CPA ISC key terms

The system by which an organization directs and controls its IT resources, aligning technology decisions with business strategy, assigning accountability for outcomes, and monitoring performance and risk.

The amount and type of risk an organization is willing to accept while pursuing its objectives, used as a benchmark for deciding whether specific IT and security risks require treatment.

The level of risk that exists before management applies any controls, reflecting the nature of the process, system, or data and the environment in which it operates.

The risk that remains after controls and mitigations have been applied; management compares it with risk appetite to decide whether further action is needed.

Controls over the technology environment that support reliable processing across many applications, typically covering access management, change management, IT operations, and backup and recovery.

Dividing responsibilities so that no single person can both cause and conceal an error or fraud, for example by separating authorization, custody of assets, and recordkeeping.

A framework for enterprise governance and management of IT that defines processes, practices, and goals connecting technology activities to business objectives and stakeholder needs.

A contract between a service provider and a customer that specifies expected service levels, performance metrics, responsibilities of each party, and remedies for missed targets.

Documented procedures for maintaining or restoring critical business functions during and after a disruption, addressing people, processes, technology, facilities, and communications.

A plan focused on restoring IT infrastructure, applications, and data after an outage, defining recovery priorities, roles, steps, and the resources required.

The maximum acceptable time a system or process can be unavailable before the business impact becomes unacceptable, which drives recovery strategy and investment.

The maximum acceptable amount of data loss, expressed in time, which determines how frequently backups or data replication must occur.

The process of identifying, assessing, and monitoring risks introduced by vendors and service providers, including their security practices, financial stability, and regulatory compliance.

A measurable metric that provides early warning that risk exposure is increasing, giving management time to act before losses or incidents occur.

The policies, roles, and processes that establish who is accountable for data quality, availability, security, and appropriate use across the organization.

A repository describing the meaning, format, permitted values, ownership, and relationships of data elements so users interpret and apply data consistently.

A centralized repository that consolidates data from multiple source systems and structures it for querying, analysis, and reporting rather than for transaction processing.

A process that extracts data from source systems, transforms it by cleaning and reformatting, and loads it into a target repository such as a data warehouse.

Core reference data shared across systems and processes, such as customers, products, and vendors, which must stay consistent to support reliable operations and reporting.

The accuracy, completeness, and consistency of data throughout its lifecycle, supported by controls over input, processing, storage, transmission, and access so that reports and decisions can be trusted.

Software that stores, organizes, and controls access to data in a database, enforcing integrity rules and providing query, concurrency, and recovery capabilities.

Assigning data to categories such as public, internal, confidential, or restricted based on sensitivity, so that appropriate handling and protection controls are applied.

Delivery of computing services such as servers, storage, software, and networks over the internet on demand, usually under a shared responsibility model between provider and customer.

Converting readable data into ciphertext using a cryptographic key so that only parties holding the correct key can reverse the process and read the information.

Transforming data into a fixed-length value that serves as a digital fingerprint; the process is one-way and is used to verify integrity and protect stored passwords.

Requiring two or more independent credentials, such as a password plus a one-time code or biometric, before granting access, reducing the risk of compromised passwords.

Granting users and systems only the access rights required to perform their assigned duties, limiting the harm that errors, misuse, or compromised accounts can cause.

The right of individuals to control how their personal information is collected, used, shared, and retained, creating obligations for organizations that handle it.

Data that can identify a specific individual, either alone or when combined with other information, and that therefore triggers legal and policy protections.

Documented procedures that guide an organization in detecting, containing, eradicating, and recovering from security incidents, including escalation, communication, and evidence preservation steps.

A systematic review that identifies and ranks weaknesses in systems, applications, and configurations, typically without exploiting them, so remediation can be prioritized.

Authorized simulated attacks against systems and applications that attempt to exploit vulnerabilities, testing how well security controls resist a determined adversary.

Tools and policies that monitor and block unauthorized movement of sensitive data outside approved boundaries, whether through email, web traffic, or removable media.

A structured sequence of phases-planning, analysis, design, build, test, implement, and maintain-used to develop, acquire, and retire information systems.

Testing performed by end users and business owners to confirm that a system meets stated requirements and is ready to be placed into production.

A controlled process for requesting, reviewing, approving, testing, and implementing changes to IT systems so that unauthorized or disruptive changes are prevented.

Keeping development, testing, and production environments separate so that untested programs and developers cannot affect live data or disrupt operations.

Transferring data from legacy or source systems into a new system, including extraction, cleansing, mapping, loading, and reconciliation to confirm completeness and accuracy.

An evaluation after a system goes live that compares actual costs, benefits, and performance with the original business case and captures lessons learned.

A framework of IT service management best practices covering service strategy, design, transition, operation, and continual improvement, used to structure IT operations.