PRMIA CCRM flashcards

31 cards. Read the term and the definition here. The deck at the top of this page is optional.

Risk identification output

The documented set of assets, threats, and vulnerabilities with their linkages. It defines scope for later assessment; it does not assign probabilities or monetary values.

Crown jewel analysis

Ranking assets by the operational dependency they create, such as identity, backup, or network control systems, rather than by purchase price or data volume alone.

STRIDE categories

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Each category points to a specific control family during threat modeling.

Fourth-party risk

Concentration risk from vendors of your vendors, such as a shared cloud or CDN provider. Failure is correlated across many contracts, so losses cannot be treated as independent.

Insider threat indicators

Behavioral and access signals such as unusual bulk downloads, privilege escalation attempts, access outside role, and activity near resignation dates. Detected by monitoring, not by perimeter controls.

Loss event taxonomy

Grouping incidents into confidentiality, integrity, availability, fraud/theft, and legal/regulatory liability. Each category has different frequency and cost drivers, so mixing them distorts estimates.

OT/ICS convergence risk

Connecting operational technology to enterprise networks exposes availability-critical industrial control systems to IT-origin threats. Identification must cover legacy protocols lacking authentication or encryption.

Identification gap test

A completeness check requiring every asset to map to at least one threat and one loss category. Unmapped assets represent unknown exposure, not zero exposure.

FAIR risk formula

Risk equals Loss Event Frequency multiplied by Loss Magnitude. Loss Event Frequency is Threat Event Frequency times Vulnerability, expressed as a probability between zero and one.

Annualized loss expectancy

ALE equals single loss expectancy multiplied by annualized rate of occurrence. It expresses expected annual cost of a scenario and supports control cost-benefit comparison.

Single loss expectancy

SLE equals asset value multiplied by exposure factor. Exposure factor is the proportion of asset value impaired by one event, not the likelihood of the event.

Loss magnitude components

Primary loss covers direct response, replacement, and productivity cost. Secondary loss covers fines, legal defense, customer churn, and reputation damage, often exceeding primary loss.

Vulnerability in FAIR

The probability that a threat event becomes a loss event, given existing controls. Effective controls lower vulnerability and therefore lower loss event frequency.

Monte Carlo P95

The loss value not exceeded in 95 percent of simulated years. Used to size capital reserves and insurance limits, because the mean hides the heavy right tail.

Risk appetite versus tolerance

Appetite is the broad willingness to accept risk; tolerance is the quantified limit at a stated confidence, such as annual loss at the 95th percentile below a set amount.

5x5 risk matrix limits

Produces ordinal scores from 1 to 25. Scores cannot be averaged, summed, or compared arithmetically across risks; use them only for ranking and escalation thresholds.

Correlated risk aggregation

Combining loss distributions rather than summing individual annualized losses. Simple summation assumes independence and understates aggregate exposure when common causes exist.

Threat event frequency

How often a threat actor attempts or a natural event occurs against an asset in a period. Estimated from internal incident counts, external loss data, or expert elicitation.

Control effectiveness mapping

Preventive controls reduce loss event frequency; detective and corrective controls reduce loss magnitude by shortening event duration and limiting scope.

Scenario calibration rule

Use internal incident data when at least five to ten events per year exist. Below that, combine external loss data with documented expert ranges and state confidence.

Loss exceedance curve

A plot of probability that annual loss exceeds a given amount. It communicates risk appetite breaches and tail exposure to executives more clearly than single-point estimates.

Risk treatment options

Mitigate, transfer, avoid, and accept. Each accepted residual risk requires a named owner, a threshold, and a scheduled review date.

Control cost-benefit rule

A control is justified when the reduction in annualized loss expectancy exceeds its total lifecycle cost, including implementation, licensing, staffing, and maintenance.

Cyber insurance limit sizing

Set the limit near the 95th to 99th percentile annual aggregate loss. Verify sublimits for extortion, dependent business interruption, and regulatory defense costs.

RTO versus RPO

Recovery time objective is maximum tolerable downtime; recovery point objective is maximum tolerable data loss. RPO drives backup frequency; RTO drives recovery architecture.

Incident response sequence

Detect, contain, eradicate, recover, then post-incident review. Containment precedes eradication, and validated recovery testing precedes return to full production.

Key risk indicators

Quantitative forward-looking metrics with thresholds, such as patch latency, MFA coverage, privileged account count, and backup restore pass rate. They signal rising exposure before losses occur.

Risk register contents

Risk identifier, scenario description, inherent score, controls, residual score, owner, treatment plan, key risk indicator, and review date. It is the audit trail for treatment decisions.

Board-level cyber reporting

Expressing cyber risk in financial and operational terms, such as loss exceedance curves and tolerance breaches, rather than counts of technical controls or vulnerabilities.

Notification clock obligations

Contractual and regulatory deadlines for reporting breaches to regulators, customers, and partners. They constrain containment speed and must be pre-mapped in the response plan.

Residual risk acceptance

Formal decision to retain risk after treatment, recorded with owner, quantified level, rationale, and expiry. Undocumented acceptance is a governance failure, not a treatment choice.