CISRM flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk appetite

The amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives, formally approved by the governing body and expressed in measurable terms.

Risk tolerance

The acceptable variation or deviation around the stated risk appetite that an organization can withstand before triggering escalation or corrective action by management.

Residual risk

The level of risk remaining after existing controls and treatments have been applied; it is the basis for formal acceptance decisions and board reporting.

Three lines model

Governance structure where operational management owns risk, a risk and compliance function provides oversight and challenge, and internal audit gives independent assurance.

Risk owner

The accountable individual with authority to manage a specific risk, including approving and funding treatment, distinct from the person executing control tasks.

Risk statement structure

A well-formed risk is expressed as cause leading to event leading to consequence, tied to a specific business objective, rather than a vague category label.

Asset inventory

A maintained register of hardware, software, data, people, facilities, and third parties, each with a unique identifier, owner, classification, and location.

Data classification

Assignment of data to tiers such as public, internal, confidential, or restricted, which determines handling rules, access controls, retention, and protection requirements.

Dependency mapping

Identifying upstream suppliers, downstream customers, and internal service chains so the blast radius of a single failure becomes visible and manageable.

Annualized loss expectancy

ALE = single loss expectancy multiplied by annualized rate of occurrence; it expresses expected yearly financial loss for a given risk scenario.

Single loss expectancy

SLE = asset value multiplied by exposure factor, representing the expected monetary loss from one occurrence of a threat event against an asset.

Bow-tie analysis

A diagram placing a central event between causes on the left and consequences on the right, with preventive controls on causes and mitigating controls on consequences.

FAIR methodology

A quantitative risk model decomposing risk into frequency (threat event frequency times vulnerability) and magnitude (primary plus secondary loss), often simulated with Monte Carlo.

FMEA

Failure mode and effects analysis scores severity, occurrence, and detection for each failure mode; the risk priority number is their product.

Risk criteria

Documented thresholds, appetite limits, and regulatory constraints against which analyzed risk is compared to decide whether to accept, treat, transfer, or avoid.

Risk velocity

The speed at which a risk event materializes and causes impact; high-velocity risks warrant prioritization beyond their static score alone.

Risk aggregation

Combining individual risk exposures into a portfolio view, accounting for dependencies and shared controls rather than simply summing individual scores.

Treatment cost-benefit

A control is justified when the expected reduction in annualized loss exceeds the total cost of ownership of implementing and operating it.

Compensating control

An alternative safeguard used when a primary control is infeasible, providing equivalent risk reduction and documented as a substitute in the control record.

Defense in depth

Layering preventive, detective, and corrective controls so that failure of any single control does not result in unmitigated loss.

Statement of applicability

A document listing which controls are applied, which are excluded, and the justification for each exclusion, used as audit and certification evidence.

Control effectiveness

The degree to which a control reduces inherent risk to residual risk; measured through design effectiveness and operating effectiveness testing over time.

Key risk indicator

A leading metric with defined thresholds and an owner that signals rising or falling exposure before losses occur, enabling proactive management action.

Risk register

The central record of identified risks with description, cause, consequence, owner, inherent and residual scores, treatments, status, and review dates.

Escalation criteria

Predefined triggers such as threshold breach, repeated control failure, emerging risk, or material context change that require reporting to higher authority.

Vendor tiering

Classifying third parties by data sensitivity, system access, and business dependency to determine assessment depth and monitoring frequency.

Fourth-party risk

Exposure arising from a vendor's own subcontractors and suppliers, which can propagate failures not visible in direct vendor assessments.

Right to audit clause

A contract provision allowing the customer to examine a vendor's controls, records, and environments, often satisfied through independent attestation reports.

Data subject rights

Entitlements such as access, rectification, erasure, portability, and objection that organizations must operationalize within regulatory timeframes.

Records retention schedule

A documented plan specifying how long each record class is kept, reflecting legal, regulatory, and contractual minimums and maximums.

Recovery time objective

The target duration within which a business process or system must be restored after disruption, set below the maximum tolerable downtime.

Recovery point objective

The maximum acceptable amount of data loss measured in time, determining backup and replication frequency for a given system.