CISO key terms

The framework of policies, roles, and decision rights that directs how an organization sets security objectives, allocates authority, and holds leaders accountable for outcomes.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms and approved by senior leadership.

The acceptable variation around the risk appetite for a specific category or metric, defining the boundary at which action or escalation is triggered.

A forward-looking metric that signals rising exposure in a risk area, enabling leadership to act before losses or incidents materialize.

A structured record of identified risks with owners, likelihood, impact, ratings, treatment plans, and review dates, used to track and prioritize remediation.

The chosen response to a risk: mitigate through controls, transfer through insurance or contracts, avoid by stopping the activity, or accept with documented approval.

The exposure remaining after controls are applied, which leadership must compare against tolerance and formally accept when it exceeds target levels.

A governance structure where operational management owns risk, an independent risk and compliance function provides oversight, and internal audit gives assurance to the board.

The governing body's duty to set expectations, approve risk appetite, monitor security performance, and ensure management is accountable for the program.

A cross-functional executive forum that prioritizes security investments, resolves competing priorities, and monitors program performance against agreed objectives.

A multi-year plan that links security objectives to business goals, defines target capabilities, and sequences investments, staffing, and change initiatives.

A time-phased plan of initiatives, dependencies, and milestones that translates the security strategy into sequenced, resourced, and measurable work.

A staged framework describing progressive capability levels, used to assess the current state, set targets, and justify improvement investments.

A structured evaluation of whether people, processes, and technology can deliver a required security outcome, revealing gaps that inform planning.

A disciplined set of measures that track control effectiveness, risk reduction, and service performance, reported to stakeholders to support decisions.

The business case that quantifies risk reduction and enables investment decisions by comparing expected loss avoidance against the cost of controls.

Layering independent preventive, detective, and corrective controls so that failure of one safeguard does not expose the whole environment.

An architecture principle that removes implicit trust from the network and grants access per request based on identity, device posture, and context.

Granting each user, service, or process only the access needed for its function, for no longer than necessary, reducing blast radius from compromise.

Dividing networks and workloads into isolated zones with enforced traffic controls, limiting lateral movement after an initial compromise.

The processes and technology governing authentication, authorization, provisioning, and lifecycle of identities across systems and applications.

Controls that vault, broker, rotate, and record high-privilege credentials and sessions, reducing misuse and improving accountability for administrative actions.

A structured exercise that identifies assets, adversaries, attack paths, and required mitigations during design, before weaknesses are built into systems.

An approach that builds security requirements and controls into architecture and development from the start, rather than adding them after deployment.

An assessment of a proposed or existing design against standards, threat models, and control requirements, producing documented findings and approval conditions.

A staffed function that monitors alerts, triages events, and coordinates response around the clock or during defined coverage windows.

A platform that centralizes logs, correlates events across sources, and generates alerts that analysts investigate and escalate.

The discipline of designing, testing, and tuning detection logic and data sources so that meaningful adversary behavior is surfaced with manageable false positives.

A continuous cycle of discovering, prioritizing, remediating, and verifying weaknesses using risk context such as exploitability and asset criticality.

The process of testing, deploying, and verifying software fixes within defined timeframes based on severity and exposure of affected assets.

An approved, documented set of settings for a system type, used to detect drift and enforce consistent hardening across the estate.

A documented set of roles, phases, communication paths, and decision authorities that guides the organization from detection through recovery and lessons learned.

A step-by-step procedure for handling a specific incident type, specifying actions, owners, evidence handling, and escalation triggers.

A classification that reflects business impact and urgency, driving escalation level, resource commitment, and notification obligations.

The legal and contractual duty to inform regulators, affected individuals, or partners within defined timeframes after a qualifying data compromise.

A blameless analysis after an incident that identifies root causes, control failures, and corrective actions with owners and due dates.

A study that identifies critical processes, dependencies, and the tolerable outage and data loss for each, producing recovery priorities.

The maximum acceptable time to restore a process or system after disruption, used to size resilience, redundancy, and recovery arrangements.

The maximum acceptable amount of data loss measured in time, determining backup frequency and replication design.

Documented procedures and alternate arrangements that keep priority operations running during disruption and guide restoration to normal service.

Predefined audiences, messages, channels, and spokespeople for informing employees, customers, regulators, and media during a significant disruption.

A facilitated scenario discussion that tests plans, decision-making, and coordination among participants without disrupting live systems.

A sustained effort combining training, communications, and behavior reinforcement to reduce risky user actions and improve reporting of threats.

A controlled exercise that sends realistic decoy messages to measure susceptibility and reporting behavior, followed by targeted coaching.

The shared beliefs and norms that shape how employees treat security, reflected in reporting behavior, accountability, and leadership example.