IIBA CCA key terms

A model describing the three core goals of information security: keeping data private to authorized parties, keeping data accurate and unaltered, and keeping systems and data reachable when needed.

Any actor, event, or circumstance with the potential to exploit a weakness and cause harm to an organization's assets, operations, or reputation.

A weakness in a system, process, or control that a threat could exploit, such as an unpatched server, a missing approval step, or an untrained employee.

A technique, tool, or piece of code that takes advantage of a specific vulnerability to achieve an unintended effect on a system or process.

The combination of how likely a harmful event is and how severe its impact would be, expressed relative to the value of the asset or process affected.

An estimate of how probable it is that a given threat will actually exploit a given vulnerability within a defined period or context.

The magnitude of harm, loss, or disruption an organization would experience if a risk event occurred, often measured in money, time, safety, or reputation.

A safeguard, policy, procedure, or technical mechanism put in place to reduce the likelihood or impact of a risk to an acceptable level.

A safeguard designed to stop an unwanted event from happening at all, such as access restrictions, input validation, or mandatory dual approval before a payment.

A safeguard designed to notice and report an unwanted event after or while it occurs, such as log monitoring, reconciliation, or an intrusion detection alert.

A safeguard that restores normal operations or reduces further harm after an incident has been detected, such as restoring from backup or revoking a compromised account.

An approach that layers multiple independent controls across people, process, and technology so that failure of any single safeguard does not expose the whole environment.

The principle that each user, service, or process receives only the access rights strictly necessary to perform its assigned function, and no more.

A control that divides sensitive tasks among different people so no single individual can both commit and conceal an error or a fraudulent act.

The set of policies and mechanisms that decide who or what may view, change, or use a resource, and under which conditions.

The process of verifying that a user, device, or system is who or what it claims to be, typically through credentials, tokens, or biometric factors.

The process of deciding which actions or resources an authenticated identity is permitted to use, based on assigned roles, rules, or attributes.

A login method requiring two or more different evidence types, such as a password plus a one-time code, so a stolen password alone is not enough.

The total set of points where an unauthorized party could try to enter or influence a system, including interfaces, accounts, code, and connected third parties.

A structured exercise that identifies valuable assets, likely attackers, plausible attack paths, and the controls needed before a system is built or changed.

The process of identifying risks, estimating their likelihood and impact, and comparing the result against agreed tolerance to decide what action is needed.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by leadership and used to judge whether exposures are acceptable.

The chosen response to an assessed risk: avoid the activity, reduce it with controls, transfer it to another party, or knowingly accept the remaining exposure.

The risk that remains after controls and treatment decisions have been applied, which leadership must compare against tolerance and monitor over time.

A study that identifies critical business functions and estimates how disruption to each affects the organization over time, guiding recovery priorities and investment.

The maximum acceptable elapsed time to restore a business function or system after a disruption, before the impact becomes unacceptable to the organization.

The maximum acceptable amount of data loss measured in time, indicating how far back a restored system may return to its last usable state.

A copy of data or system state kept separately so it can be used to restore information after loss, corruption, or a destructive event.

The organized process of preparing for, detecting, containing, eradicating, and recovering from a security incident, followed by lessons learned.

The disciplined collection, preservation, and analysis of digital evidence in a way that supports investigation and remains defensible if challenged later.

A documented, unbroken record of who handled evidence, when, and for what purpose, showing that it has not been altered or tampered with.

A chronological record of system or user activity that allows an investigator to reconstruct what happened, in what order, and by which identity.

The practice of capturing events and actions in durable records so they can be reviewed, correlated, and used to detect problems or support investigations.

A deceptive message that impersonates a trusted party to trick a recipient into revealing credentials, approving a payment, or running malicious content.

Manipulating people through trust, urgency, or authority to obtain information or access, rather than attacking technology directly.

Software written to perform unwanted actions on a device or network, including stealing data, encrypting files, or giving an intruder remote control.

Malware that encrypts or locks access to data and demands payment for restoration, often combined with threats to publish stolen information.

Transforming readable data into an unreadable form using a key, so that only parties holding the correct key can recover the original content.

Assigning labels such as public, internal, or restricted to information so that handling, access, and protection requirements are applied consistently.