CCISO flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Annualized Loss Expectancy

ALE estimates yearly financial loss from a risk by multiplying single loss expectancy by annualized rate of occurrence; used to compare risk treatment options and justify security spending.

Residual Risk

The risk remaining after controls are applied and management accepts it; it must be documented in the risk register and reviewed against the organization's risk appetite.

Risk Appetite

The amount and type of risk an organization is willing to accept in pursuit of its objectives; set by senior leadership and the board, and expressed through risk tolerance thresholds.

Three Lines of Defense

A governance model where operational management owns risk (first line), risk and compliance functions provide oversight (second line), and internal audit provides independent assurance (third line).

Key Risk Indicator

A leading metric that signals increasing risk exposure before losses occur, such as number of unpatched critical systems or failed login attempts per user per day.

Data Classification

Assigning data to categories such as public, internal, confidential, or restricted so that handling, access, retention, and protection controls are proportionate to sensitivity and regulatory obligations.

Preventive Control

A control that stops an adverse event before it occurs, such as firewalls, access badges, encryption, or separation of duties; it is proactive rather than detective.

Detective Control

A control that identifies an adverse event after it occurs, such as log monitoring, intrusion detection systems, or reconciliation reviews; it does not prevent the event.

SOC 2 Report

An independent attestation covering the Trust Services Criteria of security, availability, processing integrity, confidentiality, and privacy; used to evaluate service providers that handle sensitive data.

Statement of Applicability

An ISO/IEC 27001 document listing applicable Annex A controls, justification for inclusion or exclusion, and implementation status; required for ISMS certification.

Audit Sampling Risk

The risk that an auditor's conclusion based on a sample differs from the conclusion that would be reached by testing the entire population; managed by sample size and selection method.

Chain of Custody

A documented record of who handled evidence, when, where, and why, preserving integrity and admissibility during forensic investigations and disciplinary proceedings.

Compensating Control

An alternative control that reduces risk when the primary control cannot be implemented, such as network segmentation when legacy systems cannot be patched.

Recovery Time Objective

The maximum acceptable time to restore a business process or system after disruption; it drives recovery strategy, backup design, and continuity testing.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time; it determines backup frequency and replication strategy for critical systems.

Incident Response Phases

NIST defines preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity, including lessons learned and control improvements.

Mean Time to Detect

The average elapsed time between the start of a security incident and its detection; a key SOC metric reflecting monitoring and alerting effectiveness.

Security Operations Center

A team and facility that monitors, detects, analyzes, and responds to security events, typically organized in tiers from triage to advanced threat hunting and forensics.

Privileged Access Management

Controls that secure, monitor, and audit accounts with elevated rights, including credential vaulting, session recording, just-in-time access, and periodic entitlement reviews.

Vulnerability Management Cycle

A repeatable process of discovering assets and vulnerabilities, prioritizing by severity and business criticality, remediating or mitigating, verifying, and reporting progress to stakeholders.

Security Awareness Metrics

Measurable indicators of training effectiveness such as phishing simulation click rates, report rates, completion percentages, and reduction in repeat policy violations over time.

CIA Triad

The core security objectives of confidentiality (authorized access only), integrity (accurate and unaltered data), and availability (timely and reliable access to systems and information).

Symmetric Encryption

Encryption using a single shared secret key for both encryption and decryption, such as AES; it is fast and suited to bulk data protection but requires secure key distribution.

Asymmetric Encryption

Encryption using a public and private key pair, such as RSA or ECC; it enables secure key exchange and digital signatures but is slower than symmetric encryption.

Hashing

A one-way function that produces a fixed-length digest from input, used to verify integrity; salting protects stored password hashes against precomputed rainbow table attacks.

Multi-Factor Authentication

Authentication requiring two or more different factor types: something you know, something you have, or something you are; it reduces risk from stolen passwords.

Zero Trust

A security model that assumes no implicit trust based on network location and continuously verifies identity, device health, and least-privilege access for every request.

Return on Security Investment

ROSI compares the monetary value of risk reduced by a control against the control's cost, expressed as (risk mitigated value minus control cost) divided by control cost.

Total Cost of Ownership

The full lifecycle cost of an asset or service, including acquisition, implementation, licensing, operations, support, training, and disposal, used to compare vendor proposals fairly.

Vendor Risk Tiering

Classifying third parties by data sensitivity, system access, and business criticality so that due diligence depth, contract terms, and monitoring frequency are proportionate to risk.

Service Level Agreement

A contract clause defining measurable service commitments such as uptime, response time, and breach notification, with remedies for non-performance and audit rights.

Security Steering Committee

A cross-functional governance body with executive sponsorship that prioritizes security initiatives, allocates budget, resolves conflicts, and monitors program performance against strategy.