GISP key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It is set by senior leadership and guides how security decisions trade off against business goals.

The process of choosing and applying options to address assessed risk: mitigate, transfer, avoid, or accept. Each option is documented with an owner, cost, and expected effect on the risk level.

The risk that remains after controls and treatment options have been applied. It must be compared against the risk appetite and formally accepted by an accountable business owner.

A method that ranks risk using descriptive scales such as low, medium, and high, often from expert judgment or workshops. It is fast and useful for prioritization but does not produce monetary loss estimates.

A method that expresses risk numerically, often as annualized loss expectancy derived from asset value, exposure factor, and annualized rate of occurrence. It supports cost-benefit comparison of controls.

The monetary loss expected from a single risk event, calculated as asset value multiplied by exposure factor. It feeds into annualized loss expectancy when multiplied by the annualized rate of occurrence.

The expected yearly financial loss from a given risk, calculated as single loss expectancy multiplied by the annualized rate of occurrence. It is compared with control cost to justify safeguards.

A study that identifies critical business processes and estimates the consequences of their disruption over time. Its outputs, such as recovery time objectives, drive continuity and recovery planning priorities.

A living record of identified risks, each with owner, likelihood, impact, rating, treatment plan, and status. It is reviewed on a schedule and used to report risk posture to management.

The practice of labeling information by sensitivity and business value so that handling rules can follow, such as public, internal, confidential, and restricted tiers. Labels drive access, storage, and retention decisions.

The accountable business role that decides the classification, access rules, and acceptable use of a data set. The owner delegates technical handling but retains responsibility for protection decisions.

The role that implements and operates the technical controls protecting data on behalf of the owner, such as backups, encryption, and access provisioning. Custody does not imply ownership or classification authority.

The residual representation of data left on storage media after deletion or overwrite attempts. It is addressed through overwriting, degaussing, cryptographic erasure, or physical destruction before media reuse or disposal.

A maintained record of hardware, software, data, and service assets with owner, location, and criticality. It underpins classification, patching, vulnerability scanning, and incident response scoping.

Layering independent controls across people, process, and technology so that failure of one layer does not expose the asset. Layers typically include perimeter, network, host, application, and data safeguards.

Any point where data or control passes between components with different privilege or assurance levels, such as between networks, tenants, or user and kernel space. Threats are analyzed where boundaries are crossed.

A grouping of systems and resources that share a common security policy, trust level, and administration. Domains simplify policy enforcement and limit the blast radius of a compromise.

An abstract enforcement component that mediates every access by subjects to objects, is always invoked, and is tamper-proof and verifiable. Secure kernels and hypervisors are designed to approximate these properties.

The totality of hardware, firmware, and software components that must be trusted to enforce the system security policy. Keeping it small and well reviewed reduces the chance of a flaw breaking security.

A documented, approved set of settings for a system that represents a known secure state. Deviations are detected through configuration scanning and remediated or formally excepted.

Dividing a network into zones separated by filtering controls so that traffic between zones is restricted to what policy allows. It limits lateral movement and supports least privilege at the network layer.

A design approach that grants access per request based on identity, device posture, and context rather than assumed network location. Every connection is authenticated, authorized, and encrypted regardless of origin.

Decrypting outbound or inbound Transport Layer Security traffic at a controlled gateway, examining it, then re-encrypting it. It requires certificate management and clear policy on privacy and exceptions.

A port-based network access control standard that authenticates a device or user before allowing access to a wired or wireless LAN. It relies on an authenticator, a supplicant, and an authentication server.

Granting each subject only the access needed to perform its current task, for only as long as needed. It limits the damage from error, misuse, and compromised accounts across all layers.

Assigning permissions to roles rather than individuals, then assigning users to roles based on job duties. It simplifies administration and supports review of entitlements by business function.

Making access decisions from attributes of the subject, resource, action, and environment evaluated against policy. It enables fine-grained, context-aware rules such as time, location, and device compliance.

Controls for accounts with elevated rights, including vaulting of credentials, session recording, just-in-time elevation, and approval workflows. It targets the accounts attackers most often seek to obtain.

Requiring two or more independent authentication factors, such as something you know plus something you have. It reduces the value of stolen passwords and is a common control for remote and privileged access.

A periodic, documented verification that users still need their assigned entitlements, performed by managers or resource owners. Findings are remediated and retained as evidence for auditors.

Automated probing of assets to identify known weaknesses, missing patches, and misconfigurations. Results are prioritized by severity and exploitability, then tracked to remediation with defined timelines.

An authorized, goal-driven simulation of an attacker that chains weaknesses to demonstrate real business impact. It differs from scanning by using human judgment and exploitation within agreed rules of engagement.

A structured evaluation of controls against a chosen framework or standard, using interviews, observation, and evidence sampling. It produces findings and a maturity or compliance judgment.

A platform that centralizes logs, correlates events across sources, and generates alerts for analyst review. It supports detection, investigation, and retention of evidence for response and audit.

Documented roles, steps, and communication paths for preparing, detecting, containing, eradicating, recovering from, and learning from security incidents. It is exercised through tabletop and simulation testing.

A documented, unbroken record of who handled evidence, when, and for what purpose from collection through disposal. Gaps can render digital evidence unreliable in investigations or legal proceedings.

A defined schedule for how long each log source is kept, based on legal, investigative, and operational needs. It balances storage cost against the ability to reconstruct past events.

Integrating security activities such as threat modeling, code review, and security testing into each phase of software development. It shifts defect discovery earlier, when fixes are cheaper and safer.

A structured analysis of a system design that identifies assets, entry points, likely threats, and mitigations before code is built. It documents assumptions and drives security requirements early.

Analyzing source or binary code without executing it to find patterns that indicate vulnerabilities such as injection flaws. Results require triage because false positives are common.

Identifying third-party and open-source components in a build and checking them against known vulnerability and license data. It produces a bill of materials and flags components needing upgrade.