Studied by 4 people

CRISC Created by morganrmanter

Study
Scores
Info
Add to Folder
Share
Copy
Print
More Tools


All 102
Flashcards


All 102
Learn


All 102
Speller


All 102
Test


All 102
Scatter


All 102
Space Race






Remove ads
OriginalAlphabetical
102 terms Acronyms and terms
FMEA
failure modes effects analysis




BPM
business process modeling




SPC
statistical process control




cusum
cumulative summary. each value is added for a cummulative total.




EL
expected loss




BCP
business continuity planning




CSF
critical success factor




ERM
enterprise risk management




RCSA
risk control self assessment




COSO
committee of sponsoring organizations treadway commission




BPR
Business Process Reengineering




CRISC
certified in risk and information systems control




COBIT
Control Objectives for Information and Related Technology




framework publisher of: COBIT
framework published by: ISACA




framework publisher of: enterprise risk management - integrated
framework
framework published by: COSO




framework publisher of: Risk management framework
framework published by: NIST




framework publisher of: Risk IT Framework
framework published by: ISACA




framework publisher of: Enterprise value - govit valit
framework published by: ISACA




RMF
risk management framework




standards publisher of: IT Audit and Assurance Standards
standards published by: ISACA




ISO
international organization for standards




BSI
British Standards Institution




IEC
international electrotechnical commission




CMU
Carnegie Mellon University




SIE
Software Engineering Institute




MAGERIT
Methodology for Information Systems Risk Analysis and Management




OCTAVE
operationally critical threat and vulnerability evaluation




RMIS
risk management information systems




Access control
The processes, rules and deployment mechanisms that control access to
information systems, resources and physical access to premises




Access rights
The permission or privileges granted to users, programs or workstations to
create, change, delete or view data and files within a system, as defined by
rules established by data owners and the information security policy




Application controls
The policies, procedures and activities designed to provide reasonable
assurance that objectives relevant to a given automated solution
(application) are achieved




Asset
Something of either tangible or intangible value that is worth protecting,
including people, information, infrastructure, finances and reputation




Authentication
1. The act of verifying identity (i.e., user, system) Scope Note: Risk: Can
also refer to the verification of the correctness of a piece of data 2. The act
of verifying the identity of a user and the user's eligibility to access
computerized information. Scope Note: Assurance: Authentication is
designed to protect against fraudulent logon activity. It can also refer to
the verification of the correctness of a piece of data.




Availability
Ensuring timely and reliable access to and use of information. Balanced
scorecard (BSC) Developed by Robert S. Kaplan and David P. Norton as a
coherent set of performance measures organized into four categories that
includes traditional financial measures, but adds customer, internal
business process, and learning and growth perspectives




Business case
Documentation of the rationale for making a business investment, used
both to support a business decision on whether to proceed with the
investment and as an operational tool to support management of the
investment through its full economic life cycle




Business continuity plan (BCP)
A plan used by an enterprise to respond to disruption of critical business
processes. Depends on the contingency plan for restoration of critical
systems




Business goal
The translation of the enterprise's mission from a statement of intention
into performance targets and results




Business impact
The net effect, positive or negative, on the achievement of business
objectives




Business impact analysis/assessment (BIA)
Evaluating the criticality and sensitivity of information assets. An exercise
that determines the impact of losing the support of any resource to an
enterprise, establishes the escalation of that loss over time, identifies the
minimum resources needed to recover, and prioritizes the recovery of
processes and the supporting system. Scope Note: This process also
includes addressing: - Income loss - Unexpected expense - Legal issues
(regulatory compliance or contractual) - Interdependent processes - Loss
of public reputation or public confidence




Business objective
A further development of the business goals into tactical targets and
desired results and outcomes




Business process owner
The individual responsible for identifying process requirements, approving
process design and managing process performance. Scope Note: Must be
at an appropriately high level in the enterprise and have authority to
commit resources to process-specific risk management activities




Business risk
A probable situation with uncertain frequency and magnitude of loss (or
gain)




Capability
An aptitude, competency or resource that an enterprise may possess or
require at an enterprise, business function or individual level that has the
potential, or is required, to contribute to a business outcome and to create
value




Capability Maturity Model (CMM)
1. Contains the essential elements of effective processes for one or more
disciplines. It also describes an evolutionary improvement path from ad
hoc, immature processes to disciplined, mature processes with improved
quality and effectiveness. 2. CMM for software, from the Software
Engineering Institute (SEI), is a model used by many enterprises to
identify best practices useful in helping them assess and increase the
maturity of their software development processes. Scope Note: CMM ranks
software development enterprises according to a hierarchy of five process
maturity levels. Each level ranks the development environment according
to its capability of producing quality software. A set of standards is
associated with each of the five levels. The standards for level one describe
the most immature or chaotic processes and the standards for level five
describe the most mature or quality processes. A maturity model that
indicates the degree of reliability or dependency the business can place on
a process achieving the desired goals or objectives A collection of
instructions that an enterprise can follow to gain better control over its
software development process. Compensating control An internal control
that reduces the risk of an existing or potential control weakness resulting
in errors and omissions




Computer emergency response team (CERT)
A group of people integrated at the enterprise with clear lines of reporting
and responsibilities for standby support in case of an information systems
emergency. This group will act as an efficient corrective control, and
should also act as a single point of contact for all incidents and issues
related to information systems.




Confidentiality
Preserving authorized restrictions on access and disclosure, including
means for protecting privacy and proprietary information




Control risk self-assessment
A method/process by which management and staff of all levels collectively
identify and evaluate risk and controls with their business areas. This may
be under the guidance of a facilitator such as an auditor or risk manager.




Data custodian
The individual(s) and department(s) responsible for the storage and
safeguarding of computerized data




Data owner
The individual(s), normally a manager or director, who has responsibility
for the integrity, accurate reporting and use of computerized data




Detective control
Exists to detect and report when errors, omissions and unauthorized uses
or entries occur




Disaster recovery plan (DRP)
A set of human, physical, technical and procedural resources to recover,
within a defined time and cost, an activity interrupted by an emergency or
disaster




Enterprise risk management (ERM)
The discipline by which an enterprise in any industry assesses, controls,
exploits, finances and monitors risk from all sources for the purpose of
increasing the enterprise's short- and long-term value to its stakeholders




Enterprise Resource Planning (ERP)
A enterprise to automate and integrate the majority of its planning. System
packaged business software system that allows an business processes,
share common data and practices across the entire enterprise, and
produce and access information in a real-time environment. Scope Note:
Examples of ERP include SAP, Oracle Financials and J.D. Edwards.




Event
Something that happens at a specific place and/or time




Event type
For the purpose of IT risk management, one of three possible sorts of
events: threat event, loss event and vulnerability event. Scope Note: Being
able to consistently and effectively differentiate the different types of
events that contribute to risk is a critical element in developing good risk-
related metrics and well-informed decisions. Unless these categorical
differences are recognized and applied, any resulting metrics lose meaning
and, as a result, decisions based on those metrics are far more likely to be
flawed.




Evidence
1. Information that proves or disproves a stated issue 2. Information that
an auditor gathers in the course of performing an IS audit; relevant if it
pertains to the audit objectives and has a logical relationship to the
findings and conclusions it is used to support Scope Note: Audit
perspective




Fallback procedures
A plan of action or set of procedures to be performed if a system
implementation, upgrade or modification does not work as intended Scope
Note: May involve restoring the system to its state prior to the
implementation or change. Fallback procedures are needed to ensure that
normal business processes continue in the event of failure and should
always be considered in system migration or implementation.




Feasibility study
A phase of a system development life cycle (SDLC) methodology that
researches the feasibility and adequacy of resources for the development
or acquisition of a system solution to a user need




Frequency
A measure of the rate by which events occur over a certain period of time




Governance
Ensures that stakeholder needs, conditions and options are evaluated to
determine balanced, agreed-on enterprise objectives to be achieved;
setting direction through prioritization and decision making; and
monitoring performance and compliance against agreed-on direction and
objectives. Scope Note: Conditions can include the cost of capital, foreign
exchange rates, etc. Options can include shifting manufacturing to other
locations, sub-contracting portions of the enterprise to third-parties,
selecting a product mix from many available choices, etc.




Impact analysis
A study to prioritize the criticality of information resources for the
enterprise based on costs (or consequences) of adverse events In an impact
analysis, threats to assets are identified and potential business losses
determined for different time periods. This assessment is used to justify
the extent of safeguards that are required and recovery time frames. This
analysis is the basis for establishing the recovery strategy.




Information systems (IS)
The combination of strategic, managerial and operational activities
involved in gathering, processing, storing, distributing and using
information and its related technologies Scope Note: Information systems
are distinct from information technology (IT) in that an information
system has an IT component that interacts with the process components.




Inherent risk
1. The risk level or exposure without taking into account the actions that
management has taken or might take (e.g.,implementing controls) 2. The
risk that a material error could occur, assuming that there are no related
internal controls to prevent or detect the error. Scope Note: Audit
perspective; also see Control risk




Integrity
Guarding against improper information modification or destruction, and
includes ensuring information non-repudiation and authenticity




Internal controls
The policies, procedures, practices and organizational structures designed
to provide reasonable assurance that business




IT architecture
Description of the fundamental underlying design of the IT components of
the business, the relationships among them, and the manner in which they
support the enterprise's objectives




IT infrastructure
The set of hardware, software and facilities that integrates an enterprise's
IT assets. Scope Note: Specifically, the equipment (including servers,
routers, switches and cabling), software, services and products used in
storing, processing, transmitting and displaying all forms of information
for the enterprise's users




IT risk
The business risk associated with the use, ownership, operation,
involvement, influence and adoption of IT within an enterprise




IT risk issue
1. An instance of IT risk 2. A combination of control, value and threat
conditions that impose a noteworthy level of IT risk




IT risk profile
A description of the overall (identified) IT risk to which the enterprise is
exposed




IT risk register
A repository of the key attributes of potential and known IT risk issues.
Attributes may include name, description, owner, expected/actual
frequency, potential/actual magnitude, potential/actual business impact,
disposition.




IT risk scenario
The description of an IT-related event that can lead to a business impact
IT-related incident An IT-related event that causes an operational,
developmental and/or strategic business impact




Key performance indicator (KPI)
A measure that determines how well the process is performing in enabling
the goal to be reached. Scope Note: A lead indicator of whether a goal will
likely be reached, and a good indicator of capabilities, practices and skills.
It measures an activity goal, which is an action that the process owner
must take to achieve effective process performance.




Key risk indicator (KRI)
A subset of risk indicators that are highly relevant and possess a high
probability of predicting or indicating important risk. Scope Note: See also
Risk Indicator.




Loss event
Any event during which a threat event results in loss. Scope Note: From
Jones, J.; "FAIR Taxonomy," Risk Management Insight, USA, 2008




Magnitude
A measure of the potential severity of loss or the potential gain from
realized events/scenarios




Objectivity
The ability to exercise judgment, express opinions and present
recommendations with impartiality




Preventive control
An internal control that is used to avoid undesirable events, errors and
other occurrences that an enterprise has determined could have a negative
material effect on a process or end product




Project portfolio
The set of projects owned by a company. Scope Note: It usually includes
the main guidelines relative to each project, including objectives, costs,
time lines and other information specific to the project.




Recovery point objective (RPO)
Determined based on the acceptable data loss in case of a disruption of
operations. It indicates the earliest point in time that is acceptable to
recover the data. The RPO effectively quantifies the permissible amount of
data loss in case of interruption.




Recovery time objective
(The amount of time allowed for the recovery of a business function or
resource after a disaster occurs




Reputation risk
The current and prospective effect on earnings and capital arising from
negative public opinion. Scope Note: Reputation risk affects a bank's
ability to establish new relationships or services, or to continue servicing
existing relationships. It may expose the bank to litigation, financial loss or
a decline in its customer base. A bank's reputation can be damaged by
Internet banking services that are executed poorly or otherwise alienate
customers and the public. An Internet bank has a greater reputation risk as
compared to a traditional brick-and-mortar bank, because it is easier for
its customers toleave and go to a different Internet bank and since it
cannot discuss any problems in person with the customer.




Residual risk
The remaining risk after management has implemented a risk response




Resilience
The ability of a system or network to resist failure or to recover quickly
from any disruption, usually with minimal recognizable effect




Risk aggregation
The process of integrating risk assessments at a corporate level to obtain a
complete view on the overall risk for the enterprise




Risk analysis
1. A process by which frequency and magnitude of IT risk scenarios are
estimated. 2. The initial steps of risk management: analyzing the value of
assets to the business, identifying threats to those assets and evaluating
how vulnerable each asset is to those threats Scope Note: It often involves
an evaluation of the probable frequency of a particular event, as well as the
probable impact of that event.




Risk appetite
The amount of risk, on a broad level, that an entity is willing to accept in
pursuit of its mission




Risk avoidance
The process for systematically avoiding risk, constituting one approach to
managing risk




Risk culture
The set of shared values and beliefs that governs attitudes toward risk-
taking, care and integrity, and determines how openly risk and losses are
reported and discussed




Risk factor
A condition that can influence the frequency and/or magnitude and,
ultimately, the business impact of IT-related events/scenarios




Risk indicator
A metric capable of showing that the enterprise is subject to, or has a high
probability of being subject to, a risk that exceeds the defined risk appetite
Risk management 1. The coordinated activities to direct and control an
enterprise with regard to risk Scope Note: In the International Standard,
the term "control" is used as a synonym for "measure." (ISO/IEC Guide
73:2002) 2. One of the governance objectives. Entails recognizing risk;
assessing the impact and likelihood of that risk; and developing strategies,
such as avoiding the risk, reducing the negative effect of the risk and/or
transferring the risk, to manage it within the context of the enterprise's
risk appetite. Scope Note: COBIT 5 perspective




Risk map
A (graphic) tool for ranking and displaying risk by defined ranges for
frequency and magnitude




Risk mitigation
The management of risk through the use of countermeasures and controls




Risk portfolio view
1. A method to identify interdependencies and interconnections among
risk, as well as the effect of risk responses on multiple types of risk 2. A
method to estimate the aggregate impact of multiple types of risk (e.g.,
cascading and coincidental threat types/scenarios, risk
concentration/correlation across silos) and the potential effect of risk
response across multiple types of risk




Risk tolerance
The acceptable level of variation that management is willing to allow for
any particular risk as the enterprise pursues its objectives




Risk transfer
The process of assigning risk to another enterprise, usually through the
purchase of an insurance policy or by outsourcing the service




System development life cycle (SDLC)
The phases deployed in the development or acquisition of a software
system. Scope Note: SDLC is an approach used to plan, design, develop,
test and implement an application system or a major modification to an
application system. Typical phases of SDLC include the feasibility study,
requirements study, requirements definition, detailed design,
programming, testing, installation and post-implementation review, but
not the service delivery or benefits realization activities.




Threat
Anything (e.g., object, substance, human) that is capable of acting against
an asset in a manner that can result in harm. Scope Note: A potential cause
of an unwanted incident (ISO/IEC 13335)




Threat analysis
An evaluation of the type, scope and nature of events or actions that can
result in adverse consequences; identification of the threats that exist
against enterprise assets Scope Note: The threat analysis usually defines
the level of threat and the likelihood of it materializing.




Threat event
Any event during which a threat element/actor acts against an asset in a
manner that has the potential to directly result in harm




Vulnerability
A weakness in the design, implementation, operation or internal control of
a process that could expose the system to adverse threats from threat
events




Vulnerability event
Any event during which a material increase in vulnerability results. Note
that this increase in vulnerability can result from changes in control
conditions or from changes in threat capability/force.





Please allow access to your computers microphone to use Voice Recording.

Having trouble? Click here for help.