Information Security Management Examination flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security governance

The framework of direction, authority, accountability, and monitoring by which executive management and the board ensure security objectives support business objectives.

Risk appetite

The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives, approved at executive or board level.

Risk tolerance

The acceptable variation or deviation from the approved risk appetite that an organization can tolerate before escalation or corrective action is required.

Annualized loss expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence; it expresses expected yearly financial loss for a given risk scenario.

Residual risk

The risk remaining after existing controls are applied; it must be compared against risk appetite and formally accepted by the accountable risk owner.

Policy versus standard

A policy states mandatory management intent and what must be achieved; a standard specifies measurable, verifiable requirements that implement the policy.

Policy exception

A documented, time-bound approval allowing deviation from a policy requirement, supported by risk assessment and signed by the accountable owner.

Document control

The practice of tracking document version, owner, classification, approval, distribution, and review date so that only current approved documents are used.

Segregation of duties

Splitting tasks so no single person can both perform and conceal an improper action, such as initiating and approving the same transaction or control.

Three lines model

A governance structure where operational management owns risk, a risk and compliance function provides oversight, and internal audit provides independent assurance.

RACI matrix

A responsibility assignment chart labeling each activity as Responsible, Accountable, Consulted, or Informed, with exactly one accountable party per activity.

Asset owner

The named individual accountable for an asset's classification, access authorization decisions, and periodic review of its value and protection requirements.

Information classification

Assigning information to defined sensitivity levels so that consistent handling rules for storage, transmission, sharing, and destruction can be applied.

Data sanitization

Irreversibly removing data from media so it cannot be recovered, using methods proportionate to the media type and the data's classification.

Pre-employment screening

Lawful, role-proportionate verification of a candidate's identity, qualifications, and background before granting employment and access to information assets.

Security awareness program

A recurring program that changes behavior through relevant messaging, role-based training, and measurement such as phishing simulation and completion metrics.

Exit procedure

The documented process for revoking access, recovering assets, reaffirming confidentiality obligations, and recording the departure of an employee or contractor.

Clean agent suppression

Fire suppression using inert gas or chemical agents that extinguish fire without leaving residue or damaging electronic equipment, typical in data centers.

UPS versus generator

An uninterruptible power supply bridges short outages and conditions power; a generator supplies extended power during prolonged grid failure.

Clear desk policy

A rule requiring that sensitive papers and removable media be secured and screens locked when workstations are unattended, verified through walkthroughs.

Least privilege

Granting users and processes only the access necessary to perform assigned tasks, for the minimum time required, and no more.

Role-based access control

An authorization model where permissions are assigned to job roles and users receive access by being placed into roles, simplifying review and revocation.

Access recertification

A periodic review in which asset and system owners confirm that each user's existing entitlements remain justified, removing those that do not.

Privileged access management

Controls over elevated accounts including credential vaulting, just-in-time elevation, session recording, and frequent review of administrative entitlements.

Incident response lifecycle

The phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned applied to a security incident.

Recovery time objective

The target elapsed time within which a business process or system must be restored after disruption, set by business impact analysis.

Recovery point objective

The maximum acceptable amount of data loss measured in time, determining the required backup or replication frequency for a system.

Chain of custody

Documented, unbroken record of who handled evidence, when, and how, required for the evidence to be credible in investigations or legal proceedings.

Business impact analysis

An analysis identifying critical processes, their dependencies, and the operational and financial consequences of disruption, producing recovery objectives.

Audit evidence

Information that is sufficient, relevant, and reliable enough to support an auditor's conclusion, such as system logs and signed approvals.

Data minimization

Collecting and retaining only personal data that is adequate, relevant, and necessary for the stated lawful purpose.

Litigation hold

A directive to preserve records relevant to anticipated or active legal proceedings, suspending normal retention and deletion schedules.