ISSAP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Residual risk

The risk remaining after controls are applied. It equals inherent risk reduced by control effectiveness, and it must be compared against the organization's risk appetite and formally accepted by an accountable owner.

Risk treatment options

Mitigate (apply controls), transfer (insurance or contract), avoid (stop the activity), and accept (documented decision). Each option requires an owner, rationale, and review date; acceptance is not the same as ignoring the risk.

Segregation of duties

A control that prevents a single person from controlling all parts of a sensitive transaction. It reduces fraud and error by requiring different principals for request, approval, execution, and review steps.

Common control

A single control that satisfies multiple compliance obligations at once. Mapping obligations to common controls reduces duplicate testing and evidence collection across frameworks such as ISO 27001 and SOC 2.

Risk register

A structured record of identified risks containing asset, threat, vulnerability, likelihood, impact, inherent and residual ratings, control references, risk owner, and review date. It is the operational artifact of risk management.

Key risk indicator

A leading metric with defined thresholds that signals increasing risk exposure before losses occur. It differs from a key performance indicator, which measures how well a process or control is operating.

GDPR data minimization

A principle requiring that personal data collected be adequate, relevant, and limited to what is necessary for the stated purpose. It constrains architecture choices about what data is stored and for how long.

Breach notification 72 hours

Under GDPR, controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.

PCI DSS scope

PCI DSS applies to all systems that store, process, or transmit cardholder data, plus systems connected to or that could impact the security of that environment. Scope reduction shrinks assessment cost.

HIPAA safeguards

The Security Rule requires administrative, physical, and technical safeguards for electronic protected health information. The Privacy Rule separately governs permitted uses and disclosures of that information.

Legal hold

A directive suspending routine destruction of records once litigation or investigation is reasonably anticipated. It overrides retention schedules and must be tracked until formally released.

Standard contractual clauses

Pre-approved contract terms used to lawfully transfer personal data to jurisdictions lacking an adequacy decision. They impose obligations on both exporter and importer and require transfer impact assessment.

Verification versus validation

Verification confirms the design meets its specification; validation confirms it meets stakeholder and business need. Security architecture requires both, with traceable evidence for each requirement.

STRIDE

A threat modeling taxonomy: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Each category suggests specific mitigations such as authentication, integrity checks, and audit logging.

Requirements traceability matrix

A table linking each requirement to its design element, test case, and evidence. It exposes untested requirements and orphan tests, and it supports audit and change impact analysis.

Architecture review board

A governance body that evaluates proposed designs against standards, reference architectures, and risk criteria. It records findings with severity and owner and gates progression to implementation.

Penetration test

An authorized simulated attack that validates whether vulnerabilities are exploitable in context. It complements vulnerability scanning, which identifies potential weaknesses but does not confirm exploitability.

Zero trust

A model that verifies every request explicitly, grants least privilege, and assumes breach. Identity and device posture, not network location, become the primary basis for access decisions.

Network segmentation

Dividing a network into zones by trust level so that traffic between zones passes through a policy enforcement point. It limits lateral movement and reduces the blast radius of a compromise.

RTO and RPO

Recovery time objective is the maximum tolerable downtime; recovery point objective is the maximum tolerable data loss measured in time. Both derive from business impact analysis and drive architecture cost.

Cloud shared responsibility

The provider secures the physical and virtual infrastructure; the customer secures configuration, identity, data, and workloads. The split varies by service model: IaaS, PaaS, and SaaS shift the boundary.

Key management lifecycle

Generation, distribution, storage, rotation, use, and destruction of cryptographic keys. Keys must be protected separately from the data they protect, with documented rotation and revocation procedures.

Non-functional security requirement

A quality attribute such as availability, performance, scalability, or maintainability that constrains how a system delivers functional behavior. These requirements often drive architecture trade-offs against security controls.

Hardening baseline

A documented secure configuration standard applied to systems, derived from sources such as CIS Benchmarks. Deviations require documented exceptions, and drift must be detected by continuous monitoring.

Testable requirement

A requirement stated so that compliance can be objectively verified, for example encrypting data at rest with AES-256. Vague statements such as 'be secure' cannot be validated or audited.

Business impact analysis

An assessment identifying critical business processes and the consequences of their disruption. Its outputs, including RTO and RPO, translate directly into infrastructure resilience requirements.

Joiner-mover-leaver process

The identity lifecycle covering provisioning at hire, access adjustment on role change, and timely revocation on termination. Deprovisioning failures are among the most frequently cited audit findings.

Multi-factor authentication

Authentication using factors from at least two different categories: knowledge, possession, and inherence. Two passwords or two software tokens from the same category do not satisfy MFA.

OpenID Connect

An identity layer built on OAuth 2.0 that adds authentication and returns an ID token with claims about the authenticated subject. OAuth 2.0 alone provides delegated authorization, not authentication.

RBAC versus ABAC

Role-based access control grants permissions through assigned roles; attribute-based access control evaluates attributes of subject, resource, action, and context against policy. ABAC is more granular but harder to audit.

Privileged access management

Controls for administrative accounts including credential vaulting, session recording, just-in-time elevation, and break-glass accounts with alerting. It limits the impact of credential compromise on high-value systems.

Access recertification

A periodic review in which managers or resource owners confirm that each user's entitlements remain necessary. It detects entitlement creep, orphaned accounts, and inappropriate access accumulated over time.