CITO flashcards
CITO · Build recall with a focused review session.
30 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Shift handover
- An accountable transfer of actual service context, state, ownership and pending actions, not merely a tally of completed tickets.
- Workaround
- An action restoring or reducing immediate service impact under authorization, without necessarily removing the underlying cause or temporary dependency.
- Condition-based maintenance
- An approach using relevant actual equipment-state evidence to inform supported maintenance decisions, alongside qualified requirements and manufacturer instructions.
- Hazardous-energy boundary
- The actual sources and stored/alternate energy relevant to qualified safe-work planning, which software-off status does not automatically isolate.
- Emergency control scope
- The site-specific equipment and logic affected by a designed emergency control, requiring qualified training rather than an assumed all-source shutdown guarantee.
- Method of procedure
- A locally approved plan for particular consequential work with relevant prerequisites, roles, sequence, verification and recovery, not a universal copied template.
- Stranded capacity
- A resource that cannot be used for the intended service because another actual local constraint or dependency prevents its deployment.
- Measurement boundary
- The defined equipment, energy/power scope and time interval used in a capacity or efficiency measure, necessary for meaningful comparison.
- Shared failure dependency
- A common resource or condition that can affect multiple nominally redundant paths, requiring scenario analysis rather than a component count.
- Risk ownership
- Accountable authority for relevant risk review and acceptance under actual criteria, distinct from an operator privately ignoring an inconvenient condition.
- Risk Assessment
- The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.
- Risk Management
- The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.
- Security Audit
- A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.
- Risk
- The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.
- Inherent risk
- The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.
- Residual risk
- The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.
- Risk analysis
- The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.
- Risk evaluation
- The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.
- Risk register
- A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.
- Threat
- A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.
- Vulnerability
- A weakness in a process, system, or control that could be exploited by a threat to cause harm.
- Likelihood
- The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.
- Impact
- The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.
- Control
- A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.
- Least Privilege
- The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.
- Separation of Duties
- A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.
- Role-Based Access Control (RBAC)
- An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.
- Multi-Factor Authentication (MFA)
- An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.
- Authentication
- The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.
- Authorization
- The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.