PRMIA CCRM key terms

The potential for loss or harm to an organization's information, systems, or operations arising from threats that exploit digital assets and dependencies. It combines the likelihood of an event with its business impact.

An individual or group that carries out or sponsors actions intended to compromise systems or data. Categories include nation-states, organized crime, insiders, hacktivists, and opportunistic attackers, each with distinct capability and motivation profiles.

Evidence-based information about existing or emerging threats, including indicators, tactics, techniques, and actor behavior, collected and analyzed to inform defensive decisions and risk prioritization.

Observable evidence that a system or network has been breached, such as unusual file hashes, malicious domains, or anomalous login patterns. These artifacts support detection and incident response but age quickly.

A weakness in software, configuration, process, or human behavior that a threat could exploit to cause harm. Vulnerabilities are intrinsic conditions, distinct from the threats that may act on them.

A technique, code, or sequence of actions that takes advantage of a vulnerability to achieve unauthorized effects. The existence of a working exploit raises the practical likelihood that a weakness will be attacked.

A software flaw unknown to the vendor or without an available fix at the time of discovery. Exploitation before patching makes it especially dangerous and hard to defend against with standard controls.

The total set of points through which an unauthorized party could enter or extract data from a system, including networks, applications, endpoints, identities, and third-party connections. Reducing it lowers exposure.

Risk arising from employees, contractors, or partners who misuse legitimate access, whether maliciously or accidentally. Insiders often bypass perimeter controls, making behavior monitoring and least privilege essential.

Manipulating people into revealing information or taking unsafe actions, often through phishing, pretexting, or impersonation. It targets human judgment rather than technical flaws and is a leading initial access route.

A deceptive message, often email, that impersonates a trusted party to trick recipients into clicking links, opening attachments, or disclosing credentials. Variants include spear phishing and business email compromise.

A fraud scheme in which attackers impersonate executives, vendors, or colleagues to induce fraudulent payments or data disclosure. It exploits trust and process gaps rather than technical vulnerabilities.

Malicious software that encrypts or locks access to data and systems, with attackers demanding payment for restoration. Modern variants also exfiltrate data to pressure victims through disclosure threats.

The unauthorized transfer of data from an organization's systems to an external location controlled by an attacker. It drives confidentiality, regulatory, and reputational losses beyond the initial intrusion.

Compromise introduced through a vendor, software component, or service provider that an organization trusts. Because the entry point is legitimate, these attacks can spread widely and evade conventional defenses.

Exposure created by relying on vendors, outsourcers, or partners whose security failures could disrupt the organization or its customers. It requires due diligence, contractual controls, and ongoing monitoring.

The danger that many critical functions depend on a small number of providers, technologies, or geographies, so a single failure causes disproportionate disruption. Common in cloud and infrastructure dependencies.

The amount and type of cyber risk an organization is willing to accept in pursuit of its objectives, expressed in qualitative or quantitative terms. It guides tolerance thresholds, investment, and escalation decisions.

The acceptable variation around a risk appetite for a specific risk category or metric, often stated as thresholds or limits. Breaching tolerance typically triggers remediation or escalation.

A structured process that identifies cyber risks, analyzes their likelihood and impact, and evaluates them against criteria to support decisions. It produces a prioritized view of exposures and treatment options.

The part of assessment that examines causes, likelihood, and consequences to estimate the level of a risk. It may be qualitative, semi-quantitative, or quantitative and underpins the evaluation step.

The level of risk that exists before any controls or mitigations are applied. It establishes a baseline against which the value of controls and the remaining exposure can be judged.

The risk that remains after controls and treatments have been implemented. It is compared with risk tolerance to decide whether further action, transfer, or acceptance is appropriate.

An approach that rates risk using descriptive scales such as low, medium, or high rather than monetary values. It is fast and useful for screening but less precise for aggregation and capital decisions.

An approach that expresses risk in numeric terms, often annualized loss expectancy derived from event frequency and loss magnitude. It supports cost-benefit analysis and comparison with financial risk.

The estimated monetary loss from a single occurrence of a risk event, calculated as asset value multiplied by exposure factor. It is a building block for annualized loss expectancy.

The expected yearly loss from a risk, computed as single loss expectancy multiplied by the annualized rate of occurrence. It enables comparison of risks and justification of control spending.

The percentage of an asset's value that would be lost if a specific risk event occurred. It expresses the proportion of damage relative to the asset and feeds into loss calculations.

The estimated frequency with which a risk event is expected to happen in a year, often derived from historical data or expert judgment. It converts event likelihood into a usable planning figure.

A visual grid plotting risks by likelihood and impact so that exposures can be compared and prioritized. It communicates assessment results to decision-makers but depends on the quality of underlying ratings.

The probability or frequency that a threat will exploit a vulnerability and produce a loss event within a defined period. It is one of the two primary dimensions of risk scoring.

The adverse effect of a cyber event on an organization's operations, finances, reputation, legal standing, or safety. Impact analysis translates technical incidents into consequences leaders can weigh.

A study identifying critical business functions and the consequences of their disruption over time. It establishes recovery priorities and recovery time objectives that shape cyber resilience requirements.

Loss caused by the unavailability or degradation of systems and operations, including lost revenue and extra costs. It is often the largest component of cyber loss and is central to insurance and continuity planning.

The maximum acceptable time to restore a function or system after disruption. It drives continuity and backup design and is a key output of business impact analysis.

The selection and application of options to address assessed risk: mitigate, transfer, avoid, or accept. Each option carries trade-offs in cost, residual exposure, and business flexibility.

Shifting the financial consequences of a risk to another party, most commonly through insurance or contractual arrangements. It reduces financial volatility but does not eliminate the underlying exposure or accountability.

A policy covering specified losses from cyber events, such as breach response costs, business interruption, or liability. Coverage terms, exclusions, and limits vary widely and require careful review.

A safeguard or countermeasure that modifies risk by reducing likelihood, impact, or both. Controls may be preventive, detective, corrective, or compensating and are selected based on cost and effectiveness.

The degree to which a control achieves its intended risk-reduction objective in practice, not merely on paper. Weak or poorly operated controls leave residual risk higher than assumed.

Layering multiple independent controls so that failure of one does not expose the organization completely. It assumes any single control can be bypassed and designs redundancy across people, process, and technology.

Granting users and systems only the access necessary to perform their functions, for only as long as needed. It limits the blast radius of credential compromise and insider misuse.

Access rights that allow administrative control over systems, data, or security settings. Because compromise of such accounts can be catastrophic, it requires stronger authentication, monitoring, and review.

Authentication requiring two or more independent credential types, such as a password plus a device or biometric. It substantially reduces risk from stolen passwords and is a core control against account takeover.

Dividing networks, systems, or data into zones with controlled communication between them. It limits lateral movement after compromise and contains the scope of an incident.

The disciplined process of identifying, testing, deploying, and verifying software updates that fix vulnerabilities. Delays or gaps are a common and preventable cause of exploited weaknesses.

A continuous cycle of discovering, prioritizing, remediating, and verifying weaknesses across assets. Prioritization weighs exploitability, asset criticality, and threat context rather than raw counts alone.

A documented set of roles, procedures, and communications for detecting, containing, eradicating, and recovering from cyber incidents. Regular testing and lessons learned keep it effective under pressure.

The organized actions taken to manage a security event from detection through recovery and post-incident review. Effective response reduces impact duration and informs future risk assessments.

Documented arrangements for maintaining or restoring critical operations during disruption, including alternate sites, staffing, and dependencies. It complements technical recovery with business-level coordination.

An incident in which protected or confidential information is accessed, disclosed, altered, or destroyed without authorization. It triggers legal notification duties, regulatory scrutiny, and reputational harm.

A measurable metric that signals changes in an organization's risk profile before losses occur. Good indicators are tied to risk drivers, tracked over time, and assigned thresholds for escalation.

The pre-contract and ongoing evaluation of a third party's security posture, financial stability, and control maturity. Findings inform contractual requirements, monitoring intensity, and risk acceptance decisions.

Education that helps staff recognize and respond to threats such as phishing and unsafe practices. It reduces human-initiated incidents but must be reinforced by technical controls and realistic testing.

Financial crime conducted through digital channels, including payment diversion, account takeover, and identity deception. It often exploits process weaknesses and social trust more than technical flaws.