ISSMP flashcards
ISSMP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Risk appetite
- The amount and type of risk an organization is willing to accept in pursuit of objectives; it guides strategy and sets bounds for lower-level risk tolerances.
- Risk tolerance
- The acceptable variation around a specific objective or metric; unlike appetite, it is measurable and often expressed as thresholds that trigger escalation.
- RACI matrix
- A responsibility assignment chart that identifies who is responsible, accountable, consulted, and informed for each activity; exactly one role should be accountable per activity.
- Steering committee
- A cross-functional governance body that prioritizes security investments, approves policy, and resolves conflicts between business and security objectives; it typically meets on a scheduled cadence.
- Due care
- The reasonable level of protection an organization is expected to exercise; failing to meet it can support a negligence claim, so it must be documented and repeatable.
- Security gate
- A defined checkpoint in the lifecycle where evidence is reviewed and approval is required before proceeding; unresolved critical findings should block release.
- Traceability matrix
- A mapping that links requirements to design elements, controls, and test cases; it demonstrates that each requirement is implemented and verified.
- Configuration baseline
- The approved and documented state of a system's settings; deviations are detected through comparison and managed through change control.
- Separation of duties
- Dividing sensitive tasks among different people so no single person can complete a high-risk action alone; in development, coders should not deploy to production.
- Authorizing official
- The senior official who accepts residual risk for a system based on assessment evidence and grants or denies authority to operate.
- Policy exception
- A documented, time-bound approval to deviate from a policy; it requires risk acceptance by the appropriate owner and a remediation or review date.
- Design effectiveness
- Evidence that a control, as designed, would mitigate the identified risk if operated properly; it is assessed before testing whether the control actually worked.
- Operating effectiveness
- Evidence that a control operated consistently and correctly over the audit period; it usually requires sampling and inspection of records.
- Audit finding elements
- A well-formed finding states the condition, criteria, cause, effect, and recommendation; this structure supports clear remediation and management response.
- Right-to-audit clause
- A contract provision allowing the organization to assess a vendor's controls and evidence; it supports ongoing third-party compliance verification.
- Annualized loss expectancy
- ALE equals single loss expectancy multiplied by annualized rate of occurrence; it estimates expected yearly loss for a risk scenario.
- Single loss expectancy
- SLE equals asset value multiplied by exposure factor; exposure factor is the percentage of asset value lost in one incident.
- Residual risk
- The risk remaining after controls are applied; it must be compared with risk appetite and formally accepted by an accountable owner.
- Risk register
- A record of identified risks with owner, likelihood, impact, score, treatment, and due date; it is reviewed at a defined cadence.
- Risk treatment options
- Mitigate, transfer, avoid, or accept; selection depends on cost, feasibility, and whether residual risk falls within appetite.
- Monte Carlo analysis
- A probabilistic method that models ranges and correlations to produce a loss distribution; it is useful when single-point estimates are misleading.
- Intelligence cycle
- Requirements, collection, processing, analysis, dissemination, and feedback; the cycle repeats as priorities change and new information arrives.
- Indicator of compromise
- Observable artifacts such as hashes, IP addresses, or domains that suggest compromise; they are perishable and easy for adversaries to change.
- Tactics, techniques, procedures
- Behavioral descriptions of how adversaries operate; TTPs are more durable than atomic indicators and support detection engineering.
- Chain of custody
- A documented record of evidence handling that shows who accessed it, when, and why; it preserves admissibility and integrity.
- Incident severity triage
- A decision process that combines business impact and urgency to set response priority and escalation; critical data loss or outage triggers immediate escalation.
- Lessons learned review
- A post-incident examination of what happened, why, and what to change; corrective actions are assigned owners and tracked to closure.
- Recovery time objective
- The maximum acceptable time to restore a process or system after disruption; it drives recovery strategy selection and must be shorter than the maximum tolerable downtime.
- Recovery point objective
- The maximum acceptable data loss measured in time before disruption; it determines backup frequency and replication design.
- Business impact analysis
- A process that identifies critical processes, dependencies, and downtime impacts; it establishes RTO, RPO, and recovery priorities before strategy selection.
- Maximum tolerable downtime
- The longest time a business process can be unavailable before unacceptable harm occurs; recovery objectives must fit within this limit.
- Backup 3-2-1 rule
- Keep three copies of data on two different media with one copy offsite; restores must be tested because untested backups are unproven.