Governance, Risk, Audit & Privacy terms

Study this subject with thinQcards™

• 32 CFR Part 170Federal regulation establishing the CMMC program, effective 16 December 2024.Advanced
• Acceptable Use Policy (AUP)Policy defining permitted and prohibited uses of organizational systems, networks, and data by users.Foundational
• Adequacy DecisionEuropean Commission determination that a non-EU country provides essentially equivalent data protection.Intermediate
• Agreed-Upon Procedures (AUP)Engagement in which a practitioner performs specific procedures agreed with the client and reports factual findings without an opinion.Advanced
• AI Impact AssessmentAssessment of potential effects of an AI system on individuals, groups, and society across its life cycle.Intermediate
• AI Provider and DeployerEU AI Act roles: providers develop or place AI on the market under their name; deployers use AI systems under their authority.Advanced
• Annex AReference control set in ISO/IEC 27001 listing 93 information security controls in four themes.Intermediate
• Annualized Loss Expectancy (ALE)Expected yearly monetary loss from a risk: ALE = SLE x ARO.Foundational
• Annualized Rate of Occurrence (ARO)Estimated number of times a specific threat event is expected to occur in one year.Foundational
• AnonymizationIrreversibly transforming personal data so individuals can no longer be identified by any means reasonably likely to be used.Intermediate
• Application ControlsControls built into business applications to ensure complete, accurate, and valid processing of transactions.Foundational
• Approved Scanning Vendor (ASV)Organization certified by the PCI SSC to perform external vulnerability scans for PCI DSS.Intermediate
• Assessment MethodsThe three NIST assessment methods: examine (review artifacts), interview (discuss with people), and test (exercise mechanisms).Intermediate
• Asset ValuationDetermining the worth of an asset, including replacement cost, revenue impact, and intangible value, to support risk analysis.Intermediate
• AssuranceObjective examination of evidence to provide an independent assessment of governance, risk, and control.Intermediate
• Attestation of Compliance (AOC)Formal declaration of an entity's PCI DSS compliance status, accompanying a ROC or SAQ.Intermediate
• Attribute SamplingStatistical sampling method used in compliance testing to estimate the rate of occurrence of a characteristic.Intermediate
• Audit CharterFormal document defining internal audit's purpose, authority, responsibility, and accountability.Foundational
• Audit CommitteeBoard committee of independent directors overseeing financial reporting, internal control, and audit functions.Foundational
• Audit EvidenceInformation used by auditors to arrive at conclusions on which opinions are based.Foundational
• Audit FindingDocumented result of an audit describing a condition that deviates from criteria, with cause, effect, and recommendation.Foundational
• Audit Follow-UpProcess of verifying that management has implemented agreed corrective actions from audit findings.Intermediate
• Audit HooksEmbedded triggers in application software that flag suspicious transactions for auditor attention.Advanced
• Audit ObjectiveSpecific goal an audit aims to achieve, such as confirming controls meet a control objective.Foundational
• Audit OpinionAuditor's conclusion on the subject matter: unmodified, qualified, adverse, or disclaimer.Intermediate
• Audit PlanDocument setting out the audits to be performed over a period, or the approach for a specific engagement.Foundational
• Audit ProgramStep-by-step procedures auditors follow to gather evidence and achieve audit objectives.Intermediate
• Audit ReportFormal communication of audit objectives, scope, findings, conclusions, and recommendations.Foundational
• Audit RiskRisk that the auditor reaches an incorrect conclusion, such as issuing an unqualified opinion when material errors exist.Intermediate
• Audit SamplingApplying audit procedures to less than 100 percent of a population to draw conclusions about the whole.Foundational
• Audit ScopeBoundaries of an audit: the systems, locations, processes, period, and organizational units covered.Foundational
• Audit TrailChronological record of system activities that allows reconstruction of events and accountability.Foundational
• Audit UniverseComplete inventory of auditable entities, processes, systems, and risks in an organization.Intermediate
• Auditor IndependenceFreedom from conditions that threaten the auditor's ability to perform work objectively, in fact and in appearance.Foundational
• Authorization BoundaryAll components of a system authorized for operation by an authorizing official, excluding separately authorized connected systems.Advanced
• Authorization PackageSet of documents presented to the authorizing official for an authorization decision.Intermediate
• Authorization to Operate (ATO)Official management decision by an authorizing official to accept the risk of operating a federal information system.Intermediate
• Authorizing Official (AO)Senior official with authority to formally assume responsibility and accept risk for operating a system.Intermediate
• Automated Decision-Making Technology (ADMT)US privacy law term for technology that processes personal information to replace or substantially replace human decision-making.Advanced
• Automated Individual Decision-MakingGDPR Article 22 right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.Intermediate
• Balanced Scorecard (BSC)Performance management tool measuring strategy across financial, customer, internal process, and learning and growth perspectives.Intermediate
• Batch ControlsControls that group transactions and use totals to verify completeness and accuracy of processing.Intermediate
• Binding Corporate Rules (BCR)Internal data protection policies approved by EU authorities allowing intra-group international transfers.Advanced
• Breach Notification LawsLaws requiring organizations to notify individuals, regulators, or others after unauthorized access to personal information.Foundational
• Bridge LetterLetter from a service organization covering the gap between the end of its SOC report period and a later date.Advanced
• Business AssociatePerson or organization that performs functions involving PHI on behalf of a HIPAA covered entity.Intermediate
• Business Associate Agreement (BAA)Contract required by HIPAA between a covered entity and business associate defining permitted uses and safeguards for PHI.Intermediate
• Business CaseDocumented justification for an investment, describing benefits, costs, risks, and alignment with objectives.Intermediate
• California Consumer Privacy Act (CCPA)California law, effective 2020 and amended by the CPRA, granting consumers privacy rights over personal information held by businesses.Foundational
• California Privacy Protection Agency (CPPA)California state agency that implements and enforces the CCPA as amended by the CPRA.Intermediate
• California Privacy Rights Act (CPRA)2020 ballot initiative that amended and expanded the CCPA, effective January 2023.Intermediate
• Capability Maturity Model Integration (CMMI)Process improvement model defining maturity and capability levels from initial to optimizing.Intermediate
• Cardholder Data Environment (CDE)People, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus connected systems.Intermediate
• Certification AuditIndependent third-party audit by an accredited certification body to certify a management system, such as ISO/IEC 27001.Intermediate
• Certified Third-Party Assessment Organization (C3PAO)Organization authorized by the Cyber AB to conduct CMMC Level 2 certification assessments.Intermediate
• Check DigitExtra digit calculated from other digits of a number to detect transcription and transposition errors.Intermediate
• Chief Information Security Officer (CISO)Senior executive responsible for the organization's information security strategy, program, and risk communication.Foundational
• Children's Online Privacy Protection Act (COPPA)US law requiring verifiable parental consent before collecting personal information from children under 13 online.Intermediate
• CIS BenchmarksConsensus-based secure configuration guides for operating systems, cloud platforms, applications, and devices.Foundational
• CIS Critical Security Controls (CIS Controls)Prioritized set of 18 cybersecurity safeguard groups from the Center for Internet Security.Foundational
• CIS Implementation Groups (IG)Three tiers (IG1, IG2, IG3) prioritizing CIS Controls safeguards by organizational risk and resources.Intermediate
• CMMC AffirmationAnnual statement in SPRS by an Affirming Official that the contractor continues to meet its CMMC level requirements.Advanced
• CMMC Asset CategoriesScoping categories for CMMC Level 2: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets, and Out-of-Scope Assets.Advanced
• CMMC Conditional StatusTemporary CMMC status allowing award when a limited set of requirements remains on a POA&M to be closed within 180 days.Advanced
• CMMC Level 1CMMC level for contractors handling only FCI, requiring the 15 FAR 52.204-21 safeguarding requirements and an annual self-assessment.Intermediate
• CMMC Level 2CMMC level for contractors handling CUI, requiring the 110 NIST SP 800-171 Rev. 2 requirements.Intermediate
• CMMC Level 3Highest CMMC level, requiring Level 2 certification plus 24 selected NIST SP 800-172 requirements assessed by DIBCAC.Advanced
• COBITISACA framework for governance and management of enterprise information and technology.Intermediate
• COBIT Design FactorsEleven factors in COBIT 2019 that influence how an enterprise tailors its governance system.Advanced
• COBIT Management DomainsFour COBIT management domains: Align, Plan and Organize; Build, Acquire and Implement; Deliver, Service and Support; Monitor, Evaluate and Assess.Intermediate
• Colorado Artificial Intelligence ActColorado law (SB 24-205) requiring developers and deployers of high-risk AI systems to use reasonable care to avoid algorithmic discrimination.Advanced
• Common ControlSecurity or privacy control inherited by multiple systems and provided by an organizational entity.Intermediate
• Compensating ControlAlternative control used when a primary control cannot be implemented, providing equivalent risk reduction.Intermediate
• Complementary User Entity Controls (CUEC)Controls a service organization assumes its customers will implement for the overall control objectives to be met.Intermediate
• ComplianceConforming to laws, regulations, contracts, standards, and internal policies.Foundational
• Compliance TestingAudit testing to determine whether controls are being applied in compliance with policies and procedures.Foundational
• Computer-Assisted Audit Techniques (CAAT)Tools and techniques using computers to automate audit procedures such as data extraction and analysis.Intermediate
• Concentration RiskRisk from heavy dependence on a single vendor, provider, region, or technology whose failure would have outsized impact.Advanced
• Confidence CoefficientProbability that a sample result correctly represents the population, such as 95 percent.Advanced
• Consensus Assessments Initiative Questionnaire (CAIQ)CSA questionnaire of yes/no questions based on the Cloud Controls Matrix for assessing cloud providers.Intermediate
• ConsentFreely given, specific, informed, and unambiguous indication of agreement to processing of personal data.Foundational
• Consent Management Platform (CMP)Tool that collects, records, and enforces user consent and preferences for cookies, tracking, and data processing.Intermediate
• Continuous AuditingPerforming audit procedures on an automated, frequent, or real-time basis.Intermediate
• Continuous Control Monitoring (CCM)Automated, ongoing testing of controls using system data to identify failures quickly.Intermediate
• Continuous MonitoringMaintaining ongoing awareness of security, vulnerabilities, and threats to support risk decisions.Intermediate
• Control BaselinePredefined set of controls serving as a starting point for protecting a system at a given impact level.Intermediate
• Control Design EffectivenessWhether a control, if operated as described, would prevent or detect the risk it addresses.Intermediate
• Control EnhancementAddition to a base control that adds functionality or strengthens assurance, such as AC-2(1).Advanced
• Control EnvironmentThe set of standards, processes, and structures, including tone at the top, that provide the basis for internal control.Intermediate
• Control FamilyGrouping of related controls in a catalog such as NIST SP 800-53, identified by a two-letter code.Intermediate
• Control InheritanceSituation where a system receives protection from controls implemented by another entity or system.Intermediate
• Control MappingLinking controls to multiple framework or regulatory requirements to enable test-once, comply-many approaches.Intermediate
• Control ObjectiveStatement of the desired result or purpose to be achieved by implementing controls.Foundational
• Control OwnerPerson accountable for designing, operating, and maintaining a specific control.Intermediate
• Control RiskRisk that a material error will not be prevented or detected in a timely manner by internal controls.Intermediate
• Control Self-Assessment (CSA)Process in which management and staff evaluate the effectiveness of their own controls.Intermediate
• Control TailoringModifying a control baseline to align with the organization's mission, environment, and risk.Intermediate
• Control TestingEvaluating whether controls are designed and operating effectively through inquiry, inspection, observation, and reperformance.Intermediate
• Controlled Unclassified Information (CUI)Government-created or -owned information requiring safeguarding or dissemination controls under law, regulation, or policy, but not classified.Intermediate
• Corporate GovernanceThe system of rules, practices, and processes by which a board directs and controls an organization on behalf of stakeholders.Foundational
• Corrective ActionAction to eliminate the cause of a nonconformity or incident and prevent recurrence.Intermediate
• Corrective ControlControl that reduces the impact of an event or restores systems after it occurs.Foundational
• COSO ERM FrameworkCOSO's enterprise risk management framework integrating risk with strategy and performance.Advanced
• COSO Internal Control Integrated FrameworkWidely used framework for designing and evaluating internal controls, with five components and 17 principles.Intermediate
• Covered EntityHealth plan, health care clearinghouse, or health care provider that conducts standard electronic transactions, subject to HIPAA.Intermediate
• Cross-Border Data TransferTransfer of personal data to a country outside the jurisdiction whose law protects it, such as from the EU to a third country.Intermediate
• CSA STARCloud Security Alliance Security, Trust, Assurance and Risk program and public registry for cloud provider assurance.Intermediate
• CSF CoreTaxonomy of cybersecurity outcomes in the NIST CSF, organized as functions, categories, and subcategories.Intermediate
• CSF Detect FunctionCSF function for finding and analyzing possible cybersecurity attacks and compromises.Foundational
• CSF Govern Function (GV)CSF 2.0 function covering cybersecurity risk management strategy, expectations, policy, roles, oversight, and supply chain risk.Intermediate
• CSF Identify FunctionCSF function for understanding current cybersecurity risks to assets, suppliers, and the organization.Foundational
• CSF Implementation TiersFour levels describing the rigor of an organization's cybersecurity risk governance and management: Partial, Risk Informed, Repeatable, Adaptive.Intermediate
• CSF Organizational ProfileDescription of an organization's current or target cybersecurity posture in terms of CSF Core outcomes.Intermediate
• CSF Protect FunctionCSF function covering safeguards to manage cybersecurity risk, such as identity management, training, and data security.Foundational
• CSF Recover Function (RC)CSF function for restoring assets and operations affected by a cybersecurity incident.Foundational
• CSF Respond Function (RS)CSF function for taking action regarding a detected cybersecurity incident.Foundational
• CUI EnclaveSegmented environment designed to contain all CUI processing, limiting the scope of CMMC or NIST SP 800-171 compliance.Advanced
• Cyber ABThe official accreditation body for the CMMC ecosystem, formerly the CMMC Accreditation Body.Intermediate
• Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)2022 US law directing CISA to require critical infrastructure entities to report covered cyber incidents and ransom payments.Advanced
• Cyber Workforce QualificationDoD 8140 requirement that personnel in cyber work roles demonstrate foundational and residential qualification at a proficiency level.Intermediate
• Cybersecurity Maturity Model Certification (CMMC)DoD program verifying that defense contractors protect FCI and CUI, with three levels of assessment requirements.Foundational
• Cybersecurity Supply Chain Risk Management (C-SCRM)Practices to identify, assess, and mitigate cybersecurity risks throughout the supply chain of products and services.Intermediate
• Data Analytics in AuditingUse of data analysis tools to test entire populations, identify anomalies, and support risk assessment.Intermediate
• Data ClassificationCategorizing data by sensitivity and value to determine required protection and handling.Foundational
• Data ControllerEntity that determines the purposes and means of processing personal data.Foundational
• Data CustodianRole responsible for implementing and maintaining the controls that protect data on behalf of the data owner.Foundational
• Data MappingDocumenting what personal data an organization holds, where it resides, how it flows, who accesses it, and why.Foundational
• Data MinimizationPrinciple of collecting and retaining only the personal data that is adequate, relevant, and necessary for a stated purpose.Foundational
• Data OwnerSenior individual accountable for a data set, including its classification, access approval, and protection requirements.Foundational
• Data Processing Agreement (DPA)Contract between a controller and processor setting out GDPR Article 28 obligations.Intermediate
• Data ProcessorEntity that processes personal data on behalf of and under the instructions of a controller.Foundational
• Data Protection Impact Assessment (DPIA)GDPR Article 35 assessment required before processing likely to result in high risk to individuals' rights and freedoms.Intermediate
• Data Protection Officer (DPO)GDPR-mandated role that independently advises on and monitors data protection compliance.Intermediate
• Data Retention PolicyPolicy defining how long categories of data are kept and how they are disposed of when no longer needed.Foundational
• Data SubjectThe identified or identifiable natural person to whom personal data relates.Foundational
• Data Subject Access Request (DSAR)Request by an individual to access personal data an organization holds about them.Foundational
• De-identificationGeneral term for removing or obscuring identifiers to reduce the link between data and individuals.Intermediate
• Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)DCMA organization that performs DoD-led cybersecurity assessments of defense contractors, including CMMC Level 3.Advanced
• Delphi TechniqueStructured, anonymous, iterative method for reaching expert consensus, often used in qualitative risk analysis.Intermediate
• Denial of Authorization to Operate (DATO)AO decision that the risk of operating a system is unacceptable, so it must not operate or must cease operating.Advanced
• Detection RiskRisk that the auditor's procedures fail to detect a material error or misstatement.Intermediate
• Detective ControlControl that identifies and records an undesired event after or while it occurs.Foundational
• Deterrent ControlControl that discourages potential attackers or violators from attempting an action.Foundational
• DFARS 252.204-7012Defense acquisition clause requiring contractors to safeguard covered defense information and report cyber incidents.Intermediate
• Digital Operational Resilience Act (DORA)EU Regulation (2022/2554), applicable from 17 January 2025, on ICT risk management for financial entities.Advanced
• Directive ControlControl that specifies required behavior, such as policies, standards, and procedures.Foundational
• Discovery SamplingAttribute sampling used to find at least one instance of a critical error, such as fraud, if it exists above a given rate.Advanced
• DoD 8570.01-MFormer DoD manual that required certifications for information assurance workforce categories, superseded by DoD 8140.Intermediate
• DoD Cloud Computing Security Requirements Guide (CC SRG)DoD guide defining security requirements and impact levels (IL2, IL4, IL5, IL6) for cloud services.Advanced
• DoD Cyber Workforce Framework (DCWF)DoD taxonomy of cyberspace work roles with associated tasks, knowledge, and skills used for 8140 qualification.Intermediate
• DoD Directive 8140.01DoD policy establishing management of the cyberspace workforce across IT, cybersecurity, cyber effects, intelligence, and enabler roles.Intermediate
• DoD Manual 8140.03DoD manual defining the Cyberspace Workforce Qualification and Management Program.Intermediate
• Due CareActing as a reasonable person would to protect assets, by implementing and maintaining appropriate safeguards.Foundational
• Due DiligenceInvestigation and analysis performed to understand risks before and while making decisions.Foundational
• Due Professional CareApplying the care and skill expected of a reasonably prudent and competent auditor.Intermediate
• Electronic Protected Health Information (ePHI)Protected health information created, received, maintained, or transmitted in electronic form.Intermediate
• Embedded Audit Module (EAM)Audit code built into an application to capture selected transactions for auditor review.Advanced
• Engagement LetterDocument defining an audit or assurance engagement's objectives, scope, responsibilities, and terms.Intermediate
• Enterprise Governance of IT (EGIT)Governance of information and technology that ensures IT enables enterprise goals, optimizes risk and resources, and delivers value.Intermediate
• Enterprise Risk Management (ERM)Organization-wide approach to identifying, assessing, and managing all risks to achieve objectives.Intermediate
• ePrivacy DirectiveEU Directive 2002/58/EC governing confidentiality of electronic communications, cookies, and electronic marketing.Intermediate
• EU Artificial Intelligence Act (EU AI Act)EU Regulation 2024/1689 establishing risk-based rules for AI systems and general-purpose AI models.Intermediate
• EU-U.S. Data Privacy Framework (DPF)Framework adopted by the European Commission in July 2023 allowing transfers to self-certified US organizations.Intermediate
• European Data Protection Board (EDPB)EU body of national supervisory authorities and the EDPS that ensures consistent GDPR application.Intermediate
• Evaluate, Direct and Monitor (EDM)COBIT governance domain in which the governing body evaluates options, directs management, and monitors performance.Intermediate
• Exit MeetingClosing meeting where auditors discuss findings and recommendations with auditees before final reporting.Intermediate
• Exposure Factor (EF)Percentage of an asset's value expected to be lost if a specific threat event occurs.Foundational
• External AuditAudit performed by an independent party outside the organization, such as a CPA firm or certification body.Foundational
• External Service Provider (ESP)CMMC term for an external organization providing IT or cybersecurity services that handle CUI or Security Protection Data.Advanced
• Factor Analysis of Information Risk (FAIR)Open quantitative model that decomposes risk into loss event frequency and loss magnitude for financial analysis.Advanced
• Fair Information Practice Principles (FIPPs)Foundational principles for handling personal information, underlying most privacy laws and frameworks.Intermediate
• Family Educational Rights and Privacy Act (FERPA)US law protecting the privacy of student education records at schools receiving federal funding.Intermediate
• Federal Contract Information (FCI)Non-public information provided by or generated for the US government under a contract, not intended for public release.Intermediate
• Federal Information Security Modernization Act (FISMA)US law requiring federal agencies to develop, document, and implement agency-wide information security programs.Foundational
• Federal Trade Commission Act Section 5US law prohibiting unfair or deceptive acts or practices, the FTC's primary privacy and security enforcement authority.Intermediate
• FedRAMPFederal Risk and Authorization Management Program, the US government-wide approach to security assessment and authorization of cloud services.Intermediate
• FedRAMP 20xFedRAMP modernization initiative announced in 2025 to automate and accelerate cloud authorizations using key security indicators.Advanced
• FedRAMP Impact LevelsFedRAMP security baselines (LI-SaaS, Low, Moderate, High) aligned to FIPS 199 impact categorization.Advanced
• FIPS 199Federal standard for categorizing information and systems by potential impact (low, moderate, high) on confidentiality, integrity, and availability.Intermediate
• FIPS 200Federal standard specifying minimum security requirements for federal information and systems.Advanced
• Fourth-Party RiskRisk arising from a vendor's own vendors and subcontractors that support services provided to you.Intermediate
• Fraud RiskRisk of intentional deception for gain, including asset misappropriation, corruption, and financial statement fraud.Intermediate
• FTC Safeguards RuleFTC rule under GLBA requiring non-bank financial institutions to maintain a written information security program with specific controls.Advanced
• Fundamental Rights Impact Assessment (FRIA)EU AI Act assessment required of certain deployers of high-risk AI before first use.Advanced
• Gap AnalysisComparison of current state with a desired state or requirement to identify deficiencies and actions.Foundational
• GDPR Administrative FinesTwo-tier GDPR penalty structure: up to 10 million euros or 2 percent, or up to 20 million euros or 4 percent of global annual turnover.Intermediate
• General Data Protection Regulation (GDPR)EU regulation (2016/679), applicable since 25 May 2018, governing processing of personal data of individuals in the EU/EEA.Foundational
• General-Purpose AI Model (GPAI)EU AI Act term for AI models with significant generality able to perform a wide range of tasks, such as large language models.Advanced
• Generalized Audit Software (GAS)Audit software that reads and analyzes data files to perform functions like sampling, stratification, duplicate detection, and gap detection.Intermediate
• Global Internal Audit StandardsIIA standards effective January 2025 that govern the professional practice of internal auditing worldwide.Advanced
• Global Privacy Control (GPC)Browser or extension signal communicating a user's request to opt out of sale or sharing of personal data.Intermediate
• Goals CascadeCOBIT mechanism translating stakeholder needs into enterprise goals, alignment goals, and governance and management objectives.Advanced
• Governance, Risk, and Compliance (GRC)Integrated approach to aligning IT and security with business objectives, managing risk, and meeting legal and regulatory requirements.Foundational
• GovRAMPNonprofit program (formerly StateRAMP) providing cloud security verification for US state and local governments.Advanced
• Gramm-Leach-Bliley Act (GLBA)1999 US law requiring financial institutions to protect customers' nonpublic personal information and disclose privacy practices.Intermediate
• GuidelineRecommended, non-mandatory advice for implementing policies and standards when no specific standard applies.Foundational
• Hash TotalSum of a non-financial field, such as account numbers, used solely as a batch control.Advanced
• Health Insurance Portability and Accountability Act (HIPAA)1996 US law whose administrative simplification rules protect the privacy and security of protected health information.Foundational
• High-Risk AI SystemEU AI Act category of AI systems subject to strict requirements due to significant risk to health, safety, or fundamental rights.Advanced
• High-Water MarkPrinciple that a system's overall impact level equals the highest impact level of any security objective or information type it handles.Intermediate
• HIPAA Breach Notification RuleHIPAA rule requiring notification of individuals, HHS, and sometimes media after a breach of unsecured PHI.Intermediate
• HIPAA De-identificationMethods by which health information is rendered not individually identifiable and no longer PHI: Safe Harbor or Expert Determination.Advanced
• HIPAA Privacy RuleHIPAA rule setting standards for use and disclosure of PHI and individuals' rights over their health information.Intermediate
• HIPAA Security RuleHIPAA rule requiring administrative, physical, and technical safeguards for electronic PHI.Intermediate
• HITECH ActHealth Information Technology for Economic and Clinical Health Act of 2009, strengthening HIPAA enforcement and breach notification.Intermediate
• HITRUST CSFCertifiable security and privacy framework harmonizing HIPAA, NIST, ISO, PCI, and other requirements, widely used in healthcare.Intermediate
• Hybrid ControlControl implemented partly as a common control and partly by the individual system.Intermediate
• ImpactThe magnitude of harm or consequence if a risk event occurs.Foundational
• Information Security GovernanceThe leadership, structures, and processes that ensure security strategy supports business objectives and manages risk to an acceptable level.Foundational
• Information Security Management System (ISMS)Systematic, risk-based management system for protecting information through policies, processes, and controls.Foundational
• Information System Security Officer (ISSO)Individual responsible for maintaining the day-to-day operational security posture of an information system.Intermediate
• Inherent RiskLevel of risk before any controls or treatments are applied.Intermediate
• Input ControlsApplication controls ensuring data entered is authorized, complete, accurate, and valid.Intermediate
• Integrated Risk Management (IRM)Set of practices and technology that integrate risk management across business, IT, and compliance functions.Intermediate
• Integrated Test Facility (ITF)Technique creating dummy entities in a production system so test transactions are processed alongside live data.Advanced
• Interim Authorization to Test (IATT)Limited authorization to test a system in an operational environment with live data for a specified time.Advanced
• Internal AuditIndependent, objective assurance and consulting activity within an organization that evaluates governance, risk management, and control.Foundational
• Internal ControlProcess designed to provide reasonable assurance about achieving objectives in operations, reporting, and compliance.Foundational
• ISACA IT Audit Framework (ITAF)ISACA's professional practices framework containing IS audit and assurance standards, guidelines, and tools.Advanced
• ISAE 3402International assurance standard for reports on controls at service organizations, equivalent to SOC 1.Advanced
• ISO 22301International standard specifying requirements for a business continuity management system (BCMS).Intermediate
• ISO 31000International standard providing principles, a framework, and a process for managing any type of risk.Intermediate
• ISO/IEC 27001International standard specifying requirements for establishing, implementing, maintaining, and improving an information security management system.Foundational
• ISO/IEC 27002Code of practice providing guidance on implementing information security controls.Intermediate
• ISO/IEC 27005ISO standard giving guidance on information security risk management in support of ISO/IEC 27001.Intermediate
• ISO/IEC 27017Code of practice for information security controls for cloud services, for both providers and customers.Intermediate
• ISO/IEC 27018Code of practice for protecting PII in public clouds acting as PII processors.Intermediate
• ISO/IEC 27701International standard for a privacy information management system (PIMS), building on ISO/IEC 27001.Intermediate
• ISO/IEC 38500International standard providing principles for the governance of IT by boards and governing bodies.Advanced
• IT General Controls (ITGC)Controls over the IT environment that support the reliable operation of applications, such as access, change, and operations.Foundational
• Joint ControllersTwo or more controllers that jointly determine the purposes and means of processing.Intermediate
• Judgmental SamplingNonstatistical sampling in which the auditor selects items based on experience and judgment.Intermediate
• k-AnonymityPrivacy model ensuring each record is indistinguishable from at least k-1 others on quasi-identifiers.Advanced
• Key Control Indicator (KCI)Metric that measures how well a specific control is operating.Intermediate
• Key Goal Indicator (KGI)Metric that shows whether a business or IT goal has been achieved.Intermediate
• Key Performance Indicator (KPI)Metric that measures how well a process or activity is performing against targets.Foundational
• Key Risk Indicator (KRI)Metric that provides early warning of increasing risk exposure.Intermediate
• Lawful Basis for ProcessingOne of six GDPR Article 6 grounds required to process personal data lawfully.Foundational
• Lead Supervisory AuthoritySupervisory authority of a controller's or processor's main establishment that leads cross-border GDPR enforcement under the one-stop-shop mechanism.Advanced
• Legitimate InterestsGDPR lawful basis allowing processing necessary for a legitimate interest unless overridden by the data subject's rights.Intermediate
• LikelihoodThe chance or probability that a risk event will occur within a time frame.Foundational
• LINDDUNPrivacy threat modeling framework identifying threats such as linkability, identifiability, and non-compliance.Advanced
• Management ReviewPlanned review by top management of an ISMS to ensure its continuing suitability, adequacy, and effectiveness.Intermediate
• Managerial ControlControl category focused on governance and risk management activities such as policies, assessments, and planning.Foundational
• Material WeaknessDeficiency in internal control such that a material misstatement may not be prevented or detected timely.Advanced
• MaterialitySignificance of an item or error such that it could influence decisions of users of audit results.Intermediate
• Maturity ModelStructured scale for measuring the capability and consistency of processes from ad hoc to optimized.Intermediate
• Minimum Necessary StandardHIPAA requirement to limit use, disclosure, and requests of PHI to the minimum needed for the purpose.Intermediate
• Monte Carlo SimulationStatistical technique that runs many randomized iterations over input ranges to produce a probability distribution of outcomes.Advanced
• NIS2 DirectiveEU Directive (2022/2555) imposing cybersecurity risk-management and incident-reporting obligations on essential and important entities.Intermediate
• NIST AI 600-1NIST Generative AI Profile (July 2024) applying the AI RMF to risks unique to or exacerbated by generative AI.Advanced
• NIST Cybersecurity Framework 2.0 (NIST CSF 2.0)Voluntary NIST framework (Feb 2024) organizing cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, Recover.Foundational
• NIST Privacy FrameworkVoluntary NIST tool for managing privacy risk through enterprise risk management, structured like the Cybersecurity Framework.Intermediate
• NIST SP 800-137NIST guidance on Information Security Continuous Monitoring (ISCM) for federal systems and organizations.Advanced
• NIST SP 800-171NIST requirements for protecting the confidentiality of CUI in nonfederal systems and organizations.Intermediate
• NIST SP 800-171ANIST assessment procedures for verifying the security requirements of NIST SP 800-171.Advanced
• NIST SP 800-172NIST enhanced security requirements for protecting CUI against advanced persistent threats.Advanced
• NIST SP 800-30NIST guide for conducting information security risk assessments for federal systems and organizations.Intermediate
• NIST SP 800-37NIST publication defining the Risk Management Framework for information systems and organizations.Intermediate
• NIST SP 800-39NIST guidance on managing information security risk at organization, mission, and system tiers.Advanced
• NIST SP 800-53NIST catalog of security and privacy controls for information systems and organizations.Intermediate
• NIST SP 800-53ANIST guide for assessing security and privacy controls, defining assessment procedures and methods.Advanced
• NIST SP 800-53BNIST publication defining control baselines for low, moderate, and high impact systems and a privacy baseline.Advanced
• NIST SP 800-60NIST guide mapping types of information and systems to security categories.Advanced
• NonconformityNon-fulfillment of a requirement of a standard, regulation, or the organization's own management system.Intermediate
• NYDFS Cybersecurity RegulationNew York Department of Financial Services rule (23 NYCRR Part 500) requiring covered financial entities to maintain cybersecurity programs.Advanced
• OCTAVEOperationally Critical Threat, Asset, and Vulnerability Evaluation, a self-directed risk assessment methodology from Carnegie Mellon SEI.Advanced
• Ongoing AuthorizationTime-driven or event-driven authorization approach that replaces fixed-term reauthorization using continuous monitoring data.Advanced
• Operating EffectivenessWhether a control operated consistently as designed throughout a specified period.Intermediate
• Operational ControlControl category primarily implemented and executed by people rather than systems.Foundational
• Organization-Defined Parameter (ODP)Variable portion of a control that the organization sets, such as a frequency or time period.Advanced
• Output ControlsApplication controls ensuring output is complete, accurate, and distributed only to authorized recipients.Intermediate
• OverlayFully specified set of tailored controls and parameters for a community or technology, applied on top of a baseline.Advanced
• Parallel SimulationAuditor processes real production data with auditor-controlled programs and compares results to production output.Advanced
• Payment Card Industry Data Security Standard (PCI DSS)Industry standard with 12 requirements for protecting payment account data, maintained by the PCI Security Standards Council.Foundational
• PCI DSS Customized ApproachPCI DSS v4 option allowing entities to meet a requirement's stated objective with controls they design, validated by an assessor.Advanced
• PCI Security Standards Council (PCI SSC)Global forum founded by major card brands that develops and maintains PCI security standards.Intermediate
• Personal DataAny information relating to an identified or identifiable natural person under GDPR.Foundational
• Personal Data Breach NotificationGDPR requirement to notify the supervisory authority within 72 hours and affected individuals when risk is high.Foundational
• Personally Identifiable Information (PII)Information that can be used to distinguish or trace an individual's identity, alone or combined with other information.Foundational
• Physical ControlControl that restricts or monitors physical access to facilities and assets.Foundational
• Plan of Action and Milestones (POA&M)Document tracking weaknesses, planned remediation actions, resources, and target completion dates.Intermediate
• Plan-Do-Check-Act (PDCA)Iterative four-step management cycle for continual improvement: plan, do, check, act.Foundational
• PopulationEntire set of items from which an audit sample is drawn.Intermediate
• Post-Implementation Review (PIR)Review after a system or project goes live to assess whether objectives and benefits were achieved.Intermediate
• Preventive ControlControl designed to stop an undesired event from occurring.Foundational
• Primary Account Number (PAN)The unique payment card number identifying the issuer and cardholder account.Foundational
• Privacy by Design (PbD)Approach that embeds privacy into the design and operation of systems, processes, and business practices from the outset.Foundational
• Privacy Impact Assessment (PIA)Analysis of how personal information is handled to ensure compliance and identify and mitigate privacy risks.Intermediate
• Privacy NoticeExternal statement informing individuals how an organization collects, uses, shares, and protects their personal information.Foundational
• Privacy ProgramOrganizational structure, policies, processes, and resources that manage privacy compliance and risk.Intermediate
• Privacy-Enhancing Technologies (PETs)Technologies that minimize personal data use and maximize data security while enabling processing.Advanced
• ProcedureDetailed, step-by-step mandatory instructions for performing a specific task in compliance with policy and standards.Foundational
• Processing ControlsApplication controls ensuring data is processed completely and accurately.Intermediate
• Professional SkepticismAttitude of a questioning mind and critical assessment of audit evidence.Intermediate
• Prohibited AI PracticesAI uses banned under Article 5 of the EU AI Act as an unacceptable risk, applicable since 2 February 2025.Intermediate
• Protected Health Information (PHI)Individually identifiable health information held or transmitted by a covered entity or business associate.Foundational
• PseudonymizationProcessing personal data so it cannot be attributed to an individual without separately kept additional information.Intermediate
• Public Company Accounting Oversight Board (PCAOB)Nonprofit created by SOX to oversee audits of US public companies and set auditing standards.Advanced
• Purpose LimitationPrinciple that personal data be collected for specified, explicit, legitimate purposes and not further processed incompatibly.Intermediate
• Qualified Security Assessor (QSA)Assessor company or employee certified by the PCI SSC to perform PCI DSS assessments.Intermediate
• Qualitative Risk AnalysisRisk analysis that ranks risks using descriptive scales such as low, medium, and high rather than monetary values.Intermediate
• Quantitative Risk AnalysisRisk analysis that assigns numeric, usually monetary, values to assets, impacts, and probabilities.Intermediate
• Re-identificationLinking de-identified or anonymized data back to specific individuals, often by combining datasets.Advanced
• Records of Processing Activities (ROPA)GDPR Article 30 documentation of a controller's or processor's processing operations.Intermediate
• ReperformanceAuditor independently executes a control or procedure to verify it operates as described.Intermediate
• Report on Compliance (ROC)Detailed PCI DSS assessment report documenting how each requirement is met, completed by a QSA or ISA.Intermediate
• Residual RiskRisk that remains after controls and treatments have been applied.Foundational
• Right to Audit ClauseContract provision allowing a customer or regulator to audit a vendor's controls, records, and facilities.Intermediate
• Right to Data PortabilityGDPR right to receive personal data in a structured, commonly used, machine-readable format and transmit it to another controller.Intermediate
• Right to ErasureGDPR right of individuals to have their personal data deleted in certain circumstances; also called the right to be forgotten.Foundational
• Right to ObjectGDPR right to object to processing based on legitimate interests or public task, and absolutely to direct marketing.Intermediate
• Right to Opt Out of Sale or SharingUS state privacy right allowing consumers to stop businesses from selling their personal information or sharing it for targeted advertising.Intermediate
• RiskThe combination of the likelihood of an event and its impact on objectives; in security, a threat exploiting a vulnerability to harm an asset.Foundational
• Risk AcceptanceFormal decision by an authorized risk owner to tolerate a risk without further treatment.Foundational
• Risk AnalysisProcess of comprehending the nature of risk and determining its level by considering likelihood and impact.Foundational
• Risk AppetiteBroad amount and type of risk an organization is willing to pursue or retain to achieve its objectives.Foundational
• Risk AssessmentOverall process of risk identification, risk analysis, and risk evaluation.Foundational
• Risk AvoidanceEliminating a risk by not starting or by discontinuing the activity that creates it.Foundational
• Risk CapacityMaximum amount of risk an organization can absorb before its viability or objectives are seriously threatened.Intermediate
• Risk EvaluationComparing analyzed risk levels against risk criteria to decide which risks need treatment and in what priority.Intermediate
• Risk ExceptionFormally approved, time-limited deviation from a policy or standard with documented risk acceptance.Intermediate
• Risk Executive FunctionOrganizational role or group in NIST guidance that provides a holistic, enterprise view of risk.Advanced
• Risk FramingEstablishing the context, assumptions, constraints, tolerances, and priorities for risk decisions.Advanced
• Risk Heat MapVisual matrix plotting risks by likelihood and impact, using color to show severity.Foundational
• Risk IdentificationProcess of finding, recognizing, and describing risks that could affect objectives.Foundational
• Risk IT FrameworkISACA framework addressing IT-related business risk, organized into risk governance, risk evaluation, and risk response domains.Advanced
• Risk Management Framework (RMF)NIST SP 800-37 process for managing security and privacy risk of federal information systems in seven steps.Intermediate
• Risk MitigationRisk treatment that reduces likelihood or impact by implementing controls.Foundational
• Risk OwnerPerson or entity with the accountability and authority to manage a risk, including accepting it.Foundational
• Risk ProfileSnapshot description of the overall set of risks an organization or unit faces at a point in time.Intermediate
• Risk RegisterCentral record of identified risks with their analysis, owners, treatment, and status.Foundational
• Risk RejectionIgnoring or denying the existence of a risk; an unacceptable response distinct from acceptance.Intermediate
• Risk ScenarioDescription of a plausible event in which a threat exploits a vulnerability to cause a specific business impact.Intermediate
• Risk ThresholdSpecific measurable level of risk or uncertainty at which a response, escalation, or decision is triggered.Intermediate
• Risk ToleranceAcceptable variation around objectives or risk appetite for a specific risk or category.Foundational
• Risk TransferenceShifting the financial impact of a risk to a third party, such as through insurance or contracts.Foundational
• Risk TreatmentSelecting and implementing options to modify risk: mitigate, transfer, avoid, or accept.Foundational
• Risk Treatment PlanDocument describing how identified risks will be treated, by whom, with what resources, and by when.Intermediate
• Risk-Based Audit ApproachAudit planning approach that focuses resources on areas of highest risk.Foundational
• RMF Assess StepRMF step where an assessor determines whether controls are implemented correctly, operating as intended, and producing desired outcomes.Intermediate
• RMF Authorize StepRMF step in which a senior official decides whether the residual risk of operating a system is acceptable.Intermediate
• RMF Categorize StepRMF step that determines a system's security category based on impact of loss of confidentiality, integrity, and availability.Intermediate
• RMF Implement StepRMF step in which selected controls are put in place and implementation details documented.Intermediate
• RMF Monitor StepRMF step maintaining ongoing awareness of system security and privacy posture to support risk decisions.Intermediate
• RMF Prepare StepRMF step establishing context and priorities at organization and system levels before categorization.Intermediate
• RMF Select StepRMF step in which controls are chosen, tailored, and documented in security and privacy plans.Intermediate
• SABSASherwood Applied Business Security Architecture, a risk-driven enterprise security architecture framework.Advanced
• Sampling RiskRisk that the auditor's conclusion based on a sample differs from the conclusion if the entire population were tested.Intermediate
• Sarbanes-Oxley Act (SOX)2002 US law requiring public companies to maintain and attest to internal control over financial reporting.Foundational
• Schrems II2020 CJEU ruling that invalidated the EU-US Privacy Shield and required case-by-case assessment for SCC transfers.Intermediate
• Scope LimitationRestriction that prevents the auditor from performing necessary procedures or obtaining sufficient evidence.Intermediate
• ScopingDetermining which controls or requirements apply to a system, process, or assessment.Intermediate
• SEC Cybersecurity Disclosure Rules2023 SEC rules requiring public companies to disclose material cybersecurity incidents and describe cyber risk management and governance.Intermediate
• Security Assessment Report (SAR)Document presenting results of a control assessment, including findings and recommendations.Intermediate
• Security CategorizationProcess of determining the impact level of a system or information based on potential harm from loss of CIA.Intermediate
• Security ControlSafeguard or countermeasure that protects confidentiality, integrity, or availability of information.Foundational
• Security MetricsQuantifiable measurements used to track security program performance, risk, and control effectiveness.Intermediate
• Security PolicyHigh-level management statement of intent, direction, and requirements for protecting information assets.Foundational
• Security QuestionnaireStandardized set of questions used to assess a third party's security and privacy controls.Intermediate
• Security StandardMandatory requirement specifying uniform use of technologies, configurations, or methods to support policy.Foundational
• Security Steering CommitteeCross-functional management group that prioritizes security initiatives, resolves conflicts, and aligns security with business needs.Intermediate
• Security Technical Implementation Guide (STIG)DISA configuration standards for securing DoD information systems and software.Intermediate
• Segregation of Duties (SoD)Dividing critical tasks among different people so no single person can both commit and conceal errors or fraud.Foundational
• Self-Assessment Questionnaire (SAQ)PCI DSS validation tool for eligible merchants and service providers to self-assess compliance.Intermediate
• Semi-Quantitative Risk AnalysisHybrid approach that assigns numeric scores to qualitative scales to rank and combine risks.Intermediate
• Senior Agency Information Security Officer (SAISO)Federal official responsible for carrying out the CIO's FISMA security responsibilities, often the agency CISO.Advanced
• Sensitive Authentication Data (SAD)Card security data such as full track data, card verification codes, and PINs that must not be stored after authorization.Intermediate
• Sensitive Personal Information (SPI)CPRA category of personal information subject to the right to limit its use and disclosure.Intermediate
• Significant DeficiencyControl deficiency less severe than a material weakness but important enough to merit attention of those charged with governance.Advanced
• Single Loss Expectancy (SLE)Expected monetary loss from one occurrence of a threat event: SLE = Asset Value x Exposure Factor.Foundational
• Snapshot TechniqueContinuous audit technique capturing images of a transaction at selected points as it flows through an application.Advanced
• SOC 1Report on a service organization's controls relevant to user entities' internal control over financial reporting.Intermediate
• SOC 2Report on a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy.Foundational
• SOC 3General-use summary report of a SOC 2 examination suitable for public distribution.Intermediate
• SOC Type 1 ReportSOC report on the fairness of the description and suitability of control design as of a specific date.Foundational
• SOC Type 2 ReportSOC report covering both design and operating effectiveness of controls over a specified period.Foundational
• SOX Section 302SOX provision requiring CEOs and CFOs to certify the accuracy of financial reports and effectiveness of disclosure controls.Intermediate
• SOX Section 404SOX provision requiring annual management assessment of ICFR and, for accelerated filers, external auditor attestation.Intermediate
• Special Categories of Personal DataSensitive personal data under GDPR Article 9 requiring heightened protection and a specific processing condition.Intermediate
• Standard Contractual Clauses (SCC)European Commission-approved contract clauses providing safeguards for transfers of personal data outside the EU.Intermediate
• State Comprehensive Privacy LawsUS state laws, following California and Virginia, granting consumer privacy rights and imposing duties on controllers.Intermediate
• Statement of Applicability (SoA)ISO/IEC 27001 document listing all Annex A controls, whether each is included or excluded, and justification.Intermediate
• Statement on Standards for Attestation Engagements No. 18 (SSAE 18)AICPA attestation standard under which SOC 1, SOC 2, and SOC 3 examinations are performed.Advanced
• Statistical SamplingSampling that uses random selection and probability theory to evaluate results and quantify sampling risk.Intermediate
• Stop-or-Go SamplingAttribute sampling technique that allows the auditor to stop testing early if few or no errors are found.Advanced
• Strategic AlignmentEnsuring the information security strategy directly supports and enables business goals and objectives.Foundational
• Stratified SamplingDividing a population into homogeneous subgroups (strata) and sampling from each.Advanced
• Sub-ProcessorProcessor engaged by another processor to carry out processing on behalf of a controller.Intermediate
• Subservice OrganizationVendor used by a service organization whose controls may be relevant to the service organization's customers.Advanced
• Substantive TestingAudit testing that examines the integrity of actual data, balances, or transactions to detect material errors.Foundational
• Sufficient Appropriate EvidenceAudit evidence that is adequate in quantity and of suitable quality to support conclusions.Intermediate
• Supervisory AuthorityIndependent public authority in each EU/EEA member state responsible for enforcing GDPR.Foundational
• Supplier Performance Risk System (SPRS)DoD system where contractors post NIST SP 800-171 assessment scores and CMMC status and affirmations.Advanced
• Surveillance AuditPeriodic audit by a certification body between certification and recertification to confirm ongoing conformity.Intermediate
• System and Organization Controls Report (SOC report)AICPA attestation report by a CPA on controls at a service organization.Foundational
• System OwnerOfficial responsible for procurement, development, integration, operation, and maintenance of a system.Intermediate
• System Security Plan (SSP)Formal document describing a system's boundary, environment, security requirements, and how controls are implemented.Intermediate
• System-Specific ControlControl implemented and managed solely by an individual information system.Intermediate
• Targeted Risk Analysis (TRA)PCI DSS v4 risk analysis used to justify the frequency of certain controls or to support customized approach controls.Advanced
• Technical ControlControl implemented through hardware, software, or firmware that enforces security automatically.Foundational
• Territorial Scope of GDPRGDPR Article 3 rules defining when GDPR applies, including to non-EU organizations.Intermediate
• Test DataAuditor-prepared transactions processed through an application to verify controls and logic.Advanced
• Third-Party Assessment Organization (3PAO)Independent organization accredited by A2LA to perform FedRAMP security assessments.Intermediate
• Third-Party Risk Management (TPRM)Discipline of identifying, assessing, mitigating, and monitoring risks from vendors, suppliers, and other external parties.Foundational
• ThreatAny potential cause of an unwanted incident that may harm an asset, such as an actor, event, or circumstance.Foundational
• Three Lines ModelIIA model describing governance roles: management (first and second lines), internal audit (third line), and the governing body.Intermediate
• TOGAFThe Open Group Architecture Framework, an enterprise architecture methodology centered on the Architecture Development Method.Advanced
• Tolerable Error RateMaximum error rate an auditor will accept while still concluding a control or balance is acceptable.Advanced
• Total RiskThe amount of risk an organization faces before safeguards: threats x vulnerabilities x asset value.Intermediate
• Transfer Impact Assessment (TIA)Assessment of whether a destination country's laws and practices undermine protections of a transfer mechanism.Advanced
• Trust Services Criteria (TSC)AICPA criteria for security, availability, processing integrity, confidentiality, and privacy used in SOC 2 and SOC 3.Intermediate
• UK GDPRRetained version of GDPR in UK law post-Brexit, supplemented by the Data Protection Act 2018.Intermediate
• Value DeliveryGovernance outcome ensuring IT and security investments deliver the expected business benefits at optimal cost.Intermediate
• Variable SamplingStatistical sampling method used in substantive testing to estimate a monetary or numeric value.Intermediate
• Vendor Due DiligencePre-contract evaluation of a vendor's security, privacy, financial, operational, and compliance posture.Intermediate
• VulnerabilityA weakness in an asset, control, or process that a threat could exploit.Foundational
• WalkthroughFollowing a transaction from origination through processing and reporting to understand and confirm a process and its controls.Intermediate
• Zachman FrameworkEnterprise architecture ontology using a 6x6 matrix of perspectives and interrogatives.Advanced