CP-C key terms

A high-level written statement of management intent that sets mandatory direction and boundaries for how an organization operates. Policies are approved by senior leadership and are supported by more detailed standards and procedures.

A mandatory requirement that specifies the minimum acceptable level of controls, configuration, or performance. Standards turn broad policy statements into measurable rules that teams can be audited against.

A step-by-step description of how to perform a specific task in line with policy and standards. Procedures tell staff exactly what to do, who does it, and in what order.

Any safeguard, countermeasure, or process put in place to reduce risk to an acceptable level. Controls may be preventive, detective, or corrective, and can be technical, administrative, or physical.

A living record of identified risks, each with an owner, likelihood and impact rating, planned treatment, and current status. It is the main tool used to track and report risk over time.

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It guides decisions about which risks to treat and how much effort to invest in controls.

The risk that remains after existing controls and treatments have been applied. It is compared against risk appetite to decide whether further action is required.

Splitting critical tasks so that no single person can initiate, approve, execute, and record a transaction. This limits the chance of error or fraud going undetected.

A chronological record of who did what, when, and from where within a system. Audit trails support investigation, accountability, and proof that controls operated as designed.

Documentation or artifacts that demonstrate a control was designed and operated as described. Auditors request evidence such as logs, approvals, screenshots, and reports.

A measurable metric that provides early warning that a risk is increasing. KRIs are tracked against thresholds so management can act before losses occur.

Granting each user, service, or system only the access needed to do its job, and no more. It limits the damage that a compromised account or faulty process can cause.

Logging in with two or more independent proofs of identity, such as a password plus a code from a phone. It blocks most attacks that rely on stolen passwords alone.

Encoding stored data so it cannot be read without the correct key. It protects files and databases if disks, backups, or storage media are lost or stolen.

Protecting data while it moves between systems or users, typically with protocols such as TLS. It prevents eavesdropping and tampering on networks.

The practices for generating, storing, rotating, and destroying cryptographic keys, and controlling who can use them. Weak key handling defeats the purpose of encryption.

A weakness in software, configuration, or process that an attacker could exploit to harm the organization. Vulnerabilities are identified through scanning, testing, and external reporting.

The process of testing, approving, and applying vendor updates that fix known flaws. Timely patching reduces the window in which a vulnerability can be exploited.

A security model that assumes no network location is inherently safe and verifies every request. Access decisions are based on identity, device health, and context rather than perimeter location.

A periodic check in which system owners confirm that each user still needs their assigned permissions. Unneeded or excessive access is removed during the review.

A documented set of roles, steps, and communication paths for detecting, containing, eradicating, and recovering from a security or service incident. It is tested through exercises.

A study that identifies critical business functions and estimates the harm caused if they stop. Its results set recovery priorities and recovery objectives.

The maximum acceptable time a business function can be unavailable after a disruption. It drives how quickly recovery capabilities must restore service.

The maximum acceptable amount of data, measured in time, that may be lost in a disruption. It sets how often backups or replication must occur.

Documented arrangements that let an organization keep delivering critical services during and after a disruption, using workarounds, alternate sites, and manual processes.

The technical plans and capabilities for restoring IT systems, data, and infrastructure after a major outage. It focuses on rebuilding systems within agreed recovery objectives.

A controlled process for requesting, assessing, approving, testing, and recording changes to production systems. It reduces the risk that a change causes an outage or a control failure.

An approved, documented set of settings for a system or device that represents the secure, working state. Deviations from the baseline are detected and corrected.

A structured investigation to find the underlying reason a problem occurred, rather than just its symptoms. Findings should lead to changes that prevent recurrence.

A contract between a provider and a customer that states the expected level of service and the remedies if it is missed. It usually includes availability, response, and resolution targets.

Continuously collecting and reviewing system and security events so unusual or harmful activity is noticed quickly. Logs also support troubleshooting, audits, and investigations.

Sorting information into categories such as public, internal, confidential, and restricted so that handling rules match sensitivity. Classification drives access, encryption, and retention decisions.

Data that can identify a specific living person, alone or combined with other data. It carries legal handling obligations and is a common target of attackers and regulators.

Collecting and keeping only the personal data actually needed for a stated purpose. It reduces privacy risk and the cost of protecting and retaining unnecessary data.

Rules that define how long each type of data is kept and how it is destroyed afterwards. Retention balances legal or operational needs against privacy and storage risk.

The risk that a vendor, supplier, or partner fails to protect data or deliver services, harming the organization. It is managed through due diligence, contract terms, and ongoing monitoring.

A structured assessment of a third party's controls, finances, and reputation before and during a relationship. It gives decision makers evidence on which to base approval.

A maintained list of the organization's hardware, software, data, and services, with owners and locations. You cannot protect or patch what you have not recorded.