GSTP key terms

A coordinated, multi-year redesign of an organization's security capabilities, operating model, and technology to meet a changed threat or business landscape, rather than incremental fixes to existing controls.

A documented set of choices describing how security will support business objectives, which risks matter most, and where investment will and will not go over a defined horizon.

A blueprint of how security work is organized: roles, decision rights, processes, sourcing, and technology, describing the future state an organization intends to reach.

A sequenced plan of initiatives, dependencies, milestones, and funding waves that moves an organization from its current security state to its target state over time.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative statements or quantitative thresholds that guide security decisions.

The acceptable variation around a risk appetite statement, giving practitioners concrete limits, such as maximum downtime or loss per event, for day-to-day and exception decisions.

The practice of tying security objectives, metrics, and investment cases to the organization's revenue, customer, and regulatory priorities so security is seen as enabling outcomes rather than blocking them.

A senior cross-functional body that reviews security program progress, resolves escalated trade-offs, approves major funding, and holds accountable owners to agreed transformation commitments.

A standing decision-making forum, often chaired by the CISO with business and technology representatives, that sets policy, arbitrates exceptions, and monitors whether security decisions match stated risk appetite.

Explicitly assigned authority describing who may approve, veto, or escalate a given security decision, preventing duplicated approvals and unowned risks across business units and technology teams.

A formally requested, time-bound permission to deviate from a security standard, documented with compensating controls, a named owner, and an expiry or review date.

A maintained inventory of identified risks recording likelihood, impact, owner, treatment status, and review dates, used to prioritize work and demonstrate that risk decisions are tracked.

The chosen response to an identified risk: mitigate with controls, transfer via insurance or contract, avoid the activity, or accept the residual exposure with documented sign-off.

A documented decision by an accountable owner to live with a residual risk, including the rationale, scope, and review date, without further mitigation at that time.

The exposure that remains after existing and planned controls are applied, which is compared against risk tolerance to decide whether more treatment is required.

The level of risk before any controls are considered, useful as a baseline for showing how much protection current controls actually provide.

A judgment of how well a control actually reduces risk when operating as designed, supported by testing evidence rather than the mere existence of the control.

An alternative safeguard used when the primary control cannot be applied, intended to reduce the same risk to an acceptable level and documented alongside the exception.

Structured examination of whether a control is designed appropriately and operates consistently over a period, producing evidence used by risk, audit, and compliance functions.

A forward-looking metric that signals rising exposure in a risk area, such as unremediated critical vulnerabilities or aging access reviews, enabling action before losses occur.

The process of assessing, contracting with, monitoring, and offboarding suppliers and partners according to the security risk they introduce to the organization's data and operations.

Exposure arising from the vendors, software components, and service providers an organization depends on, including their own security posture and the integrity of what they deliver.

An assessment identifying critical business processes, their dependencies, and the consequences of disruption over time, which sets recovery priorities and recovery objectives for resilience planning.

The maximum acceptable elapsed time to restore a process or system after disruption, a target that drives architecture choices such as redundancy and failover design.

A design approach that removes implicit trust based on network location, instead verifying identity and device posture for every request and granting least-privilege access continuously.

Layering independent preventive, detective, and corrective controls so that failure or bypass of any single control does not expose critical assets directly.

Dividing a network into fine-grained zones with explicit allow rules between workloads, limiting lateral movement after a compromise and supporting least-privilege network access.

Granting identities, services, and users only the access needed for their current task, for only as long as needed, and reviewing entitlements regularly to remove excess rights.

The technologies and processes for authenticating identities, authorizing their access, and governing the lifecycle of accounts and entitlements across systems.

Controls over high-power accounts and credentials, including vaulting, session recording, just-in-time elevation, and rotation, to reduce the impact of stolen administrative access.

A published list of security services with descriptions, owners, service levels, and how to request them, making the security function's offerings transparent and consumable by the business.

Rationalizing overlapping security tools into fewer integrated platforms to reduce cost, operational complexity, and gaps caused by disconnected data and inconsistent policy enforcement.

Accumulation of overlapping or underused security products across teams, which raises integration burden, licensing cost, and alert noise while diluting ownership and expertise.

A machine-readable inventory of the components and dependencies in a software product, used to identify exposure quickly when a vulnerability is disclosed in a library.

A continuous cycle of discovering, prioritizing, remediating, and verifying weaknesses in systems and software, prioritized by exploitability and business criticality rather than raw counts alone.

Ranking security work by the combination of likelihood, business impact, and threat context, so limited resources address the exposures that matter most first.

The discipline of preparing people for a transition by addressing awareness, capability, incentives, and resistance, so new ways of working are adopted rather than merely announced.

Deliberate, ongoing communication and involvement of the people affected by or influencing a change, tailored to their interests, influence, and concerns.

Visible, active support from a senior leader who champions the initiative, removes organizational blockers, and holds others accountable for commitments.

Reduced willingness and energy to adopt further change after repeated initiatives, shown by disengagement or compliance without commitment, requiring sequencing and clearer prioritization.

A short, low-risk initiative delivering visible benefit early in a transformation, used to build credibility and momentum for longer, harder changes.

The shared assumptions and everyday behaviors in an organization regarding security, shaped by leadership signals, incentives, and whether people feel safe reporting mistakes.

A planned effort to improve security behaviors through targeted education, simulation, and reinforcement, measured by behavior change rather than course completion rates alone.

A metric tracking whether a security activity is being delivered as planned, such as percentage of assets covered by logging or time to patch within target.

A defined structure linking operational, tactical, and strategic measures to program objectives, with agreed definitions, data sources, and reporting cadence.

A staged reference describing progressively more capable practices, used to assess the current state, set a realistic target level, and show improvement over time.

A structured evaluation of what an organization can reliably do today across people, process, and technology, producing the baseline that a transformation roadmap is built from.

The average elapsed time between the occurrence of a security event and its detection, a measure of monitoring and detection effectiveness.

The average time from detection of a security incident to containment or resolution, reflecting the efficiency of investigation, decision-making, and response processes.

A team and facility responsible for continuous monitoring, triage, and escalation of security events, often supported by defined playbooks and tiered analyst roles.

A documented set of roles, phases, communication paths, and decision criteria guiding the organization's handling of a security incident from detection through lessons learned.

A predefined, repeatable procedure for handling a specific scenario or alert type, reducing decision time and inconsistency during response and routine operations.