ISC2 CGRC: key terms

Flashcards for this exam ISC2 CGRC guide Class dates

• Assessment MethodsThe three NIST assessment methods: examine (review artifacts), interview (discuss with people), and test (exercise mechanisms).Intermediate
• Authorization BoundaryAll components of a system authorized for operation by an authorizing official, excluding separately authorized connected systems.Advanced
• Authorization PackageSet of documents presented to the authorizing official for an authorization decision.Intermediate
• Authorization to Operate (ATO)Official management decision by an authorizing official to accept the risk of operating a federal information system.Intermediate
• Authorizing Official (AO)Senior official with authority to formally assume responsibility and accept risk for operating a system.Intermediate
• Common ControlSecurity or privacy control inherited by multiple systems and provided by an organizational entity.Intermediate
• Continuous MonitoringMaintaining ongoing awareness of security, vulnerabilities, and threats to support risk decisions.Intermediate
• Control BaselinePredefined set of controls serving as a starting point for protecting a system at a given impact level.Intermediate
• Control EnhancementAddition to a base control that adds functionality or strengthens assurance, such as AC-2(1).Advanced
• Control FamilyGrouping of related controls in a catalog such as NIST SP 800-53, identified by a two-letter code.Intermediate
• Control InheritanceSituation where a system receives protection from controls implemented by another entity or system.Intermediate
• Control MappingLinking controls to multiple framework or regulatory requirements to enable test-once, comply-many approaches.Intermediate
• Control OwnerPerson accountable for designing, operating, and maintaining a specific control.Intermediate
• Control TailoringModifying a control baseline to align with the organization's mission, environment, and risk.Intermediate
• Control TestingEvaluating whether controls are designed and operating effectively through inquiry, inspection, observation, and reperformance.Intermediate
• Controlled Unclassified Information (CUI)Government-created or -owned information requiring safeguarding or dissemination controls under law, regulation, or policy, but not classified.Intermediate
• CSF CoreTaxonomy of cybersecurity outcomes in the NIST CSF, organized as functions, categories, and subcategories.Intermediate
• CSF Detect FunctionCSF function for finding and analyzing possible cybersecurity attacks and compromises.Foundational
• CSF Govern Function (GV)CSF 2.0 function covering cybersecurity risk management strategy, expectations, policy, roles, oversight, and supply chain risk.Intermediate
• CSF Identify FunctionCSF function for understanding current cybersecurity risks to assets, suppliers, and the organization.Foundational
• CSF Implementation TiersFour levels describing the rigor of an organization's cybersecurity risk governance and management: Partial, Risk Informed, Repeatable, Adaptive.Intermediate
• CSF Organizational ProfileDescription of an organization's current or target cybersecurity posture in terms of CSF Core outcomes.Intermediate
• CSF Protect FunctionCSF function covering safeguards to manage cybersecurity risk, such as identity management, training, and data security.Foundational
• CSF Recover Function (RC)CSF function for restoring assets and operations affected by a cybersecurity incident.Foundational
• CSF Respond Function (RS)CSF function for taking action regarding a detected cybersecurity incident.Foundational
• Cybersecurity Maturity Model Certification (CMMC)DoD program verifying that defense contractors protect FCI and CUI, with three levels of assessment requirements.Foundational
• Cybersecurity Supply Chain Risk Management (C-SCRM)Practices to identify, assess, and mitigate cybersecurity risks throughout the supply chain of products and services.Intermediate
• Denial of Authorization to Operate (DATO)AO decision that the risk of operating a system is unacceptable, so it must not operate or must cease operating.Advanced
• DoD Cloud Computing Security Requirements Guide (CC SRG)DoD guide defining security requirements and impact levels (IL2, IL4, IL5, IL6) for cloud services.Advanced
• DoD Directive 8140.01DoD policy establishing management of the cyberspace workforce across IT, cybersecurity, cyber effects, intelligence, and enabler roles.Intermediate
• Federal Information Security Modernization Act (FISMA)US law requiring federal agencies to develop, document, and implement agency-wide information security programs.Foundational
• FedRAMPFederal Risk and Authorization Management Program, the US government-wide approach to security assessment and authorization of cloud services.Intermediate
• FedRAMP 20xFedRAMP modernization initiative announced in 2025 to automate and accelerate cloud authorizations using key security indicators.Advanced
• FedRAMP Impact LevelsFedRAMP security baselines (LI-SaaS, Low, Moderate, High) aligned to FIPS 199 impact categorization.Advanced
• FIPS 199Federal standard for categorizing information and systems by potential impact (low, moderate, high) on confidentiality, integrity, and availability.Intermediate
• FIPS 200Federal standard specifying minimum security requirements for federal information and systems.Advanced
• Governance, Risk, and Compliance (GRC)Integrated approach to aligning IT and security with business objectives, managing risk, and meeting legal and regulatory requirements.Foundational
• GovRAMPNonprofit program (formerly StateRAMP) providing cloud security verification for US state and local governments.Advanced
• High-Water MarkPrinciple that a system's overall impact level equals the highest impact level of any security objective or information type it handles.Intermediate
• Hybrid ControlControl implemented partly as a common control and partly by the individual system.Intermediate
• Information Security GovernanceThe leadership, structures, and processes that ensure security strategy supports business objectives and manages risk to an acceptable level.Foundational
• Information System Security Officer (ISSO)Individual responsible for maintaining the day-to-day operational security posture of an information system.Intermediate
• Interim Authorization to Test (IATT)Limited authorization to test a system in an operational environment with live data for a specified time.Advanced
• NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)Voluntary NIST framework (Feb 2024) organizing cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.Foundational
• NIST SP 800-137NIST guidance on Information Security Continuous Monitoring (ISCM) for federal systems and organizations.Advanced
• NIST SP 800-171NIST requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.Intermediate
• NIST SP 800-30NIST guide for conducting information security risk assessments for federal systems and organizations.Intermediate
• NIST SP 800-37NIST publication defining the Risk Management Framework for information systems and organizations.Intermediate
• NIST SP 800-39NIST guidance on managing information security risk at organization, mission, and system tiers.Advanced
• NIST SP 800-53NIST catalog of security and privacy controls for information systems and organizations.Intermediate
• NIST SP 800-53ANIST guide for assessing security and privacy controls, defining assessment procedures and methods.Advanced
• NIST SP 800-53BNIST publication defining control baselines for low, moderate, and high impact systems and a privacy baseline.Advanced
• NIST SP 800-60NIST guide mapping types of information and systems to security categories.Advanced
• Ongoing AuthorizationTime-driven or event-driven authorization approach that replaces fixed-term reauthorization using continuous monitoring data.Advanced
• Organization-Defined Parameter (ODP)Variable portion of a control that the organization sets, such as a frequency or time period.Advanced
• OverlayFully specified set of tailored controls and parameters for a community or technology, applied on top of a baseline.Advanced
• Plan of Action and Milestones (POA&M)Document tracking weaknesses, planned remediation actions, resources, and target completion dates.Intermediate
• Privacy Impact Assessment (PIA)Analysis of how personal information is handled to ensure compliance and identify and mitigate privacy risks.Intermediate
• Risk AcceptanceFormal decision by an authorized risk owner to tolerate a risk without further treatment.Foundational
• Risk AssessmentOverall process of risk identification, risk analysis, and risk evaluation.Foundational
• Risk ExceptionFormally approved, time-limited deviation from a policy or standard with documented risk acceptance.Intermediate
• Risk Executive FunctionOrganizational role or group in NIST guidance that provides a holistic, enterprise view of risk.Advanced
• Risk FramingEstablishing the context, assumptions, constraints, tolerances, and priorities for risk decisions.Advanced
• Risk Management Framework (RMF)NIST SP 800-37 process for managing security and privacy risk of federal information systems in seven steps.Intermediate
• RMF Assess StepRMF step where an assessor determines whether controls are implemented correctly, operating as intended, and producing desired outcomes.Intermediate
• RMF Authorize StepRMF step in which a senior official decides whether the residual risk of operating a system is acceptable.Intermediate
• RMF Categorize StepRMF step that determines a system's security category based on impact of loss of confidentiality, integrity, and availability.Intermediate
• RMF Implement StepRMF step in which selected controls are put in place and implementation details documented.Intermediate
• RMF Monitor StepRMF step maintaining ongoing awareness of system security and privacy posture to support risk decisions.Intermediate
• RMF Prepare StepRMF step establishing context and priorities at organization and system levels before categorization.Intermediate
• RMF Select StepRMF step in which controls are chosen, tailored, and documented in security and privacy plans.Intermediate
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• Security Assessment Report (SAR)Document presenting results of a control assessment, including findings and recommendations.Intermediate
• Security CategorizationProcess of determining the impact level of a system or information based on potential harm from loss of CIA.Intermediate
• Security PolicyHigh-level management statement of intent, direction, and requirements for protecting information assets.Foundational
• Security Technical Implementation Guide (STIG)DISA configuration standards for securing DoD information systems and software.Intermediate
• Senior Agency Information Security Officer (SAISO)Federal official responsible for carrying out the CIO's FISMA security responsibilities, often the agency CISO.Advanced
• System OwnerOfficial responsible for procurement, development, integration, operation, and maintenance of a system.Intermediate
• System Security Plan (SSP)Formal document describing a system's boundary, environment, security requirements, and how controls are implemented.Intermediate
• System-Specific ControlControl implemented and managed solely by an individual information system.Intermediate
• Third-Party Assessment Organization (3PAO)Independent organization accredited by A2LA to perform FedRAMP security assessments.Intermediate