Information Security Management Examination key terms

The system of direction and control by which senior leadership sets security objectives, assigns decision rights, and monitors performance so that security effort supports organizational strategy and legal obligations.

A cross-functional executive body that prioritizes security initiatives, resolves competing demands for resources, and reviews risk and performance reports on behalf of top management.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and used to judge whether treatment is required.

The acceptable variation around the risk appetite for a specific activity or asset, often stated as a threshold or limit that triggers escalation when exceeded.

The overall process of identifying, analyzing, and evaluating risk, combining likelihood and impact estimates with comparison against risk criteria to decide what needs treatment.

The risk that remains after controls have been implemented and evaluated, which management must consciously accept, transfer, or further reduce.

The process of selecting and applying options to modify risk, typically avoiding, reducing, sharing, or retaining it, then verifying that the chosen option achieves the intended effect.

A structured record of identified risks with owners, assessed likelihood and impact, existing controls, treatment plans, and status, used to track and report risk over time.

A high-level management statement of intent and direction that defines security objectives, principles, and mandatory requirements, and authorizes the supporting standards and procedures.

A mandatory, specific requirement that translates policy into measurable rules, such as approved cryptographic algorithms, password length, or configuration baselines that must be met.

A detailed, step-by-step description of how to perform a task or process to meet a policy or standard, including who does what, when, and with which inputs and outputs.

A documented, approved minimum set of controls or configurations applied uniformly to a class of systems or assets, from which deviations require formal exception approval.

A formally documented and approved deviation from a policy, standard, or baseline, with a stated business justification, compensating controls, an owner, and an expiry date.

Dividing tasks and privileges so that no single person can both initiate and conceal a sensitive action, such as requesting, approving, and recording a payment or access change.

The principle of granting each user, process, or system only the access rights needed to perform its assigned tasks, and no more, for only as long as needed.

A restriction limiting access to information to those who require it to perform their duties, independent of whether they hold a higher clearance or job title.

A maintained record of information assets and their owners, locations, and value, forming the basis for risk assessment, classification, and protection decisions.

The accountable role that classifies an information asset, defines its protection requirements, and approves access decisions, even when day-to-day custody is delegated.

The role responsible for implementing and operating the safeguards defined by the asset owner, such as backups, access provisioning, and physical protection of the asset.

Assigning information to defined sensitivity categories, such as public, internal, confidential, and restricted, so that handling rules and controls are applied consistently.

The defined period for which records must be kept to satisfy legal, regulatory, contractual, or operational needs, after which they are securely disposed of.

The process of destroying or sanitizing media and paper so that information cannot be recovered, using methods appropriate to the media and the classification of the data.

Rules describing permitted and prohibited use of organizational systems, networks, and data, including personal use limits, monitoring notice, and consequences of violation.

Ongoing education that builds employee recognition of threats and correct behavior, reinforced by simulated phishing and measured through behavior rather than completion alone.

A controlled exercise that sends realistic fake messages to employees and records who reports or clicks them, used to measure and improve awareness without punishment.

The checks applied when people join, move, or leave a role, covering background screening, signed agreements, access provisioning, asset return, and prompt revocation of rights.

Physical and workstation practices requiring that sensitive papers be locked away and unattended screens be locked, reducing casual disclosure and theft in shared spaces.

Measures such as badges, locks, turnstiles, guards, and visitor logging that restrict entry to facilities and sensitive areas to authorized individuals only.

The set of mechanisms that decide and enforce who or what may use a resource and in what manner, spanning identification, authentication, authorization, and logging.

Authentication using two or more independent factor types, such as something known, possessed, or inherent, so that one compromised factor alone does not grant access.

Controls over administrative accounts, including vaulting credentials, just-in-time elevation, session recording, and review, because these accounts can bypass most other safeguards.

A periodic, documented verification by asset or system owners that each user's current access remains justified, with inappropriate rights removed promptly.

The structured process for detecting, reporting, triaging, containing, eradicating, and recovering from security incidents, followed by lessons learned to improve controls.

A documented set of roles, communication paths, escalation triggers, and step-by-step actions that guides the organization during and after a security incident.

Documented arrangements for keeping or restoring critical business functions during disruption, including recovery priorities, alternate arrangements, and communication with stakeholders.

The technical component of continuity planning that specifies how systems, data, and infrastructure are restored after a major outage, including backups and alternate sites.

The maximum acceptable duration of interruption for a process or system before the impact becomes unacceptable, used to set recovery capability and architecture requirements.

The state of meeting applicable laws, regulations, contracts, and internal policies, demonstrated through evidence such as records, testing results, and management attestations.

An independent function that examines controls and compliance against defined criteria and reports findings to governance bodies, separate from the management it reviews.

Verifiable records, logs, screenshots, or test results retained to demonstrate that a control operates as described and that requirements were met during a given period.

Quantitative measures that track control effectiveness, risk exposure, and process performance, chosen so that they inform decisions rather than merely report activity volume.