CISRM key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed as a statement or set of thresholds approved by senior leadership.

The acceptable variation around a risk appetite target, giving operational boundaries within which business units can act without escalation to executive management.

The maximum risk an organization can absorb before its financial, operational, or reputational viability is threatened, regardless of stated willingness to take risk.

A governance structure separating operational management (first line), independent risk and compliance oversight (second line), and internal audit (third line) to clarify accountability for risk.

The framework of roles, responsibilities, policies, and reporting lines that determines how decisions about risk are made, escalated, and overseen across an organization.

A subset of the board of directors responsible for overseeing the enterprise risk management framework, reviewing top risks, and challenging management's risk decisions.

The shared values, attitudes, and behaviors that determine how employees identify, discuss, escalate, and respond to risk in day-to-day decisions.

A maintained record of an organization's information assets, owners, locations, and criticality, forming the basis for scoping risk assessments and applying controls.

The named individual accountable for an asset's classification, protection requirements, and access decisions throughout its lifecycle.

A rating of how essential an asset is to business operations, often based on impact of loss, used to prioritize protection and assessment effort.

Assigning labels such as public, internal, confidential, or restricted to information so handling controls match its sensitivity and regulatory obligations.

Collected, analyzed information about threat actors, campaigns, and vulnerabilities used to anticipate attacks and inform risk identification and prioritization.

A structured exercise that identifies likely threat actors, attack paths, and weaknesses against a system or process before controls are designed.

A living log of identified risks recording description, owner, likelihood, impact, rating, controls, treatment plans, and review dates.

The person accountable for managing a specific risk, including approving treatment plans and monitoring whether exposure stays within tolerance.

Assessing risk using descriptive scales such as low, medium, and high, relying on expert judgment rather than numeric probability and financial loss estimates.

Expressing risk numerically, often as annualized loss expectancy derived from asset value, exposure factor, and annualized rate of occurrence.

The monetary loss expected from one occurrence of an incident, calculated as asset value multiplied by the exposure factor.

The expected yearly financial loss from a risk, calculated by multiplying single loss expectancy by the annualized rate of occurrence.

The percentage of an asset's value that would be lost if a given threat event occurred, used in quantitative loss calculations.

The estimated number of times a threat event is expected to happen in one year, used as the frequency input in loss expectancy calculations.

The assessed probability that a threat will exploit a vulnerability and cause harm, considering threat capability, exposure, and effectiveness of existing controls.

The magnitude of harm a risk event would cause, measured in financial, operational, regulatory, reputational, or safety terms.

A grid plotting likelihood against impact to assign risk ratings and define thresholds that trigger escalation or treatment decisions.

The level of risk that exists before any controls are applied, used as a baseline to judge how much protection controls actually provide.

The risk remaining after existing or planned controls are applied, which must be compared against risk tolerance and formally accepted.

Ranking risks by rating, velocity, and business criticality to allocate limited treatment resources to the exposures that matter most.

A structured description of a plausible event chain, including threat actor, method, affected asset, and consequence, used to make assessments concrete and comparable.

Selecting and implementing a response to a risk: mitigate with controls, transfer to a third party, avoid the activity, or accept the exposure.

A documented decision by an accountable manager to retain a risk without further treatment, valid only when exposure sits within approved tolerance.

Shifting the financial consequence of a risk to another party, typically through insurance or contractual indemnities, without eliminating the underlying exposure.

Layering independent preventive, detective, and corrective controls so a single control failure does not expose the asset to full compromise.

A safeguard designed to stop an unwanted event before it occurs, such as access restrictions, encryption, or segregation of duties.

A safeguard that identifies an event after it has occurred, such as logging, monitoring, or reconciliation, enabling timely response.

A weakness where an identified risk lacks an effective control, or where an existing control does not operate as designed.

The comparison of a control's implementation and operating cost against the loss expectancy it reduces, showing whether treatment is economically sound.

A forward-looking metric that signals rising exposure in a risk area, giving management early warning before losses occur.

Communicating risk status, trends, and treatment progress to executives, the board, and other stakeholders in a form suited to their decisions.

The exposure created when vendors, suppliers, or partners hold data, run processes, or provide services on which the organization depends.

Pre-contract assessment of a supplier's security, financial stability, and compliance posture, proportionate to the criticality of the service.

Exposure arising from a vendor's own subcontractors or dependencies, which the organization does not contract with directly but still inherits.

A contract provision allowing the organization or its designee to inspect a vendor's controls, records, and facilities to verify compliance.

A legal requirement from a law, regulation, or regulator that mandates specific controls, reporting, or conduct, carrying penalties for failure.

The exposure to legal penalties, financial forfeiture, or reputational damage from failing to act in accordance with laws, regulations, or internal policies.

The process of tracking new and amended regulations, assessing their impact on controls and processes, and updating the compliance program accordingly.

An analysis identifying critical business functions, their dependencies, and the operational and financial consequences of disruption over time.

The maximum acceptable duration of downtime for a business process or system before consequences become unacceptable.

The maximum acceptable amount of data loss measured in time, defining how far back recovery must be able to restore.

Documented procedures for maintaining or restoring critical operations during and after a disruption, including roles, alternates, and communication paths.

A defined set of phases, roles, and escalation paths for detecting, containing, eradicating, and recovering from a security incident.