CCISO cheat sheet

Risk = Threat × Vulnerability × Impact; Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO).

Risk treatment options: avoid, mitigate, transfer (insurance), and accept; residual risk is the risk remaining after controls are applied.

CISO typically owns risk management and reports to the CEO, CIO, or board risk committee; the board retains ultimate accountability for risk appetite.

Three lines of defense: operations (first), risk/compliance oversight (second), internal audit (third, independent).

Compliance is adherence to laws, regulations, and standards (e.g., GDPR, HIPAA, PCI DSS, ISO 27001); governance sets direction, risk management decides trade-offs, compliance verifies obligations.

Security governance frameworks include COBIT (IT governance), ISO/IEC 27001 (ISMS), NIST CSF (functions: Identify, Protect, Detect, Respond, Recover), and CIS Controls.

Key risk indicators (KRIs) are leading metrics that signal rising risk exposure; key performance indicators (KPIs) measure control effectiveness.

Risk register records asset, threat, vulnerability, likelihood, impact, risk score, owner, treatment, and residual risk; review cadence is typically quarterly or upon major change.

Data classification (public, internal, confidential, restricted) drives handling, access, and retention controls; data owners are accountable, custodians implement controls.

Control types: preventive (stops), detective (identifies), corrective (restores), deterrent (discourages), compensating (alternate), and recovery (restores operations).

Control categories: administrative/managerial (policies, training), technical/logical (firewalls, encryption, IAM), and physical (locks, guards, badge readers).

Defense in depth layers controls so a single failure does not compromise the asset; least privilege and separation of duties are core preventive controls.

Audit evidence must be sufficient, reliable, relevant, and useful; sampling risk exists when conclusions are drawn from a subset of a population.

Audit phases: planning/scoping, fieldwork/evidence collection, reporting, and follow-up on remediation; independence of the auditor is essential.

SOC 1 covers financial reporting controls (ICFR); SOC 2 covers security, availability, processing integrity, confidentiality, and privacy (Trust Services Criteria); SOC 3 is a public summary.

ISO/IEC 27001 certification requires an ISMS, documented risk assessment, Statement of Applicability, internal audit, management review, and corrective action (PDCA).

Compliance testing verifies control design and operating effectiveness; a deficiency is a gap between expected and actual control performance.

Chain of custody documents evidence handling (who, what, when, where) to preserve admissibility and integrity during investigations.

Program lifecycle: plan (scope, charter, stakeholders), build (controls, architecture, staffing), operate (monitoring, incident response), and improve (metrics, lessons learned).

Incident response phases (NIST): Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Business continuity (BCP) keeps critical functions running; disaster recovery (DRP) restores IT infrastructure; recovery time objective (RTO) is max downtime, recovery point objective (RPO) is max data loss.

Security operations center (SOC) tiers: Tier 1 triage, Tier 2 investigation, Tier 3 threat hunting/forensics; SIEM correlates logs; SOAR automates response.

Vulnerability management cycle: discover, prioritize (CVSS, EPSS, asset criticality), remediate/patch, verify, and report.

Identity and access management (IAM): authentication (who you are), authorization (what you can do), accounting/auditing (what you did); MFA and privileged access management reduce credential risk.

Security awareness training should be role-based, measured by phishing simulation click rates and reporting rates, and refreshed at least annually.

Metrics should be actionable: mean time to detect (MTTD), mean time to respond (MTTR), patch compliance percentage, and incident volume by severity.

CIA triad: confidentiality (encryption, access control), integrity (hashing, checksums, change control), availability (redundancy, backups, DDoS protection).

Symmetric encryption (AES) uses one shared key and is fast; asymmetric encryption (RSA, ECC) uses public/private key pairs and supports key exchange and digital signatures.

Hashing (SHA-256) provides integrity and is one-way; salting protects password hashes against rainbow tables; HMAC combines a hash with a secret key.

Authentication factors: something you know (password), something you have (token), something you are (biometrics); MFA requires two or more different factor types.

AAA: authentication, authorization, and accounting; RADIUS and TACACS+ are common AAA protocols.

Network defenses: firewalls (stateful/next-gen), IDS/IPS, DMZ segmentation, VLANs, and zero trust (never trust, always verify).

Vulnerability vs. threat vs. risk: a vulnerability is a weakness, a threat is a potential cause of harm, and risk is the likelihood and impact of exploitation.

Cryptographic key management includes generation, distribution, storage, rotation, and destruction; key length and algorithm choice determine strength.

Security strategy must align with business objectives; use SWOT analysis and balanced scorecards to link security initiatives to organizational goals.

Budget types: capital expenditure (CapEx) for long-lived assets; operating expenditure (OpEx) for recurring services; total cost of ownership (TCO) includes acquisition, operation, and disposal.

Return on security investment (ROSI) = (risk mitigated value − control cost) ÷ control cost; use ALE reduction to justify spend.

Vendor risk tiers: critical (high data access), high, medium, low; due diligence depth and review frequency scale with tier.

Third-party risk lifecycle: selection, contract (SLAs, right-to-audit, data protection clauses), onboarding, ongoing monitoring, and offboarding.

Service level agreement (SLA) defines performance commitments; service level objective (SLO) is an internal target; service level indicator (SLI) is the measured metric.

Contracts should include confidentiality, data ownership, breach notification timelines, subcontractor controls, and termination/transition assistance.

Security steering committee and executive sponsorship are required to prioritize projects; portfolio management balances risk reduction against cost and business value.