ISACA CRISC: key terms

Flashcards for this exam ISACA CRISC guide Class dates

• Annualized Loss Expectancy (ALE)Expected yearly monetary loss from a risk: ALE = SLE x ARO.Foundational
• Annualized Rate of Occurrence (ARO)Estimated number of times a specific threat event is expected to occur in one year.Foundational
• Asset ValuationDetermining the worth of an asset, including replacement cost, revenue impact, and intangible value, to support risk analysis.Intermediate
• Audit RiskRisk that the auditor reaches an incorrect conclusion, such as issuing an unqualified opinion when material errors exist.Intermediate
• Business Impact Analysis (BIA)An analysis that identifies critical business functions and the impact of their disruption over time.Foundational
• CIS Critical Security Controls (CIS Controls)Prioritized set of 18 cybersecurity safeguard groups from the Center for Internet Security.Foundational
• COBITISACA framework for governance and management of enterprise information and technology.Intermediate
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• ComplianceConforming to laws, regulations, contracts, standards, and internal policies.Foundational
• Concentration RiskRisk from heavy dependence on a single vendor, provider, region, or technology whose failure would have outsized impact.Advanced
• Continuous Control Monitoring (CCM)Automated, ongoing testing of controls using system data to identify failures quickly.Intermediate
• Control Design EffectivenessWhether a control, if operated as described, would prevent or detect the risk it addresses.Intermediate
• Control EnvironmentThe set of standards, processes, and structures, including tone at the top, that provide the basis for internal control.Intermediate
• Control MappingLinking controls to multiple framework or regulatory requirements to enable test-once, comply-many approaches.Intermediate
• Control ObjectiveStatement of the desired result or purpose to be achieved by implementing controls.Foundational
• Control OwnerPerson accountable for designing, operating, and maintaining a specific control.Intermediate
• Control RiskRisk that a material error will not be prevented or detected in a timely manner by internal controls.Intermediate
• Control Self-Assessment (CSA)Process in which management and staff evaluate the effectiveness of their own controls.Intermediate
• Control TestingEvaluating whether controls are designed and operating effectively through inquiry, inspection, observation, and reperformance.Intermediate
• COSO ERM FrameworkCOSO's enterprise risk management framework integrating risk with strategy and performance.Advanced
• COSO Internal Control Integrated FrameworkWidely used framework for designing and evaluating internal controls, with five components and 17 principles.Intermediate
• CSF Govern Function (GV)CSF 2.0 function covering cybersecurity risk management strategy, expectations, policy, roles, oversight, and supply chain risk.Intermediate
• CSF Organizational ProfileDescription of an organization's current or target cybersecurity posture in terms of CSF Core outcomes.Intermediate
• Cybersecurity Supply Chain Risk Management (C-SCRM)Practices to identify, assess, and mitigate cybersecurity risks throughout the supply chain of products and services.Intermediate
• Delphi TechniqueStructured, anonymous, iterative method for reaching expert consensus, often used in qualitative risk analysis.Intermediate
• Detective ControlControl that identifies and records an undesired event after or while it occurs.Foundational
• Digital Operational Resilience Act (DORA)EU Regulation (2022/2554), applicable from 17 January 2025, on ICT risk management for financial entities.Advanced
• Enterprise Risk Management (ERM)Organization-wide approach to identifying, assessing, and managing all risks to achieve objectives.Intermediate
• Exposure Factor (EF)Percentage of an asset's value expected to be lost if a specific threat event occurs.Foundational
• Factor Analysis of Information Risk (FAIR)Open quantitative model that decomposes risk into loss event frequency and loss magnitude for financial analysis.Advanced
• Fourth-Party RiskRisk arising from a vendor's own vendors and subcontractors that support services provided to you.Intermediate
• Fraud RiskRisk of intentional deception for gain, including asset misappropriation, corruption, and financial statement fraud.Intermediate
• Governance, Risk, and Compliance (GRC)Integrated approach to aligning IT and security with business objectives, managing risk, and meeting legal and regulatory requirements.Foundational
• ImpactThe magnitude of harm or consequence if a risk event occurs.Foundational
• Inherent RiskLevel of risk before any controls or treatments are applied.Intermediate
• Integrated Risk Management (IRM)Set of practices and technology that integrate risk management across business, IT, and compliance functions.Intermediate
• Internal AuditIndependent, objective assurance and consulting activity within an organization that evaluates governance, risk management, and control.Foundational
• Internal ControlProcess designed to provide reasonable assurance about achieving objectives in operations, reporting, and compliance.Foundational
• ISO 31000International standard providing principles, a framework, and a process for managing any type of risk.Intermediate
• ISO/IEC 27005ISO standard giving guidance on information security risk management in support of ISO/IEC 27001.Intermediate
• Key Control Indicator (KCI)Metric that measures how well a specific control is operating.Intermediate
• Key Goal Indicator (KGI)Metric that shows whether a business or IT goal has been achieved.Intermediate
• Key Performance Indicator (KPI)Metric that measures how well a process or activity is performing against targets.Foundational
• Key Risk Indicator (KRI)Metric that provides early warning of increasing risk exposure.Intermediate
• LikelihoodThe chance or probability that a risk event will occur within a time frame.Foundational
• Monte Carlo SimulationStatistical technique that runs many randomized iterations over input ranges to produce a probability distribution of outcomes.Advanced
• NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)Voluntary NIST framework (Feb 2024) organizing cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.Foundational
• NIST SP 800-30NIST guide for conducting information security risk assessments for federal systems and organizations.Intermediate
• NIST SP 800-39NIST guidance on managing information security risk at organization, mission, and system tiers.Advanced
• OCTAVEOperationally Critical Threat, Asset, and Vulnerability Evaluation, a self-directed risk assessment methodology from Carnegie Mellon SEI.Advanced
• Operating EffectivenessWhether a control operated consistently as designed throughout a specified period.Intermediate
• Preventive ControlControl designed to stop an undesired event from occurring.Foundational
• Qualitative Risk AnalysisRisk analysis that ranks risks using descriptive scales such as low, medium, and high rather than monetary values.Intermediate
• Quantitative Risk AnalysisRisk analysis that assigns numeric, usually monetary, values to assets, impacts, and probabilities.Intermediate
• Residual RiskRisk that remains after controls and treatments have been applied.Foundational
• RiskThe combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.Foundational
• Risk AcceptanceFormal decision by an authorized risk owner to tolerate a risk without further treatment.Foundational
• Risk AnalysisProcess of comprehending the nature of risk and determining its level by considering likelihood and impact.Foundational
• Risk AppetiteBroad amount and type of risk an organization is willing to pursue or retain to achieve its objectives.Foundational
• Risk AssessmentOverall process of risk identification, risk analysis, and risk evaluation.Foundational
• Risk AvoidanceEliminating a risk by not starting or by discontinuing the activity that creates it.Foundational
• Risk CapacityMaximum amount of risk an organization can absorb before its viability or objectives are seriously threatened.Intermediate
• Risk EvaluationComparing analyzed risk levels against risk criteria to decide which risks need treatment and in what priority.Intermediate
• Risk ExceptionFormally approved, time-limited deviation from a policy or standard with documented risk acceptance.Intermediate
• Risk Heat MapVisual matrix plotting risks by likelihood and impact, using color to show severity.Foundational
• Risk IdentificationProcess of finding, recognizing, and describing risks that could affect objectives.Foundational
• Risk IT FrameworkISACA framework addressing IT-related business risk, organized into risk governance, risk evaluation, and risk response domains.Advanced
• Risk MitigationRisk treatment that reduces likelihood or impact by implementing controls.Foundational
• Risk OwnerPerson or entity with the accountability and authority to manage a risk, including accepting it.Foundational
• Risk ProfileSnapshot description of the overall set of risks an organization or unit faces at a point in time.Intermediate
• Risk RegisterCentral record of identified risks with their analysis, owners, treatment, and status.Foundational
• Risk RejectionIgnoring or denying the existence of a risk; an unacceptable response distinct from acceptance.Intermediate
• Risk ScenarioDescription of a plausible event in which a threat exploits a vulnerability to cause a specific business impact.Intermediate
• Risk ThresholdSpecific measurable level of risk or uncertainty at which a response, escalation, or decision is triggered.Intermediate
• Risk ToleranceAcceptable variation around objectives or risk appetite for a specific risk or category.Foundational
• Risk TransferenceShifting the financial impact of a risk to a third party, such as through insurance or contracts.Foundational
• Risk TreatmentSelecting and implementing options to modify risk: mitigate, transfer, avoid, or accept.Foundational
• Risk Treatment PlanDocument describing how identified risks will be treated, by whom, with what resources, and by when.Intermediate
• Sarbanes-Oxley Act (SOX)2002 US law requiring public companies to maintain and attest to internal control over financial reporting.Foundational
• Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
• Security MetricsQuantifiable measurements used to track security program performance, risk, and control effectiveness.Intermediate
• Segregation of Duties (SoD)Dividing critical tasks among different people so no single person can both commit and conceal errors or fraud.Foundational
• Semi-Quantitative Risk AnalysisHybrid approach that assigns numeric scores to qualitative scales to rank and combine risks.Intermediate
• Single Loss Expectancy (SLE)Expected monetary loss from one occurrence of a threat event: SLE = Asset Value x Exposure Factor.Foundational
• SOX Section 404SOX provision requiring annual management assessment of ICFR and, for accelerated filers, external auditor attestation.Intermediate
• Third-Party Risk Management (TPRM)Discipline of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, and other external parties.Foundational
• ThreatAny potential cause of an unwanted incident that may harm an asset, such as an actor, event, or circumstance.Foundational
• Three Lines ModelIIA model describing governance roles: management (first and second lines), internal audit (third line), and the governing body.Intermediate
• Vendor Due DiligencePre-contract evaluation of a vendor's security, privacy, financial, operational, and compliance posture.Intermediate
• VulnerabilityA weakness in an asset, control, or process that a threat could exploit.Foundational