ISACA CISM: key terms
108 terms you need to know for ISACA CISM (CISM). Filter by level, then drill them with flashcards.
Flashcards for this exam ISACA CISM guide Class dates
108 terms
- AI GovernanceThe policies, roles, processes and controls that direct and oversee how an organization develops and uses AI.Foundational
- Annualized Loss Expectancy (ALE)Expected yearly monetary loss from a risk: ALE = SLE x ARO.Foundational
- Annualized Rate of Occurrence (ARO)Estimated number of times a specific threat event is expected to occur in one year.Foundational
- Asset ValuationDetermining the worth of an asset, including replacement cost, revenue impact, and intangible value, to support risk analysis.Intermediate
- Audit CommitteeBoard committee of independent directors overseeing financial reporting, internal control, and audit functions.Foundational
- Balanced Scorecard (BSC)Performance management tool measuring strategy across financial, customer, internal process, and learning and growth perspectives.Intermediate
- Business CaseDocumented justification for an investment, describing benefits, costs, risks, and alignment with objectives.Intermediate
- Business Continuity Planning (BCP)Planning to keep essential business functions operating during and after a disruption.Foundational
- Business Impact Analysis (BIA)An analysis that identifies critical business functions and the impact of their disruption over time.Foundational
- Chief Information Security Officer (CISO)Senior executive responsible for the organization's information security strategy, program, and risk communication.Foundational
- COBITISACA framework for governance and management of enterprise information and technology.Intermediate
- Cold SiteAn alternate facility with basic infrastructure such as power and space but no ready equipment or data.Foundational
- Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
- ComplianceConforming to laws, regulations, contracts, standards, and internal policies.Foundational
- Concentration RiskRisk from heavy dependence on a single vendor, provider, region, or technology whose failure would have outsized impact.Advanced
- Corporate GovernanceThe system of rules, practices, and processes by which a board directs and controls an organization on behalf of stakeholders.Foundational
- COSO Internal Control Integrated FrameworkWidely used framework for designing and evaluating internal controls, with five components and 17 principles.Intermediate
- CSF CoreTaxonomy of cybersecurity outcomes in the NIST CSF, organized as functions, categories, and subcategories.Intermediate
- CSF Govern Function (GV)CSF 2.0 function covering cybersecurity risk management strategy, expectations, policy, roles, oversight, and supply chain risk.Intermediate
- CSF Identify FunctionCSF function for understanding current cybersecurity risks to assets, suppliers, and the organization.Foundational
- CSF Implementation TiersFour levels describing the rigor of an organization's cybersecurity risk governance and management: Partial, Risk Informed, Repeatable, Adaptive.Intermediate
- CSF Organizational ProfileDescription of an organization's current or target cybersecurity posture in terms of CSF Core outcomes.Intermediate
- Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)2022 US law directing CISA to require critical infrastructure entities to report covered cyber incidents and ransom payments.Advanced
- Data Breach NotificationLegal or contractual obligations to inform regulators, affected individuals or partners after a qualifying data breach.Intermediate
- Data ClassificationCategorizing data by sensitivity and value to determine required protection and handling.Foundational
- Data OwnerSenior individual accountable for a data set, including its classification, access approval, and protection requirements.Foundational
- Digital Operational Resilience Act (DORA)EU Regulation (2022/2554), applicable from 17 January 2025, on ICT risk management for financial entities.Advanced
- Disaster Recovery Plan (DRP)A documented plan for restoring IT systems, data and infrastructure after a disruptive event.Foundational
- Due CareActing as a reasonable person would to protect assets, by implementing and maintaining appropriate safeguards.Foundational
- Due DiligenceInvestigation and analysis performed to understand risks before and while making decisions.Foundational
- Enterprise Risk Management (ERM)Organization-wide approach to identifying, assessing, and managing all risks to achieve objectives.Intermediate
- Exposure Factor (EF)Percentage of an asset's value expected to be lost if a specific threat event occurs.Foundational
- Factor Analysis of Information Risk (FAIR)Open quantitative model that decomposes risk into loss event frequency and loss magnitude for financial analysis.Advanced
- FTC Safeguards RuleFTC rule under GLBA requiring non-bank financial institutions to maintain a written information security program with specific controls.Advanced
- Full Interruption TestA disaster recovery test that shuts down the primary site and moves operations completely to the recovery site.Intermediate
- Gap AnalysisComparison of current state with a desired state or requirement to identify deficiencies and actions.Foundational
- Governance, Risk, and Compliance (GRC)Integrated approach to aligning IT and security with business objectives, managing risk, and meeting legal and regulatory requirements.Foundational
- Gramm-Leach-Bliley Act (GLBA)1999 US law requiring financial institutions to protect customers' nonpublic personal information and disclose privacy practices.Intermediate
- Hot SiteA fully equipped alternate facility with current systems and data that can take over operations almost immediately.Foundational
- Incident Response Plan (IRP)A documented set of policies, roles and procedures guiding how an organization responds to security incidents.Foundational
- Information Security GovernanceThe leadership, structures, and processes that ensure security strategy supports business objectives and manages risk to an acceptable level.Foundational
- Information Security Management System (ISMS)Systematic, risk-based management system for protecting information through policies, processes, and controls.Foundational
- Inherent RiskLevel of risk before any controls or treatments are applied.Intermediate
- Insider ThreatA risk posed by a current or former employee, contractor or partner who misuses authorized access, maliciously or by accident.Foundational
- ISO 22301International standard specifying requirements for a business continuity management system (BCMS).Intermediate
- ISO 31000International standard providing principles, a framework, and a process for managing any type of risk.Intermediate
- ISO/IEC 27001International standard specifying requirements for establishing, implementing, maintaining, and improving an information security management system.Foundational
- Key ManagementPractices and systems for securely generating, distributing, storing, rotating, and destroying cryptographic keys.Foundational
- Key Performance Indicator (KPI)Metric that measures how well a process or activity is performing against targets.Foundational
- Key Risk Indicator (KRI)Metric that provides early warning of increasing risk exposure.Intermediate
- Maturity ModelStructured scale for measuring the capability and consistency of processes from ad hoc to optimized.Intermediate
- Maximum Tolerable Downtime (MTD)The longest period a business function can be unavailable before causing unacceptable or irrecoverable harm.Intermediate
- NIS2 DirectiveEU Directive (2022/2555) imposing cybersecurity risk-management and incident-reporting obligations on essential and important entities.Intermediate
- NIST AI Risk Management Framework (AI RMF)A voluntary U.S. NIST framework for managing AI risks, organized into Govern, Map, Measure and Manage functions.Intermediate
- NIST Cybersecurity Framework (CSF)A NIST framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover.Foundational
- NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)Voluntary NIST framework (Feb 2024) organizing cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.Foundational
- NIST SP 800-30NIST guide for conducting information security risk assessments for federal systems and organizations.Intermediate
- NYDFS Cybersecurity RegulationNew York Department of Financial Services rule (23 NYCRR Part 500) requiring covered financial entities to maintain cybersecurity programs.Advanced
- Parallel TestA disaster recovery test in which recovery systems are brought up at the alternate site and run alongside production without interrupting it.Intermediate
- Payment Card Industry Data Security Standard (PCI DSS)Industry standard with 12 requirements for protecting payment account data, maintained by the PCI Security Standards Council.Foundational
- Phishing SimulationAn authorized fake phishing campaign used to measure and improve user resistance to email-based attacks.Foundational
- Qualitative Risk AnalysisRisk analysis that ranks risks using descriptive scales such as low, medium, and high rather than monetary values.Intermediate
- Quantitative Risk AnalysisRisk analysis that assigns numeric, usually monetary, values to assets, impacts, and probabilities.Intermediate
- Recovery Point Objective (RPO)Maximum acceptable amount of data loss measured in time before a disruption.Foundational
- Recovery Time Objective (RTO)Maximum acceptable time to restore a service after a disruption.Foundational
- Residual RiskRisk that remains after controls and treatments have been applied.Foundational
- RiskThe combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.Foundational
- Risk AcceptanceFormal decision by an authorized risk owner to tolerate a risk without further treatment.Foundational
- Risk AppetiteBroad amount and type of risk an organization is willing to pursue or retain to achieve its objectives.Foundational
- Risk AssessmentOverall process of risk identification, risk analysis, and risk evaluation.Foundational
- Risk AvoidanceEliminating a risk by not starting or by discontinuing the activity that creates it.Foundational
- Risk CapacityMaximum amount of risk an organization can absorb before its viability or objectives are seriously threatened.Intermediate
- Risk EvaluationComparing analyzed risk levels against risk criteria to decide which risks need treatment and in what priority.Intermediate
- Risk ExceptionFormally approved, time-limited deviation from a policy or standard with documented risk acceptance.Intermediate
- Risk Heat MapVisual matrix plotting risks by likelihood and impact, using color to show severity.Foundational
- Risk Management Framework (RMF)NIST SP 800-37 process for managing security and privacy risk of federal information systems in seven steps.Intermediate
- Risk MitigationRisk treatment that reduces likelihood or impact by implementing controls.Foundational
- Risk OwnerPerson or entity with the accountability and authority to manage a risk, including accepting it.Foundational
- Risk ProfileSnapshot description of the overall set of risks an organization or unit faces at a point in time.Intermediate
- Risk RegisterCentral record of identified risks with their analysis, owners, treatment, and status.Foundational
- Risk ScenarioDescription of a plausible event in which a threat exploits a vulnerability to cause a specific business impact.Intermediate
- Risk ThresholdSpecific measurable level of risk or uncertainty at which a response, escalation, or decision is triggered.Intermediate
- Risk ToleranceAcceptable variation around objectives or risk appetite for a specific risk or category.Foundational
- Risk TransferenceShifting the financial impact of a risk to a third party, such as through insurance or contracts.Foundational
- Risk TreatmentSelecting and implementing options to modify risk: mitigate, transfer, avoid, or accept.Foundational
- SABSASherwood Applied Business Security Architecture, a risk-driven enterprise security architecture framework.Advanced
- Sarbanes-Oxley Act (SOX)2002 US law requiring public companies to maintain and attest to internal control over financial reporting.Foundational
- SEC Cybersecurity Disclosure Rules2023 SEC rules requiring public companies to disclose material cybersecurity incidents and describe cyber risk management and governance.Intermediate
- Security Awareness Training (SAT)Education that teaches staff to recognize and report security threats such as phishing and social engineering.Foundational
- Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
- Security MetricsQuantifiable measurements used to track security program performance, risk, and control effectiveness.Intermediate
- Security PolicyHigh-level management statement of intent, direction, and requirements for protecting information assets.Foundational
- Security StandardMandatory requirement specifying uniform use of technologies, configurations, or methods to support policy.Foundational
- Security Steering CommitteeCross-functional management group that prioritizes security initiatives, resolves conflicts, and aligns security with business needs.Intermediate
- Separation of Duties (SoD)Dividing a critical task among multiple people so no single individual can complete it alone.Foundational
- Sherwood Applied Business Security Architecture (SABSA)Business-driven enterprise security architecture framework built on six layers of views.Advanced
- Single Loss Expectancy (SLE)Expected monetary loss from one occurrence of a threat event: SLE = Asset Value x Exposure Factor.Foundational
- Strategic AlignmentEnsuring the information security strategy directly supports and enables business goals and objectives.Foundational
- Strategic Threat IntelligenceHigh-level intelligence about threat trends, motivations and risks for executives and decision-makers.Intermediate
- Tabletop Exercise (TTX)A discussion-based exercise in which participants walk through a simulated incident scenario to test plans and roles.Foundational
- Third-Party Risk Management (TPRM)Discipline of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, and other external parties.Foundational
- Three Lines ModelIIA model describing governance roles: management (first and second lines), internal audit (third line), and the governing body.Intermediate
- Value DeliveryGovernance outcome ensuring IT and security investments deliver the expected business benefits at optimal cost.Intermediate
- Vendor Due DiligencePre-contract evaluation of a vendor's security, privacy, financial, operational, and compliance posture.Intermediate
- Vulnerability ExceptionA formally approved, documented decision to delay or not remediate a vulnerability, usually with compensating controls.Intermediate
- Vulnerability PrioritizationRanking vulnerabilities for remediation based on severity, exploitability, exposure and asset criticality.Intermediate
- Warm SiteAn alternate facility with some equipment and connectivity in place but requiring data restoration and configuration before use.Foundational
- Work Recovery Time (WRT)The time needed after systems are restored to verify data, test functionality and resume normal operations.Advanced