ISSAP key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed as thresholds that security architecture decisions must respect.

The acceptable variation around the risk appetite for a specific category or system, used to set concrete thresholds for design decisions and exceptions.

The risk remaining after controls are applied, which architects must document and compare against tolerance before accepting a design.

Selecting and applying options to address assessed risk: mitigate, transfer, avoid, or accept. The choice drives control selection in the architecture.

A maintained record of identified risks with owners, ratings, treatment decisions, and status, used to trace architecture decisions to organizational risk.

A structured catalog of security controls, such as NIST SP 800-53 or ISO/IEC 27001 Annex A, used to select, map, and assess safeguards consistently.

A statement of what a control must achieve, independent of implementation, allowing architects to choose mechanisms that satisfy the intent.

An alternative safeguard used when a required control cannot be implemented as specified, providing equivalent risk reduction that must be documented and approved.

A governed process for approving, time-limiting, and reviewing deviations from policy or standards, ensuring accepted risk has an owner and expiry.

A formal decision by an accountable owner to retain a risk without further treatment, recorded with rationale and review date.

Assigning data to sensitivity tiers that determine handling, access, and protection requirements, forming the basis for architecture control selection.

The principle that data is subject to the laws and governance of the jurisdiction where it resides, constraining where systems and storage may be placed.

The requirement that data be stored or processed in a specified geographic location, often driven by regulation or contract rather than technical need.

Defined periods for keeping records to satisfy legal, regulatory, or operational needs, after which data must be securely disposed of.

A structured analysis of how a system collects, uses, and shares personal data, identifying privacy risks and required mitigations before build or change.

The ongoing practice of applying reasonable safeguards and oversight to protect assets, demonstrating that obligations are actively managed rather than assumed.

The investigation and verification performed before and during a decision, such as assessing a vendor or design, to identify risks and confirm claims.

Risk introduced by suppliers, partners, and service providers, managed through assessment, contractual controls, and ongoing monitoring across the supply chain.

A governance body that evaluates proposed designs against standards, risk tolerance, and strategy, and approves, conditions, or rejects them.

The accountable role or group that owns technical standards and approves significant design decisions, ensuring consistency across projects.

A structured evaluation of a design's threats, controls, and compliance against requirements, producing findings and conditions before implementation proceeds.

A systematic method to identify threats, attack paths, and required mitigations for a design, typically performed early and revisited as the system changes.

The set of exposed entry points, interfaces, and assets an adversary could exploit, which architecture aims to minimize and monitor.

Layering independent controls so that failure of one does not defeat protection, reducing the likelihood of a single point of compromise.

A minimum set of controls selected for a system based on its classification and risk, from which tailoring and justified deviations are made.

The practice of linking each requirement to design elements, controls, and test evidence, proving that obligations are met and changes are assessed.

A design approach that treats no network location as trusted, verifying identity and context for every request and enforcing least privilege continuously.

Dividing a network or workload environment into small zones with explicit allowed flows, limiting lateral movement after compromise.

Granting only the access needed for a task, for the shortest time, reducing both accidental error and the impact of compromise.

Splitting critical tasks among different people or roles so no single actor can complete a sensitive action alone, preventing fraud and error.

Controls for issuing, vaulting, monitoring, and revoking elevated accounts and sessions, often with just-in-time elevation and session recording.

Granting elevated permissions only for a limited window upon request and approval, then automatically revoking them to shrink standing privilege.

The governed process of creating, changing, and removing identities and their entitlements as people join, move, and leave.

Automatically creating and assigning accounts and entitlements based on authoritative sources and approved roles, reducing manual error and delay.

Periodic review in which owners confirm or revoke existing entitlements, producing evidence that access remains justified.

Assigning permissions to roles rather than individuals, so users gain access through role membership that can be governed and audited.

Making access decisions from attributes of the subject, resource, action, and context, enabling fine-grained and dynamic policy evaluation.

The component that evaluates access policies and returns a decision, separated from the enforcement point that applies it.

Trust arrangements that let an identity authenticated in one domain be accepted in another, typically via standards such as SAML or OpenID Connect.

Authenticating once to obtain access to multiple systems, reducing credential sprawl while concentrating risk on the primary authenticator.

Requiring two or more independent evidence types to verify identity, strengthening assurance against credential theft and replay.