CPIT InfoSec key terms

The set of structures, processes and accountability relationships a governing body uses to direct and control security so that it supports organisational objectives, meets obligations and manages risk within agreed tolerance.

The amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed as thresholds or statements that guide decisions about whether to treat, transfer, avoid or accept a given risk.

The deliberate choice among avoiding, reducing, sharing or accepting a risk, followed by implementing the chosen controls and recording the residual risk for the accountable owner's sign-off.

The risk that remains after existing or planned controls have been applied. It must be estimated and compared against the risk appetite before an owner formally accepts it.

A judgement of how well a control, as actually operated, reduces the likelihood or impact of the risk it addresses, based on evidence such as test results, incident history and monitoring data.

The hierarchy of documents governing security: a top-level policy stating intent and mandatory requirements, supporting standards that specify what is required, and procedures describing how staff carry out those requirements day to day.

A document stating how staff may use organisational systems, data and devices, including permitted activities, prohibitions and consequences, which supports disciplinary action when behaviour falls short of the stated rules.

Splitting a sensitive process so that no single person can both initiate and approve or conceal an action, reducing the chance of error or fraud by requiring collusion across two or more roles.

The ongoing, demonstrable effort an organisation makes to identify its obligations and apply reasonable safeguards, used in legal and audit contexts to show it acted responsibly rather than negligently.

The investigation and verification carried out before or during a relationship, such as assessing a supplier's security posture or a third party's compliance, so that decisions rest on evidence rather than assumption.

Exposure arising from suppliers, outsourcers and partners that process data or connect to systems, managed through due diligence, contractual security clauses, ongoing monitoring and exit planning.

Layering independent controls across people, process and technology so that failure or bypass of one control does not by itself expose the asset, and attackers must defeat several barriers in sequence.

An architecture principle under which no network location is inherently trusted; every request is authenticated, authorised against policy and continuously evaluated using identity, device and context signals before access is granted.

Dividing a network or workload environment into small zones with enforced, workload-level access rules, so that a compromised host cannot freely reach unrelated systems even inside the same data centre.

Technology that checks a device's identity and health before admitting it to a network segment, often placing non-compliant endpoints into a restricted remediation network until they meet policy.

Granting each user, service or process only the access needed for its defined task, for only as long as needed, so that compromise or error limits damage to the smallest practical scope.

An access model where permissions are attached to job roles rather than individuals, and users gain rights by being assigned to roles, simplifying review and consistent provisioning across the organisation.

An access model that evaluates policies combining attributes of the subject, resource, action and environment, such as department, data classification, time and device posture, to reach an allow or deny decision.

Controls over accounts with elevated rights, including vaulting credentials, just-in-time elevation, session recording and approval workflows, to limit and audit the use of administrative power.

Authentication requiring evidence from at least two different factor categories, such as something known plus something held or inherent, so that a stolen password alone is insufficient to gain access.

Authentication methods bound to the legitimate service origin, such as passkeys or hardware security keys, that do not release a reusable secret to a look-alike site and therefore resist real-time credential relay attacks.

The governed handling of cryptographic keys from generation through distribution, storage, rotation, archival, recovery and destruction, with separation of duties so no one person controls a key end to end.

A scheme where a data key encrypts the content and a separately protected master key encrypts the data key, allowing frequent data-key rotation without re-encrypting the whole dataset.

Controlled holding of key material, often split among trusted holders or stored in a protected recovery service, so that keys can be recovered after loss of personnel or hardware without weakening everyday protection.

A cipher mode that provides both confidentiality and integrity, producing a tag that reveals tampering with ciphertext or associated data, so recipients can reject altered messages before acting on them.

A cryptographic value created with a private key that a recipient verifies with the corresponding public key, giving integrity, origin authentication and, with trusted timestamps, support for non-repudiation.

The people, processes and systems that issue, validate, renew and revoke certificates, binding public keys to verified identities so relying parties can trust encrypted connections and signed artefacts.

Agent-based tooling that continuously records endpoint process, file and network behaviour, detects suspicious patterns, and supports investigation and containment actions such as isolating a host.

A control that permits only explicitly approved executables or scripts to run, blocking unapproved code including malware, and requiring a managed process to approve legitimate new software.

Embedding security activities such as threat modelling, secure coding standards, dependency scanning and security testing into each phase of software delivery, with gates that must be met before release.

A structured exercise that maps assets, entry points and trust boundaries, then enumerates plausible threats and the controls that address them, usually performed early when design changes are cheapest.

The repeatable cycle of discovering assets, identifying weaknesses, prioritising them by exploitability and business impact, remediating or mitigating, and verifying that fixes actually took effect.

A platform that centralises logs from many sources, correlates events against detection rules, raises alerts and retains evidence, forming the data backbone for monitoring and investigation.

Tooling that runs predefined playbooks to enrich alerts, query data sources and take containment steps automatically, reducing analyst effort and response time for well-understood incident types.

A documented set of roles, escalation paths, communication routes and phase-by-phase actions for preparing, detecting, containing, eradicating, recovering from and learning after a security incident.

The maximum acceptable elapsed time to restore a service after disruption, driving recovery architecture, staffing and testing decisions; it is set by the business, not by technical convenience.

The maximum acceptable amount of data loss measured in time before a disruption, which determines backup frequency, replication mode and the acceptable gap between the last good copy and the incident.

An assessment identifying critical business processes, their dependencies and the harm caused by outage or data loss over time, producing the recovery objectives that continuity and recovery plans must satisfy.

A contract clause set defining how a processor may handle a controller's personal data, covering purpose limitation, security measures, sub-processor approval, breach notification, audit rights and deletion on termination.

A structured review, required before high-risk processing begins, that describes the processing, assesses necessity and risks to individuals, and records the safeguards and approvals that justify proceeding.

Building privacy safeguards into systems and processes from the outset, including data minimisation, purpose limitation and default settings that protect personal data without requiring users to change anything.