GCT-2A-324 key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms. It guides decisions about which risks to treat and how much control is proportionate.

The acceptable variation around the risk appetite for a specific category or metric. It sets practical thresholds that trigger escalation when exceeded, translating broad appetite statements into operational limits.

The process of selecting and applying options to modify risk: avoid, reduce, transfer, or accept. Each option is chosen based on cost, residual exposure, and alignment with appetite, then documented and monitored.

The risk remaining after existing controls and treatments are applied. It is compared against tolerance to decide whether further action is needed and is the figure normally reported to management.

The level of risk that exists before any controls are applied. Comparing it with residual risk shows how much protection current controls actually provide and where investment is most justified.

A forward-looking metric that signals rising exposure in a process or area before losses occur. Effective indicators are measurable, tied to a specific risk, and have defined thresholds for escalation.

A structured record of identified risks, each with owner, likelihood, impact, existing controls, treatment plan, and status. It is the working document that supports periodic risk review and reporting.

A control that prevents one person from initiating, approving, and recording the same transaction. Splitting these responsibilities reduces the chance of error or fraud going undetected.

A missing or ineffective control that leaves an identified risk insufficiently mitigated. Gaps are recorded with an owner and remediation date, then retested to confirm the fix works.

A minimum set of safeguards mandated for a system or class of systems. Baselines are derived from standards or frameworks and tailored through documented exceptions approved by an accountable authority.

Layering independent controls so that failure of one does not expose the whole system. Layers typically span physical, network, host, application, and data protection, requiring an attacker to defeat several.

An architecture principle that grants no implicit trust based on network location. Every request is authenticated, authorized, and evaluated against policy using identity, device health, and context signals.

Dividing a network or workload environment into small zones with explicit allow rules between them. It limits lateral movement by ensuring a compromised host can reach only what policy permits.

The complete set of hardware, firmware, and software components whose correct operation is necessary to enforce the security policy. Smaller, simpler bases are easier to verify and reduce attack surface.

The sum of points where an attacker could attempt to enter or extract data from a system. It includes exposed services, interfaces, credentials, and human processes, and should be minimized deliberately.

An authentication arrangement where one successful login grants access to multiple applications. It improves usability and centralizes policy enforcement but concentrates risk in the primary credential.

An arrangement where separate organizations or systems trust each other's identity assertions, letting users access resources without separate accounts. Trust is established through shared standards and configured metadata.

A signed XML statement from an identity provider about a subject's authentication and attributes. The service provider validates the signature and conditions before granting access to a resource.

Requiring two or more independent credential types, such as a password plus a hardware key. Independence matters: two passwords or two knowledge questions do not constitute multiple factors.

Granting identities only the permissions needed for their current task, for only as long as needed. It limits the blast radius of a compromised account and simplifies access review.

Controls that secure accounts with elevated rights: vaulting credentials, brokering sessions, recording activity, and requiring approval or time limits. It targets the accounts attackers most want.

A periodic review in which owners confirm that each user's access remains justified. Unconfirmed entitlements are revoked, producing evidence that access reflects current business need.

A network segment between internal networks and the internet that hosts externally reachable services. Rules restrict traffic so a compromised host there cannot freely reach internal systems.

Controlling outbound traffic from a network to permitted destinations and protocols. It blocks command-and-control callbacks and data exfiltration that inbound firewalls alone would not stop.

A proxy or inline device that inspects HTTP traffic and blocks requests matching attack patterns or policy violations. It complements secure coding rather than replacing input validation.

Enforcing admission decisions for devices joining a network based on identity and posture checks. Noncompliant devices are quarantined or given limited access until remediated.

Encrypting data with a data key, then encrypting that key with a longer-lived key encryption key. It limits how often master keys are used and simplifies rotation and per-object access.

Replacing cryptographic keys periodically or after compromise, re-encrypting protected material as needed. Rotation limits the volume of data exposed if a single key is later broken or leaked.

A tamper-resistant appliance that generates and stores keys and performs cryptographic operations inside its boundary. Keys typically cannot be exported, reducing exposure to host compromise.

Tools and policies that detect and block sensitive data leaving approved boundaries, whether by email, web, or endpoint copy. Rules rely on classification labels and content patterns.

Assigning sensitivity labels such as public, internal, confidential, or restricted so handling rules can follow. Labels drive encryption, retention, access, and sharing decisions consistently.

Observable evidence suggesting a system has been breached, such as a malicious hash, domain, or registry key. Indicators are shared for detection but age quickly as attackers adapt.

A platform that centralizes logs, correlates events, and raises alerts against detection rules. Its value depends on adequate log coverage, tuned rules, and staff able to triage output.

A documented set of roles, phases, and communication paths for handling security incidents from detection through recovery. It is validated through exercises rather than assumed to work.

A documented, unbroken record of who handled evidence, when, and why. It preserves admissibility and credibility during investigation and any later legal or disciplinary process.

Checking that data entering an application matches expected type, length, and format before use. Allow-list validation on trusted servers is a primary defense against injection and malformed input.

Scanning a codebase and its dependencies to identify known vulnerable or unlicensed components. It produces an inventory and flags versions needing upgrade, supporting patch prioritization.

A machine-readable inventory of components and their versions contained in a software product. It lets consumers rapidly determine exposure when a dependency vulnerability is disclosed.

Evaluating a vendor's security posture, contractual obligations, and dependency on subcontractors before and during engagement. Findings determine required controls, review frequency, and contractual terms.

A contract provision allowing the customer to examine a supplier's controls, reports, or premises. It gives leverage to verify assurances rather than relying solely on self-reported questionnaires.