NICA CCCA key terms

The amount and type of risk an organization is willing to accept in pursuit of its objectives. It guides how much security investment and residual risk leadership will tolerate.

The risk that remains after safeguards have been applied. It must be documented and formally accepted by an accountable owner, not assumed to be zero.

Choosing how to handle an identified risk: mitigate with controls, transfer it (for example via insurance), avoid the activity, or knowingly accept it.

A living record of identified risks with owners, likelihood, impact, existing controls, planned treatments, and review dates. It supports reporting and prioritization decisions.

Ranking risks using descriptive scales such as low, medium, and high based on judgment and experience. It is fast and useful when numeric data is scarce.

Expressing risk in monetary or numeric terms, often using annualized loss expectancy derived from asset value, exposure factor, and annualized rate of occurrence.

The expected monetary loss from one occurrence of an incident, calculated as asset value multiplied by exposure factor. It feeds into annualized loss expectancy.

The expected yearly loss from a risk, calculated by multiplying single loss expectancy by the annualized rate of occurrence. It helps compare risks against control costs.

Layering multiple independent controls across people, process, and technology so that failure of one safeguard does not expose the whole environment.

Dividing a network into zones with controlled traffic between them, limiting how far an attacker can move after initial compromise. Often enforced with firewalls and VLANs.

A perimeter network segment hosting systems reachable from untrusted networks while shielding the internal network. Traffic into internal zones is tightly restricted.

A firewall that inspects traffic beyond addresses and ports, adding application awareness, user identity, intrusion prevention, and threat intelligence integration.

A design principle that grants no implicit trust based on network location; every request is authenticated, authorized, and continuously evaluated before access is allowed.

Applying granular, workload-level access rules so individual servers or applications communicate only with approved peers, reducing lateral movement opportunities.

A sensor that monitors network or host activity for malicious patterns and raises alerts. Detection-focused deployments do not automatically block traffic.

An inline sensor that detects malicious traffic and can actively block or drop it. Placement matters because inline devices can affect availability.

A platform that centralizes logs from many sources, correlates events, generates alerts, and supports investigation and compliance reporting.

An alert that flags benign activity as malicious. High false positive rates cause alert fatigue and can hide genuine incidents from analysts.

A failure to detect activity that is actually malicious. It is the more dangerous error because the incident proceeds without any alert being raised.

Adjusting detection rules, thresholds, and exclusions to reduce noise while preserving coverage of real threats. It is an ongoing operational activity.

A documented set of roles, procedures, and communication paths for detecting, containing, eradicating, and recovering from security incidents. It should be exercised regularly.

The incident response phase that limits the spread and impact of an incident, for example by isolating hosts or disabling accounts, before eradication and recovery.

Removing the root cause of an incident, such as malware, attacker persistence, or a vulnerable configuration, so the environment can be safely restored.

A structured post-incident review that identifies what worked, what failed, and which controls or procedures should change to prevent recurrence.

A discussion-based simulation where participants walk through a hypothetical incident to test decision-making, roles, and communication without disrupting production.

Documentation tracking who handled evidence, when, and how, preserving its integrity for disciplinary, legal, or regulatory proceedings.

An automated assessment that identifies known weaknesses and missing patches on systems. Results require validation because they can include false positives.

An authorized, goal-oriented simulated attack that exploits weaknesses to demonstrate real business impact, typically performed after or alongside scanning.

A standardized scoring framework for the severity of a vulnerability, combining exploitability and impact metrics. Base scores do not account for local compensating controls.

The lifecycle of identifying, testing, deploying, and verifying software updates. Risk-based timelines prioritize internet-facing and critical systems.

Granting users and systems only the access needed to perform their tasks, and only for as long as needed. It limits the blast radius of compromise and misuse.

Assigning permissions to job roles rather than individuals, so users inherit access through their role assignment. It simplifies administration and access reviews.

Controls for administrative accounts, including vaulting credentials, session recording, and just-in-time elevation, to reduce misuse and credential theft impact.

Requiring two or more independent authentication factors, such as a password plus a hardware token. It reduces the impact of stolen passwords.

Trusting an external identity provider to authenticate users so they can access services with one set of credentials. It relies on standards such as SAML or OpenID Connect.

A periodic attestation where managers or system owners confirm that users still need their current entitlements, removing stale or excessive permissions.

Protecting stored data by converting it to ciphertext, typically using full-disk, database, or object-storage encryption. Keys must be managed separately and protected.

A protocol that encrypts and authenticates data in transit between clients and servers, protecting confidentiality and integrity over untrusted networks.

The lifecycle of generating, storing, rotating, and destroying cryptographic keys, including access controls and separation of duties for key custodians.

A one-way function producing a fixed-length value used to verify integrity or store passwords. It is not encryption and cannot be reversed to recover the input.

A cryptographic value that verifies the origin and integrity of a message or file using the signer's private key and a published certificate.

An approved standard configuration for systems, used to detect drift and enforce secure settings consistently across the environment.

Evaluating whether a security control is designed appropriately and operating effectively, producing evidence for auditors and management.

Keeping logs, test results, and records for a defined period to satisfy legal, regulatory, and audit requirements. Retention periods should reflect obligations.

The policy defining how long event and audit logs are kept and how they are protected from tampering, balancing investigation needs against storage cost.

A defined detection or monitoring scenario describing the behavior to detect, the data sources required, and the expected response when the alert fires.

A bit-for-bit copy of a storage device or memory captured for investigation, preserving original evidence while allowing analysis on a working copy.