ISSMP cheat sheet

Governance roles: the board sets risk appetite, executive management sets risk tolerance, and the security manager implements controls; material variance is escalated to the board.

Security budget formulas: ALE = SLE × ARO; ROI = (benefit − control cost) ÷ control cost.

RACI rule: exactly one role is accountable per activity; responsibility may be shared, consultation occurs before the decision, and informing occurs after.

Risk indicator thresholds: green = within appetite, amber = approaching tolerance, red = exceeds tolerance and requires escalation.

Business case components: problem, options, cost, benefit, risk, and recommendation; approve only when benefit exceeds cost and residual risk is within appetite.

Steering committee: cross-functional membership; owns policy approval, investment prioritization, and conflict resolution; meets at a defined cadence.

Due care is reasonable protection; due diligence is ongoing verification; absence of either increases negligence exposure.

Span of control: narrow spans fit complex or high-risk work; wide spans fit standardized, low-variability tasks.

Lifecycle phases: requirements, design, build, test, deploy, operate, retire; each phase has entry and exit criteria.

Security gate rule: production deployment requires documented security acceptance; unresolved critical findings block release.

Traceability matrix maps requirements to design, controls, and tests; an unmapped requirement is unverified.

Change control: normal changes require approval; emergency changes require retrospective review and documentation.

Separation of duties: developers do not hold production write access; the person who writes code does not approve its release.

Configuration baseline is the approved state; drift is any difference between actual and baseline and is handled through change management.

Secure disposal: sanitize media according to data classification before reuse or retirement; retain a destruction record.

Authorization to operate: the authorizing official accepts residual risk based on assessment evidence; continuous monitoring supports maintenance.

Compliance hierarchy: law and regulation, then standard, then policy, then procedure, then guideline; lower levels cannot weaken higher levels.

Policy exception: documented, time-bound, risk-accepted by the owner, with a review or remediation date; permanent exceptions are not valid.

Control testing: design effectiveness asks whether the control could work; operating effectiveness asks whether it actually worked over the period.

Sample size rises with population size, required confidence, and lower tolerable error rate.

Audit finding structure: condition, criteria, cause, effect, recommendation; each element is needed for a defensible finding.

Evidence retention: follow legal and regulatory schedules; evidence must be dated, attributable, and protected from alteration.

Gap analysis compares current controls with required obligations; prioritize by legal exposure and risk.

Third-party review: right-to-audit clause, independent report review, and reassessment frequency based on data sensitivity and access.

Risk score = likelihood × impact; scales must be defined so ratings are consistent across assessors.

SLE = asset value × exposure factor; ALE = SLE × ARO.

Treatment options: mitigate, transfer, avoid, accept; residual risk must be within risk appetite.

Risk register fields: asset, threat, vulnerability, likelihood, impact, score, owner, treatment, due date.

Risk appetite is the broad willingness to take risk; risk tolerance is the acceptable variation around a specific objective.

Control cost is justified when annual control cost is less than the reduction in ALE.

Monte Carlo analysis models ranges and correlations to produce a loss distribution; it is preferred when single-point estimates hide uncertainty.

Third-party tiering uses data sensitivity, system access, and business criticality; higher tiers require deeper due diligence.

Intelligence cycle: requirements, collection, processing, analysis, dissemination, feedback; feedback restarts the cycle.

IoCs are atomic and perishable; TTPs are behavioral and durable; detection engineering prioritizes TTPs.

Pyramid of Pain order: hash, IP address, domain, network artifact, tool, TTP; higher levels are harder for adversaries to change.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Severity = impact × urgency; escalation triggers include confirmed data exfiltration, ransomware, and critical service outage.

Chain of custody records who handled evidence, when, where, and why; hash evidence and preserve the original.

Containment decision: isolate affected hosts while preserving evidence; avoid destructive actions before capture.

Metrics include MTTD and MTTR; post-incident corrective actions are tracked to closure.

BIA identifies critical processes, dependencies, and downtime impact; it establishes RTO, RPO, and MTD before strategy selection.

RTO is maximum acceptable downtime; RPO is maximum acceptable data loss; MTD is maximum tolerable disruption; RTO must be less than MTD.

Recovery site options: hot, warm, cold, reciprocal, and cloud failover; selection depends on RTO, RPO, and cost.

Backup rule 3-2-1: three copies, two media types, one offsite; restore testing proves recoverability.

Test types: tabletop, walkthrough, simulation, full failover; realism increases with process criticality.

Disaster declaration requires an authorized role and predefined criteria; the declaration starts plan activation and communications.

Crisis communications: predefined spokespeople, contact lists, and status templates; public statements avoid speculation.

Plan maintenance: review at least annually and after major change; use version control and role-based distribution.