CGRC key terms

The decision-making structures, policies, and oversight practices an organization uses to direct security and privacy work, assign accountability, and align protection activities with business objectives and legal duties.

An organized set of policies, assigned roles, monitoring activities, and reporting mechanisms maintained to meet laws, regulations, contracts, and internal standards on a continuing basis.

A governance arrangement where operational management owns risk, an independent risk and compliance function provides oversight, and internal audit gives the governing body objective assurance.

A continuous process for identifying, analyzing, prioritizing, and responding to uncertainty that could affect objectives, then monitoring outcomes and adjusting treatments as conditions change.

The amount and type of risk an organization is willing to accept while pursuing its objectives, stated in broad terms and approved by senior leadership.

The specific, measurable amount of variation from the risk appetite that is acceptable for a particular activity, system, or category of risk.

The process of identifying threats and vulnerabilities, estimating likelihood and impact, and determining a risk level that can be compared with tolerance and treated.

The risk level that exists before any controls or mitigating actions are applied, used as a starting point for deciding what treatment is needed.

The risk remaining after controls are implemented and evaluated, which leadership compares against tolerance and formally accepts, transfers, or mitigates further.

A structured record of identified risks, owners, ratings, treatment plans, and status, used to track and report risk decisions over time.

A documented decision by an accountable official to tolerate a stated level of residual risk, including the rationale and any conditions or time limits.

The coordinated policies, controls, and oversight activities an organization uses to protect personal information and satisfy obligations such as notice, consent, retention limits, and individual rights.

A structured analysis of how a system or process collects, uses, shares, and retains personal information, identifying privacy risks and the safeguards needed to address them.

The defined set of components, data flows, users, and supporting infrastructure included in an assessment, together with interfaces and dependencies that must be considered.

The logical and physical perimeter identifying which components, people, and data belong to the system being authorized, including externally provided services whose controls are relied upon.

The process of judging the potential impact of losing confidentiality, integrity, or availability of a system and its data, producing an overall level that drives control selection.

A direct connection between two systems that permits data exchange and requires documented agreements and controls to manage risk at the shared boundary.

A published, structured catalog of security and privacy requirements and guidance, such as NIST SP 800-53 or ISO/IEC 27001, that an organization adopts to organize control selection.

A predefined set of controls chosen for a system based on its categorization and organizational decisions, serving as the starting point before tailoring.

The documented adjustment of a baseline by adding, removing, or modifying controls to fit a system's environment, mission, and risk, with justification recorded.

A set of control specifications and guidance applied on top of a baseline to address a particular technology, environment, community, or mission, reducing the need for individual tailoring.

A control implemented by an organizational entity and inherited by multiple systems, so those systems can rely on the provider's assessment evidence instead of re-implementing it.

The reliance of a system on controls implemented, assessed, and monitored by another provider or organizational level, documented so accountability and evidence remain clear.

A safeguard or management action that addresses privacy risk, such as purpose limitation, consent management, data minimization, retention limits, or redress mechanisms.

A description of how a selected control is applied in a specific system, including the responsible role, the mechanism used, and evidence that it operates as intended.

A document describing a system's boundary, environment, and how each selected control is implemented or inherited, along with assigned roles and monitoring commitments.

A specific parameter or option applied to a component to enforce a secure state, such as password length, logging level, or protocol version, managed through change control.

An alternative safeguard used when a required control cannot be applied directly, providing comparable risk reduction and documented with justification and approval.

An examination of implemented controls against stated objectives, using methods such as examining artifacts, interviewing staff, and testing, to reach evidence-based conclusions about effectiveness.

The detailed steps an assessor follows to evaluate a specific control, naming the methods, objects to examine, and expected evidence needed for a conclusion.

Records, artifacts, observations, or interview results that support a conclusion about whether a control is designed and operating effectively.

Examining a subset of a population of control instances to draw a reasonable conclusion about the whole, with the selection method and rationale documented.

A documented conclusion that a control is missing, deficient, or not operating as intended, usually including severity, the affected system, and the basis for the conclusion.

A formal management decision, based on assessment evidence and risk analysis, that a system may operate with an accepted level of risk for a defined period and conditions.

The set of documents submitted for an authorization decision, typically including the system security plan, assessment results, and plan of action and milestones.

A management tool recording identified weaknesses, planned corrective actions, responsible owners, resources, and completion dates, and tracking progress until each item is closed.

Ongoing automated and manual activities that track control effectiveness, system changes, and risk posture after authorization so decisions can be updated before problems grow serious.

A modification to a system or its environment that could materially affect security or privacy posture, requiring reassessment and possibly reauthorization before it proceeds.

A controlled process for requesting, reviewing, approving, testing, and documenting modifications to systems and configurations so risk is understood before implementation.

Remediation work undertaken to resolve a finding or weakness, including root-cause analysis, implementation steps, verification, and evidence supporting closure.