CGRC flashcards
CGRC · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Three lines model
- Governance structure where operational management owns and manages risk, a risk or compliance function provides oversight, and internal audit gives independent assurance to the governing body.
- Policy hierarchy
- Laws and regulations inform policies; policies are supported by standards, procedures, and guidelines, with lower documents providing more detailed implementation direction.
- Data minimization
- Privacy principle limiting collection and use of personal data to what is necessary for a specified purpose, reducing exposure and compliance burden.
- Accountability in governance
- Senior leaders remain answerable for security and privacy outcomes even when controls or services are delegated to vendors or other organizational units.
- Inherent versus residual risk
- Inherent risk exists before controls are applied; residual risk remains after controls operate and is the level compared with risk appetite.
- Risk response options
- Four common responses are mitigate, transfer, avoid, and accept; each requires documented rationale and an accountable risk owner.
- Risk appetite versus tolerance
- Risk appetite is the amount and type of risk an organization is willing to pursue; tolerance is the acceptable variation around that appetite.
- POA&M
- Plan of action and milestones tracks identified weaknesses, remediation tasks, resources, responsible owners, and scheduled completion dates for compliance follow-up.
- Authorization boundary
- The set of components, data flows, people, and services that process, store, transmit, or protect information within a system's assessed scope.
- FIPS 199 high-water mark
- Overall system categorization equals the highest impact value assigned to any of its confidentiality, integrity, or availability objectives.
- Shared controls
- Controls inherited from a common provider or environment that satisfy part of a system's requirements and must be documented with evidence of operation.
- Trust boundary
- A point where data or control passes between components with different security assumptions, requiring inspection and explicit risk management.
- Control baseline
- A predefined set of controls for a category and impact level, such as NIST low, moderate, or high, which is then tailored to the system.
- Tailoring
- Adjusting a control baseline by scoping, parameterizing, adding supplements, or applying compensating controls to fit mission and risk.
- Overlay
- A tailored set of controls and supplemental guidance applied on top of a baseline for a community, technology, or mission context.
- Control inheritance
- Reliance on controls implemented by a common provider or parent system, supported by evidence and documented customer responsibilities.
- SSP
- System security plan documents control implementation, responsible roles, inherited controls, and implementation status for the authorized system.
- Security configuration baseline
- Documented settings that harden a component, often derived from benchmarks or STIGs, and are verified through configuration monitoring.
- Least privilege
- Granting users and processes only the access needed to perform assigned tasks, reducing accidental and malicious damage potential.
- Change control impact review
- Before deployment, changes are assessed for security and privacy effects, control validity, and need for reassessment or reauthorization.
- Examine interview test
- NIST assessment methods: examine artifacts, interview personnel, and test mechanisms or activities to determine control effectiveness.
- Design versus operating effectiveness
- Design effectiveness asks whether a control can meet its objective; operating effectiveness asks whether it worked consistently over the review period.
- Sufficient appropriate evidence
- Evidence that is relevant, reliable, and adequate to support an assessment conclusion, collected within the period being evaluated.
- Assessor independence
- Assessors should not evaluate controls they designed or implemented, preserving objectivity and credibility of audit conclusions.
- Authorization to operate
- Formal decision by an authorizing official that a system may operate with acceptable residual risk and documented monitoring obligations.
- Interim authorization to operate
- Time-limited approval allowing operation while specified weaknesses are remediated under an approved plan with milestones.
- Significant change
- A change that may materially affect security or privacy posture, such as new interconnection, major code release, or changed data type, triggering reassessment.
- Continuous monitoring
- Ongoing awareness of control effectiveness, vulnerabilities, and threats using automated and manual data to maintain authorization decisions.
- Corrective action tracking
- Documenting each deficiency, root cause, remediation owner, due date, and verification evidence until risk is reduced to an acceptable level.
- Compliance calendar
- A schedule of recurring assessments, policy reviews, training, reporting deadlines, and third-party reviews that keeps obligations from being missed.
- Evidence retention schedule
- Defined periods for keeping assessment artifacts based on legal, contractual, and audit needs, with secure disposal at expiration.
- Vendor attestation review
- Periodic evaluation of third-party audit reports and certifications to confirm controls still meet contractual and regulatory requirements.