SEC-CISI Diploma key terms

Systems, assets, and networks, whether physical or virtual, so vital that their incapacity or destruction would weaken security, national economic security, public health, or safety.

A designated government body that partners with owners and operators in a specific infrastructure sector to reduce risk, share threat information, and coordinate incident response within that sector.

A disruption in which the failure of one system or node triggers failures in dependent systems, amplifying impact well beyond the original incident and complicating containment and recovery.

A bidirectional relationship in which two infrastructures rely on each other, so that a disruption in either one degrades the operation of the other, often in ways that are hard to predict.

A ranking of assets by how much their loss or compromise would harm an organization's mission, safety, or obligations, used to prioritize protection, monitoring, and recovery spending.

A structured study that identifies time-sensitive processes and quantifies the operational and financial consequences of their disruption, producing recovery priorities and time-based recovery targets.

The maximum acceptable elapsed time to restore a process, system, or service after a disruption, before the consequences defined in the business impact analysis become unacceptable.

The maximum acceptable amount of data, measured in time, that may be lost in a disruption, which drives backup frequency and replication design decisions.

A documented set of procedures that lets an organization keep its essential functions running during and after a disruption, including alternate sites, delegations of authority, and devolution arrangements.

A cooperative arrangement in which government and private owners or operators share information, resources, and responsibilities to protect and restore infrastructure that neither can secure alone.

A group that collects, analyzes, and distributes threat and vulnerability information among its members, often within a sector, to improve collective situational awareness and response.

A sector-specific, often member-funded organization that gathers and disseminates cyber and physical threat data among infrastructure owners and operators and their government partners.

A set of color-coded sharing markings that tells recipients how far they may redistribute information, ranging from limited internal use to fully public release.

Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, and implications, that supports decisions about prevention, detection, and response.

A forensic artifact such as a malicious file hash, domain, IP address, or registry key that suggests a system has been breached and can be used to detect or scope an intrusion.

A behavioral signal that an intrusion is underway or being prepared, such as unusual privilege escalation or command execution, detected regardless of the specific tools used.

The behavioral patterns describing how an adversary operates: high-level goals, the methods used to achieve them, and the specific step-by-step implementations observed in campaigns.

A proactive, hypothesis-driven search through networks and endpoints for signs of compromise that existing automated detection tools have missed, rather than waiting for alerts.

The process by which a discovered security flaw is reported to the party responsible for fixing it, including coordination timelines and decisions about when public details are released.

A structured practice in which finders, vendors, and coordinators agree on remediation and publication timing, reducing risk to users while giving defenders time to patch.

A formal arrangement that rewards outside researchers for responsibly reporting qualifying vulnerabilities, with published scope, rules of engagement, and payout tiers.

An authorized, simulated attack against defined systems to identify exploitable weaknesses and validate whether existing controls actually resist a motivated adversary.

A goal-oriented, adversary-simulation engagement that tests people, processes, and technology together, often without defenders knowing the timing, to measure real detection and response capability.

The written constraints governing an authorized security test, covering permitted targets, prohibited techniques, timing windows, escalation contacts, and how to handle unintended findings.

The explicitly defined boundary of systems, networks, and data that an authorized assessment may touch, including exclusions, so that testing stays lawful and avoids operational harm.

A discussion-based session in which participants walk through a simulated incident scenario to test plans, decision-making, and coordination without disrupting live operations.

A structured debrief after an exercise or real incident that compares intended and actual outcomes, identifies root causes of gaps, and assigns owners and deadlines for corrective actions.

A documented framework defining roles, communication paths, and phased actions for detecting, containing, eradicating, and recovering from a security incident, with criteria for escalation.

The repeating sequence of preparation, detection and analysis, containment, eradication, recovery, and post-incident activity that structures how organizations handle security incidents.

The phase of incident handling aimed at limiting the spread and damage of a compromise, using short-term measures such as isolation and long-term measures such as rebuilding systems.

The incident-handling step that removes the root cause of a compromise, such as malware, unauthorized accounts, or exploited vulnerabilities, before systems are returned to service.

A predefined, repeatable set of steps and decision points for handling a specific incident type, enabling consistent, faster response and easier automation.

A platform that integrates security tools and automates repetitive response tasks through workflows, reducing analyst workload and shortening the time between detection and action.

A system that centralizes log collection from many sources, correlates events, and generates alerts so analysts can detect and investigate suspicious activity across the enterprise.

Agent-based software that continuously records endpoint activity, detects malicious behavior, and supports investigation and remote containment actions on compromised hosts.

A methodical investigation that traces an incident or failure back to the underlying condition that allowed it, so that corrective actions prevent recurrence rather than just treating symptoms.

Documented insights from incidents and exercises that are turned into concrete changes in plans, controls, training, or technology, and tracked until verified as implemented.

The disciplined process of inventorying software, assessing vulnerabilities, testing updates, deploying fixes on a schedule, and verifying installation across the environment.

A continuous cycle of discovering, prioritizing, remediating, and verifying weaknesses across assets, driven by risk rather than raw severity scores alone.

An approved, documented set of settings for a system or class of systems that serves as the reference for detecting drift and enforcing secure configuration.

The principle of granting each user, process, and system only the access needed to perform its function, and only for as long as needed, limiting blast radius if compromised.

Controls that secure, vault, rotate, and monitor accounts with elevated rights, including just-in-time elevation and session recording, to reduce misuse and credential theft risk.

Authentication requiring two or more independent credential types, such as a password plus a hardware token, so that a stolen password alone does not grant access.

A security model that assumes no implicit trust based on network location and instead verifies every request through continuous authentication, authorization, and least-privilege enforcement.

Dividing a network into isolated zones with controlled traffic between them, so that a compromise in one area cannot spread freely to critical systems.

The exposure created by dependence on vendors, service providers, software components, and hardware sources whose security practices or integrity can affect the organization's own operations.

A structured evaluation of a vendor's security posture, contractual obligations, and resilience before onboarding and periodically thereafter, scaled to the criticality of the service.

A machine-readable inventory of the components and dependencies in a software product, enabling organizations to identify exposure quickly when a new vulnerability is disclosed.

The remote or on-site connectivity granted to suppliers and contractors, which must be inventoried, limited, monitored, and revoked promptly when no longer needed.

A contract that obligates parties to protect confidential information shared between them, commonly used before exchanging sensitive security or incident details with external parties.