The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.

The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.

A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.

A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.

A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.

A document that outlines how an organization will continue critical operations during and after a disruption, including strategies for recovery and restoration.

A plan focused on restoring IT infrastructure and operations after a disaster, including backup restoration and recovery time objectives.

The process of copying data to a secondary location or medium to enable recovery in case of data loss or corruption.