CITO key terms

An accountable transfer of actual service context, state, ownership and pending actions, not merely a tally of completed tickets.

An action restoring or reducing immediate service impact under authorization, without necessarily removing the underlying cause or temporary dependency.

An approach using relevant actual equipment-state evidence to inform supported maintenance decisions, alongside qualified requirements and manufacturer instructions.

The actual sources and stored/alternate energy relevant to qualified safe-work planning, which software-off status does not automatically isolate.

The site-specific equipment and logic affected by a designed emergency control, requiring qualified training rather than an assumed all-source shutdown guarantee.

A locally approved plan for particular consequential work with relevant prerequisites, roles, sequence, verification and recovery, not a universal copied template.

A resource that cannot be used for the intended service because another actual local constraint or dependency prevents its deployment.

The defined equipment, energy/power scope and time interval used in a capacity or efficiency measure, necessary for meaningful comparison.

A common resource or condition that can affect multiple nominally redundant paths, requiring scenario analysis rather than a component count.

Accountable authority for relevant risk review and acceptance under actual criteria, distinct from an operator privately ignoring an inconvenient condition.

The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.

The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.

A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.

The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.

The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.

The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.

The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.

The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.

A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.

A potential cause of an unwanted incident that could harm an asset or organization, such as an attacker, malware, or natural event.

A weakness in a process, system, or control that could be exploited by a threat to cause harm.

The probability that a threat event will occur and exploit a vulnerability, expressed qualitatively or quantitatively. It is one factor used to rate risk.

The consequence or magnitude of loss or harm to the organization if a risk event occurs. It may be financial, operational, legal, or reputational.

A safeguard, policy, procedure, or technical measure that reduces the likelihood or impact of a risk event.

The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.

A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.

An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.

An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.

The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.

The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.