CPP (PayrollOrg Certifications) key terms

The likelihood that a threat will exploit a vulnerability and the resulting impact on an organization's assets, people, or operations.

Any person, event, or condition with the potential to cause harm, loss, or disruption to an organization's people, assets, or operations.

A weakness in a system, process, or physical structure that a threat could exploit to cause harm, loss, or disruption.

A systematic process of identifying assets, threats, and vulnerabilities, then estimating likelihood and impact so security measures can be prioritized.

The level of risk that remains after security controls and countermeasures have been applied, and which management formally accepts.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, often expressed as a tolerance threshold.

A layered security strategy that uses multiple independent controls so that if one fails, others continue to protect the asset.

A high-level written statement of management's intent and direction for protecting the organization's assets, which guides supporting standards, procedures, and guidelines.

Anything of value to an organization, including people, information, equipment, facilities, and reputation, that requires protection from harm or loss.

A method of comparing the cost of a security control against the expected reduction in losses to judge whether the investment is justified.

A financial measure that compares the gain from an investment against its cost, usually expressed as a percentage of the amount invested.

The reasonable care and investigation an organization is expected to perform to identify and prevent foreseeable risks before making decisions or taking action.

Failure to exercise the degree of care a reasonable person would use in similar circumstances, resulting in foreseeable harm or loss.

Any individual or group with an interest in, or affected by, an organization's security decisions, including employees, customers, owners, and regulators.

A measurable value, tracked over time, that shows how effectively an organization is achieving a specific security objective or operational goal.

The documented, unbroken record of who handled evidence, when, and how, from collection through final disposition, used to prove its integrity.

Any information, object, testimony, or record that tends to prove or disprove a fact relevant to an investigation or legal proceeding.

A reasonable belief, based on facts and circumstances, that a person has committed an offense or that evidence will be found in a specific place.

A structured, non-accusatory conversation with a person to gather information about an incident, his or her role, or observations.

A formal, accusatory questioning process used to obtain admissions or confessions from a suspect after the facts of a case have been established.

The covert or overt observation of people, places, or activities to gather information, detect wrongdoing, or collect evidence.

Verification of a candidate's or employee's history, such as identity, employment, education, and criminal record, to assess suitability and risk.

Risk posed by a current or former employee, contractor, or business partner who misuses authorized access to harm the organization.

A control that divides a sensitive task among different people so no single person can both commit and conceal an error or fraud.

A legal contract in which a person promises not to disclose confidential information learned through employment or a business relationship.

Shaping the physical environment to reduce crime through natural surveillance, access control, territorial reinforcement, and maintenance.

The process of permitting or denying entry to a person, vehicle, or data resource based on verified identity or authorization.

An unauthorized person following an authorized person through a controlled door or gate without presenting their own credentials.

A system of sensors and alarms that detects unauthorized entry into a protected area and alerts guards or responders.

A control requiring two authorized individuals to be present for a sensitive action, reducing the risk of theft, fraud, or misuse.

A principle limiting access to information to individuals whose job duties specifically require it, regardless of their general clearance or rank.

Giving users only the minimum access rights needed to perform their assigned tasks, and only for as long as required.

The three core goals of information security: confidentiality, meaning only authorized access; integrity, meaning accuracy and completeness; and availability, meaning reliable access when needed.

A social engineering attack that tricks people into revealing credentials or clicking malicious links by imitating a trusted person or brand.

The process of labeling information by sensitivity and value so appropriate handling, storage, and access controls can be applied.

Documented procedures for keeping critical business functions running during and after a disruption, using alternate sites, resources, and manual workarounds.

A plan focused on restoring IT systems, data, and infrastructure after a major disruption, including backup, recovery, and relocation procedures.

The process of delivering timely, accurate, and consistent messages to employees, media, customers, and other stakeholders during an emergency.

A discussion-based drill in which participants walk through a simulated emergency scenario to test plans, roles, and decision-making.

The maximum acceptable time a business process or system can be unavailable after a disruption before serious harm occurs.