CPP (PayrollOrg Certifications) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk formula

Risk equals threat likelihood multiplied by vulnerability and consequence; used to rank exposures and prioritize mitigation spending.

Defense in depth

Layered controls-physical, procedural, and technical-so failure of one layer does not expose the asset; redundancy increases attacker effort and detection chance.

CPTED

Crime Prevention Through Environmental Design uses natural surveillance, access control, territorial reinforcement, and maintenance to reduce opportunity for crime in a facility.

Deterrence

Security control that persuades an adversary not to attempt an act by increasing perceived risk, effort, or cost; effective only if the threat perceives and believes it.

Least privilege

Granting users and processes only the access needed for assigned tasks and no more; limits damage from error, compromise, or misuse.

Return on investment

ROI equals net benefit divided by cost, often shown as a percentage; security proposals use it to compare expected loss reduction against implementation cost.

Cost-benefit analysis

Systematic comparison of control costs against avoided losses and other benefits; a control is justified when expected loss reduction exceeds total cost over the analysis period.

Business impact analysis

Process identifying critical business functions, dependencies, and outage tolerances; outputs recovery priorities and maximum tolerable downtime used to set continuity strategies.

Key performance indicator

Quantifiable measure tied to a security objective, such as incident rate or response time; should be specific, measurable, achievable, relevant, and time-bound.

Total cost of ownership

All costs of acquiring, operating, maintaining, and retiring a security system over its life; prevents decisions based only on initial purchase price.

Chain of custody

Chronological record documenting who handled evidence, when, where, and why; gaps or undocumented transfers can undermine admissibility and evidentiary weight.

Locard exchange principle

Every contact leaves a trace; offenders both deposit and remove material at a scene, guiding collection of physical and trace evidence.

Interview versus interrogation

Interview gathers information from cooperative subjects; interrogation is accusatory and designed to elicit admissions from suspects, with legal constraints and documentation requirements.

Workplace investigation

Internal inquiry into policy violation or misconduct; must be prompt, impartial, documented, and limited to need-to-know, with interview and evidence records retained.

Evidence integrity

Maintaining evidence unchanged and authenticated from seizure through disposition; requires proper packaging, sealing, labeling, secure storage, and controlled access.

Pre-employment screening

Verification of identity, work history, credentials, and criminal record before hire; scope must be job-related, consistent, and compliant with applicable law.

Insider threat

Risk from authorized persons who misuse access, intentionally or unknowingly; controls include behavior monitoring, least privilege, and separation of duties.

Need-to-know

Access granted only when a person requires specific information to perform assigned duties; separate from rank or clearance level and reviewed when duties change.

Separation checklist

Structured offboarding steps-revoke access, recover assets, collect credentials, conduct exit interview, and update records-to prevent post-employment risk.

Layered perimeter

Multiple physical barriers from property line to asset-fences, lighting, doors, locks, and detection-each delaying or revealing intruders before the protected asset.

Access control point

Controlled opening where identity is verified and authorization checked before entry; should have positive control, throughput planning, and fail-safe or fail-secure mode defined.

Fail-safe versus fail-secure

Fail-safe unlocks on power loss for life safety egress; fail-secure remains locked to protect assets; selection depends on occupancy and code requirements.

Intrusion detection zone

Defined area monitored by sensors that alarm on movement, breakage, or opening; zone size and sensor type determine alarm accuracy and response.

Security lighting

Illumination designed to deter intrusion and support CCTV or guard observation; uniformity and glare control matter more than raw brightness.

CIA triad

Confidentiality, integrity, and availability-the three core information security objectives used to classify controls and evaluate risk.

Multi-factor authentication

Authentication using two or more independent factor types-knowledge, possession, or inherence; combining two passwords does not satisfy the requirement.

Data classification

Labeling information by sensitivity and handling requirements, such as public, internal, confidential, and restricted; drives access, storage, and disposal rules.

Incident response lifecycle

Phases typically include preparation, detection and analysis, containment, eradication, recovery, and lessons learned; documented playbooks shorten response time.

Crisis management team

Pre-designated leaders with defined roles-incident commander, communications, operations, logistics, and liaison-who direct response from a designated command location.

Tabletop exercise

Discussion-based simulation of a crisis scenario that tests plans, roles, and decisions without deploying resources; reveals gaps in communication and authority.

Recovery time objective

Maximum acceptable time to restore a process or system after disruption; drives backup, redundancy, and continuity strategy selection.

Crisis communication plan

Pre-approved procedures, spokespersons, channels, and message templates for notifying employees, authorities, customers, and media during an incident.