CPSS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Chain of Custody

A documented, unbroken record of accountability for goods from origin through each transfer to final destination, showing time, location, and responsible party at every handoff.

Weakest Link Principle

The overall security of a supply chain equals the resilience of its least-secured node or link, so effort should target the weakest controls first.

Tier 2 Supplier

An indirect supplier that provides goods or services to a Tier 1 supplier rather than directly to the focal organization, often carrying the least visibility and greatest unknown risk.

Risk Appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and approved by leadership.

Residual Risk

The risk that remains after controls and treatments have been applied; it must be documented and formally accepted by an accountable risk owner.

Key Risk Indicator

A metric that signals changes in an organization's exposure to risk, used to trigger review or action before losses occur.

Risk Treatment Options

The standard responses to identified risk: avoid, reduce or mitigate, transfer, accept, and exploit when the exposure represents an opportunity rather than a threat.

Vulnerability

A weakness in a process, control, facility, or system that a threat actor or event could exploit to cause harm to supply chain assets or operations.

CARVER Matrix

A structured scoring method rating targets on criticality, accessibility, recuperability, vulnerability, effect, and recognizability to prioritize protective effort.

Risk Register

A living record of identified risks with owners, likelihood and impact ratings, treatment plans, and review dates used to track and manage exposure.

Access Control Zoning

Dividing a facility into security zones with least-privilege credentials, so personnel reach only the areas their role requires, limiting exposure of high-value assets.

Anti-Passback

An access control feature preventing a credential from being used to enter twice without an intervening exit, deterring badge sharing and tailgating.

ISO 17712 Seal

An international standard for high-security mechanical seals used on freight containers; the seal number is recorded at origin and verified at each handoff.

Geofencing

A tracking control that defines virtual geographic boundaries and triggers alerts when a shipment deviates from its planned route or stops unexpectedly.

Consolidation Point

A facility where shipments from multiple origins are combined; cargo is exposed and documents change hands, making it a high-risk node for theft or tampering.

CIA Triad

The three core information security objectives: confidentiality, integrity, and availability, applied to commercial data, EDI links, and logistics platforms.

Least Privilege

Granting each user or system only the access needed for its role, reducing the exposure of supply chain data and systems to misuse or compromise.

Third-Party Integration Risk

Cyber exposure created when partners connect through EDI, APIs, or shared platforms; managed with contractual security requirements, access reviews, and monitoring.

Insider Threat

Risk from employees, contractors, or partners who misuse authorized access, motivated by financial gain, coercion, ideology, disgruntlement, or negligence.

Segregation of Duties

Splitting sensitive tasks among different people so no single individual can both commit and conceal a fraudulent or insecure act.

Pre-Employment Screening

Verification of identity, employment history, references, and criminal record where lawful, with depth matched to the sensitivity of the role.

Supplier Due Diligence

Pre-contract assessment of a supplier's security posture, financial stability, and compliance history, repeated periodically during the relationship.

Denied-Party Screening

Checking customers, suppliers, and shipments against sanctions and export control lists before transaction, a mandatory compliance step in many jurisdictions.

Record Retention Requirement

A legal or regulatory obligation to keep shipping, screening, and access records for a defined period, supporting audits, investigations, and customs inquiries.

C-TPAT

A US Customs and Border Protection voluntary partnership with trade stakeholders that requires documented supply chain security measures in exchange for reduced inspections.

Authorized Economic Operator

A World Customs Organization-aligned trusted-trader status granted to compliant operators, offering faster clearance and reduced inspections in participating countries.

Incident Severity Classification

Assigning incidents to defined severity levels that determine escalation paths, notification obligations, and the resources committed to response.

Post-Incident Review

A structured examination after an incident to identify root causes, capture lessons, and track corrective actions to closure.

Business Impact Analysis

An assessment identifying critical processes, their dependencies, and maximum tolerable downtime, forming the basis for continuity strategies and recovery priorities.

Recovery Time Objective

The target time within which a critical process or system must be restored after disruption, derived from the business impact analysis.

Supplier Diversification

Using multiple suppliers, carriers, or routes to reduce single-point-of-failure exposure and maintain flow during disruption.

Corrective Action Closure

The audited confirmation that a finding's root cause has been remediated and verified, allowing the finding to be formally closed in the audit record.