CISO flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Residual Risk

The risk remaining after controls are applied. Calculated as inherent risk reduced by control effectiveness. Business owners formally accept residual risk; security teams quantify and advise on it.

Statement of Applicability

ISO/IEC 27001 document listing every Annex A control, whether it is implemented, and the justification for inclusion or exclusion. It is the auditable link between risk assessment and control selection.

Three Lines Model

Governance structure where operational management owns controls, risk and compliance functions provide independent oversight, and internal audit provides independent assurance to the board.

Compensating Control

An alternative safeguard used when the primary control is infeasible or too costly. It must achieve equivalent risk reduction and be documented with justification and an owner.

Key Risk Indicator

A leading metric with a defined threshold that signals increasing risk exposure. Crossing the threshold triggers escalation to management rather than automatic risk acceptance.

Policy Hierarchy

Ordered set of governance documents: policy states mandatory intent, standard sets measurable requirements, procedure gives step-by-step instructions, and guideline offers recommended practice.

Security Steering Committee

Cross-functional body including the CISO, business unit leads, CIO, CFO, and legal. It prioritizes security investment, resolves conflicts, and records decisions with owners and due dates.

Security Charter

Document defining the CISO's mandate, reporting line, authority to set policy, and budget ownership. Ambiguity in the charter is a leading cause of program failure.

Maturity Model Scale

Capability rating on a five-level scale: initial, managed, defined, quantitatively managed, and optimizing. Ratings support gap analysis and roadmap sequencing across security domains.

Board Risk Reporting

Reporting security posture to the board in business language, emphasizing financial exposure, regulatory standing, and trend, rather than operational tool metrics such as patch counts.

Security Culture Metric

Behavioral indicator of security culture, such as phishing simulation failure rate, helpdesk report rate, or policy exception volume. Training completion alone does not measure culture.

Zero Trust

Architecture principle set: verify explicitly, apply least privilege, and assume breach. Network location never grants trust; every access request is authenticated and authorized.

STRIDE Threat Modeling

Design-time technique classifying threats as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Applied before code is written.

Trust Boundary

Any point where data or control crosses between differing privilege, ownership, or trust levels. Each boundary requires a defined and tested control.

Shared Responsibility Model

Cloud division of duty: the provider secures underlying infrastructure, while the customer secures data, identity, configuration, and access across all service models.

Microsegmentation

Granular network control isolating workloads so lateral movement is limited. Often used as a compensating control when flat networks cannot be redesigned within budget or timeline.

Encryption Key Management

Lifecycle control of cryptographic keys: generation, distribution, rotation, storage, revocation, and destruction. Weak key management defeats strong encryption algorithms.

Secure SDLC Gates

Mandatory checkpoints in development: design review with threat model, static analysis on commit, dependency scanning in build, dynamic testing, and penetration test before major launch.

Patch Risk Tiering

Prioritizing remediation by exposure: critical internet-facing vulnerabilities typically within fifteen days, high within thirty, medium within ninety, with documented exceptions.

Privileged Access Management

Controls governing administrative accounts: vaulting of shared credentials, session recording, just-in-time elevation, and multi-factor authentication on all privileged access paths.

CVSS Severity Bands

Base score ranges: 9.0 to 10.0 critical, 7.0 to 8.9 high, 4.0 to 6.9 medium, 0.1 to 3.9 low. Asset criticality and exploitability adjust prioritization.

3-2-1 Backup Rule

Three copies of data, on two different media, with one copy offsite or offline. At least one copy must be immutable to resist ransomware encryption.

Separation of Duties

No single person controls an entire transaction. In change management, the developer of a change cannot be its sole approver or sole production deployer.

MTTD and MTTR

Mean time to detect and mean time to respond. These are the primary effectiveness measures for security operations; raw alert volume is not a quality indicator.

Incident Response Lifecycle

Phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned. Each phase has defined entry criteria and deliverables.

GDPR 72-Hour Notification

Breach notification to the supervisory authority within seventy-two hours of awareness, unless the breach is unlikely to result in risk to individuals' rights and freedoms.

Chain of Custody

Documented record of who handled evidence, when, and how. Volatile data such as memory and network state is preserved first; forensic images replace live edits.

Containment Strategy

Choosing among isolate, disable, block, or segment to stop incident spread. The choice balances containment speed against evidence preservation and business continuity.

Blameless Post-Incident Review

Structured review producing tracked corrective actions with owners and due dates. Recurrence of the same root cause signals a governance failure, not a technical one.

Recovery Time Objective

Maximum tolerable downtime for a process before unacceptable business impact. Must be less than or equal to the maximum tolerable downtime established in the BIA.

Recovery Point Objective

Maximum tolerable data loss measured in time before the disruption. It determines backup frequency and replication strategy for each system.

Awareness Versus Training

Awareness builds broad security attitude across all staff; training builds role-specific skill for defined job functions. They are separate programs with separate metrics.

Phishing Report Rate

Percentage of recipients who report a simulated phishing message. This is the most meaningful culture indicator, more so than click rate or completion metrics.