CISSO key terms

The system of direction and oversight that aligns security activities with organizational objectives, assigns accountability to leadership, and sets expectations for risk tolerance, resource allocation, and performance measurement across the enterprise.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and used to judge whether identified risks require treatment.

The acceptable variation around the risk appetite that a specific activity, system, or business unit may operate within before escalation or corrective action is required.

The process of identifying assets and threats, evaluating the likelihood and impact of adverse events, and determining the resulting level of risk so that treatment decisions can be prioritized.

A risk evaluation method that ranks risk using descriptive scales such as high, medium, and low, relying on expert judgment rather than numeric estimates of loss frequency and cost.

A risk evaluation method that assigns monetary and frequency values to potential losses, often producing an annualized loss expectancy so that risks can be compared and treatment budgets justified numerically.

The estimated monetary loss from one occurrence of a risk event, calculated as the asset value multiplied by the exposure factor representing the percentage of the asset damaged.

The expected yearly cost of a risk, computed by multiplying the single loss expectancy by the annualized rate of occurrence, used to compare the cost of a control against the loss it prevents.

The risk that remains after controls and countermeasures have been applied, which management must formally accept, transfer, or further reduce based on the organization's risk appetite.

A living record of identified risks that captures each risk description, owner, likelihood and impact ratings, existing controls, planned treatment actions, target dates, and current status for tracking and reporting.

A forward-looking metric that signals increasing exposure in a specific risk area, enabling management to act before losses occur rather than reporting only after incidents have happened.

A cross-functional leadership body that sets security priorities, approves policy and major investments, resolves conflicts between business and security objectives, and reviews risk and performance reporting on a recurring basis.

An architecture strategy that layers independent preventive, detective, and corrective controls across people, process, and technology so that failure of any single control does not expose the whole environment.

The principle that each user, service, or process receives only the access rights required to perform its assigned function, for only as long as needed, reducing the blast radius of misuse or compromise.

A control that divides a sensitive task among multiple people so that no single individual can initiate, approve, and conceal a transaction or configuration change without detection by another.

A design approach that treats no network location as inherently trusted, requiring continuous verification of identity and device posture and enforcing least-privilege access for every request regardless of origin.

The practice of dividing a network into isolated zones with controlled inter-zone traffic, limiting lateral movement by an attacker and allowing tighter policy enforcement around sensitive systems and data.

A network segment that hosts externally accessible services and is isolated from the internal network by filtering controls, so that compromise of a public-facing host does not directly expose internal systems.

An authorization model that grants permissions to roles defined by job function and then assigns users to those roles, simplifying administration and supporting consistent enforcement of least privilege.

The set of tools and processes that vault, broker, monitor, and record administrative credentials and sessions, reducing the risk that elevated accounts become the path to widespread compromise.

An approved documented set of settings for a system or device that serves as the reference for deployment, comparison, and remediation when drift is detected during audits or scans.

The gradual divergence of a deployed system's settings from its approved baseline, often caused by manual fixes or unmanaged updates, which can silently reopen vulnerabilities that were previously closed.

The controlled process for requesting, assessing, approving, testing, scheduling, and documenting modifications to systems, intended to prevent outages and unauthorized or untested alterations.

The continuous cycle of discovering assets, scanning for weaknesses, prioritizing findings by exploitability and business impact, remediating or mitigating them, and verifying that fixes actually worked.

The disciplined process of identifying, testing, deploying, and verifying software updates that correct known flaws, with timelines driven by severity and exposure of the affected systems.

A documented set of roles, responsibilities, communication paths, and step-by-step procedures that guides the organization from detection through containment, eradication, recovery, and post-incident review.

The recurring phases of preparation, detection and analysis, containment, eradication, recovery, and post-incident activity that structure how an organization handles a security incident from start to finish.

A predefined scale that rates incidents by business impact, data sensitivity, and scope, determining escalation paths, notification obligations, and the resources mobilized to respond.

The response action that stops an incident from spreading, using short-term measures such as isolation or blocking and longer-term measures that preserve evidence while restoring safe operations.

The documented, unbroken record of who collected, handled, transferred, and stored evidence, and when, so that its integrity can be defended if the matter proceeds to legal or disciplinary action.

The creation of a bit-for-bit copy of a storage device or memory space, together with a cryptographic hash of both source and copy, so analysis can proceed without altering the original evidence.

The prioritization of evidence collection from most to least perishable, starting with processor registers and memory before disk and archival media, so transient data is captured before it disappears.

The property that collected evidence has not been altered, demonstrated through hash verification, documented handling, and controlled access so that findings remain credible and admissible.

The maximum acceptable amount of data loss measured in time, which determines how frequently backups or replication must occur for a given system or business process.

The maximum acceptable elapsed time to restore a system or process after disruption, which drives decisions about redundancy, standby capacity, and restoration sequencing.

A structured study that identifies critical business processes, their dependencies, and the operational and financial consequences of outage over time, producing recovery priorities and objective targets.

Documented procedures and technical arrangements for restoring critical systems and data at an alternate location or configuration after a major disruption, including roles, contact lists, and activation criteria.

The broader organizational strategy for keeping essential business functions operating during and after disruption, encompassing people, facilities, suppliers, and communications in addition to technology recovery.

A structured post-incident examination of what happened, why controls failed or succeeded, and which plan changes, training, or technology investments should follow, with tracked corrective actions.

An inventory mapping each applicable law, regulation, contract clause, and standard requirement to the internal controls and owners responsible for satisfying it, supporting gap analysis and audit readiness.

The practice of linking individual security controls to the specific requirements they satisfy, allowing one control to demonstrate compliance with multiple frameworks and revealing uncovered obligations.

Records, configurations, logs, screenshots, or interviews that demonstrate a control operated as described during the audit period, retained and organized so an independent reviewer can verify the claim.

A time-bound plan that assigns owners and milestones for remediating findings from audits, assessments, or incidents, with follow-up verification to confirm the weakness has actually been resolved.

A formal process in which a system is assessed against defined security requirements (certification) and an authorizing official then accepts the residual risk of operating it (accreditation).

A document describing a system's boundary, data, implemented controls, and known weaknesses, serving as the primary artifact reviewed during certification and updated as the system changes.

The legal or contractual duty to inform regulators, affected individuals, or partners within defined timeframes after discovering unauthorized access to or disclosure of protected information.

The process for monitoring evolving laws, regulations, and contractual terms, assessing their impact on current controls, and updating policy and evidence before deadlines take effect.

A document that lists each control from a chosen standard, states whether it is applied or excluded, and justifies every exclusion, providing transparency about the scope of a compliance program.