CISSP - Domain 1 - Security & Risk Management

BCP vs. DRP

A Business Continuity Plan focuses on keeping entire business operational during a disruption - covering people, processes, & facilities. A Disaster Recovery Plan (DRP) is a subset of BCP focusing specifically on restoring the IT systems and data after the incident. The BCP asks ‘how do we keep the business running?’ and the DRP asks ‘how do we get our systems back?’

Work Recovery Time

Work Recovery Time (WRT) is the time required to restore and validate data, reconfigure systems, and perform the work needed to make a recovered system fully operational after the technical recovery is complete. WRT accounts for the effort between 'systems are back online' and 'the system is fully functional and verified.' RTO + WRT must not exceed MTD.

Computer Fraud and Abuse Act (CFAA)

The Computer Fraud and Abuse Act is the primary US federal statute criminalizing unauthorized access to computer systems, including exceeding authorized access levels. It covers offenses ranging from stealing financial information to launching denial-of-service attacks and provides both criminal penalties and a civil cause of action for victims.

Patent

A patent is a government-granted exclusive right that allows an inventor to prevent others from making, using, or selling their invention for a fixed period — typically 20 years. Patents protect functional inventions, processes, or designs. In exchange for this protection, the inventor publicly discloses how the invention works.

Auditing

Auditing is the process of reviewing and examining records of system activity to verify compliance, detect anomalies, and support accountability. Audit logs capture who did what and when, providing a trail for investigation and oversight. It is a key control for both security monitoring and regulatory compliance.

Exposure

Exposure is the condition of being susceptible to harm because of a vulnerability that has not been addressed. It represents how open an asset is to potential loss — the greater the unmitigated vulnerability, the greater the exposure. Exposure is what risk controls are designed to reduce.

Secondary Risk

Secondary risk is a new risk that arises as a direct result of implementing a risk response. For example, deploying a new security tool to mitigate one risk may introduce vulnerabilities or operational disruptions of its own. Organizations should assess secondary risks before finalizing any risk treatment plan.

Due Care vs. Due Diligence

Due care is taking reasonable, responsible action to protect assets and people — doing the right thing. Due diligence is the ongoing process of investigating, assessing, and verifying risks before making decisions. Together they show an organization acted responsibly: due diligence identifies what needs to be done, and due care is actually doing it.

Trade Secret

A trade secret is confidential business information that provides a competitive advantage and is actively kept secret by the owner — such as a formula, algorithm, or business process. Unlike patents, trade secrets are not registered or publicly disclosed. Protection lasts as long as the information remains secret and the owner takes reasonable steps to protect it.

Business Impact Analysis

A Business Impact Analysis (BIA) is an assessment that identifies critical business functions and determines the potential impact of disrupting them. It establishes key recovery metrics — such as how long a function can be down and how much data loss is acceptable. The BIA is the foundation for both BCP and DRP planning.

PCI DSS

The Payment Card Industry Data Security Standard is a set of security requirements established by major card brands to protect cardholder data throughout the payment processing lifecycle. It applies to any organization that stores, processes, or transmits cardholder data regardless of size. Compliance is validated through self-assessment questionnaires or third-party audits depending on transaction volume.

Two-person Integrity

Two-person integrity (the two-man rule) is a control requiring two authorized individuals to be simultaneously present and concur before a sensitive operation can be performed. Neither person can act alone — both must authenticate and approve. It originated in nuclear weapons control and is applied in security for access to cryptographic key material and critical system operations.

Attack Vector

An attack vector is the path or means by which a threat actor gains unauthorized access to a system or network. Common attack vectors include phishing emails, unpatched vulnerabilities, physical intrusion, and stolen credentials. Identifying attack vectors is a core step in threat modeling and helps prioritize which entry points to harden.

zero-day Vulnerability

A zero-day vulnerability is a security flaw unknown to the vendor for which no patch exists. The term reflects that developers have had zero days to respond since the flaw became known to an attacker. Zero-day vulnerabilities are highly valuable because defenders have no available signature or patch to deploy as a standard defense.

AI Ethics Governance

The policies, standards, and oversight structures ensuring AI systems are developed and deployed in line with ethical principles: fairness, transparency, accountability, and respect for human rights. In a security context it includes mechanisms to detect and mitigate algorithmic bias, ensure explainability of automated decisions, and align AI behaviour with legal and regulatory requirements.

Authentication

Authentication is the process of verifying that a claimed identity is genuine. A user presents credentials, and the system confirms those credentials match what is on record. Common methods include passwords, smart cards, and biometrics.

Privacy

Privacy is the right of individuals to control how their personal information is collected, used, and shared. From a security management perspective, organizations have legal and ethical obligations to protect personal data and limit its use to stated purposes. Privacy is distinct from confidentiality in that it focuses on personal rights, not just data protection.

Risk

Risk is the possibility that a threat will exploit a vulnerability and cause harm to an asset. It is often expressed as a function of the likelihood of an event occurring and the impact it would have. Risk management is the process of identifying, assessing, and responding to these possibilities.

Attack

An attack is a deliberate action taken by a threat actor to exploit a vulnerability in a system, process, or person. Attacks are intentional, distinguishing them from accidental threats or natural events. They may target confidentiality, integrity, or availability of an organization's assets.

Risk Avoidance

Risk avoidance is a risk response in which an organization eliminates the risk entirely by stopping the activity that creates it. For example, choosing not to collect certain types of sensitive data removes the risk associated with storing it. It is the most conservative risk response and is used when a risk is too high to accept or mitigate effectively.

Risk Transfer

Risk transfer is a risk response in which an organization shifts the financial or legal consequences of a risk to a third party. Purchasing cyber insurance is the most common example. Risk transfer does not eliminate the underlying risk — it changes who bears the cost if the risk materializes.

standard

A standard is a mandatory, specific requirement that supports a policy by defining the exact controls, technologies, or measurements that must be used. Where a policy says what must happen, a standard says how it must happen. Standards ensure consistency across the organization and are enforceable.

Baseline

A baseline is a minimum security configuration that all systems of a given type must meet. It operationalizes standards by providing a concrete starting point — a floor of security — for a specific platform or environment. Systems are then measured against the baseline to identify gaps.

Security Governance

Security governance is the set of policies, roles, and processes by which an organization directs and oversees its information security program. It ensures that security decisions align with business objectives and that accountability is established at the executive and board level. Good governance connects strategy to execution.

Copyright

Copyright is a legal protection granted automatically to the creator of an original work — such as software, writing, music, or art — giving them exclusive rights to reproduce, distribute, and display that work. It protects the expression of an idea, not the idea itself. Copyright protection typically lasts for the life of the author plus 70 years.

Disaster Recovery Plan (DRP)

A Disaster Recovery Plan (DRP) is a documented set of procedures for restoring IT systems, data, and infrastructure after a disruptive event. It is a subset of business continuity that focuses specifically on technology recovery. The DRP defines the steps, responsibilities, and timelines for getting systems back online.

Recovery Point Objective

Recovery Point Objective (RPO) is the maximum acceptable amount of data loss, measured in time, that an organization can tolerate after a disruption. It defines how far back in time the data can be restored from a backup. A shorter RPO requires more frequent backups and typically greater investment.

GDPR

The General Data Protection Regulation is a European Union law governing how organizations collect, store, and process personal data of EU residents. It grants individuals rights including access, correction, erasure, and portability, and requires organizations to implement appropriate technical and organizational safeguards. Non-compliance can result in fines of up to 4% of global annual revenue.

Threat Actor

A threat actor (also called a threat agent) is any individual, group, or automated system capable of carrying out an attack against an information asset. Threat actors are categorized by motivation, capability, and intent — common categories include nation-states, organized crime, hacktivists, insiders, and script kiddies. Understanding the threat actor profile helps organizations prioritize defenses.

AI Vendor Third-Party Risk Assessment

The due diligence process applied to AI service providers to evaluate their security posture, data handling practices, model transparency, and resilience. Unlike traditional vendor assessments, AI vendor reviews add questions about training data provenance, bias documentation, model drift monitoring, and inference result access controls.

Risk Appetite vs. Risk Tolerance

Risk appetite is the broad level of risk an organization is willing to accept in pursuit of its objectives — it reflects strategic intent. Risk tolerance is the acceptable variation around that appetite, defining specific upper and lower boundaries for risk-taking in practice. Appetite sets the direction; tolerance defines the operational limits.

Defense in Depth

Defense in depth is a security strategy that layers multiple independent controls so that if one fails, others remain in place. No single control is relied upon to protect an asset; instead, overlapping safeguards at different levels reduce overall risk. This approach reflects the idea that determined attackers may bypass any single control.

Risk Mitigation

Risk mitigation is a risk response in which an organization implements controls to reduce either the likelihood or impact of a risk. It is the most common risk response in security programs. Mitigation does not eliminate risk entirely — it reduces it to a more acceptable level.

Residual Risk

Residual risk is the risk that remains after controls have been applied to reduce a threat. No set of controls eliminates risk entirely, so some level of residual risk always exists. Management must explicitly accept residual risk for it to be properly owned and documented.

Asset Value (AV)

Asset value (AV) is the monetary worth assigned to an asset, reflecting its importance to the organization. It accounts for the cost to acquire, replace, or recreate the asset, as well as its business criticality. Asset value is the starting point for calculating potential financial losses in quantitative risk analysis.

Guideline

A guideline is a recommended — but not mandatory — practice that offers advice and flexibility for achieving security objectives. Unlike policies and standards, guidelines are optional and allow users to use judgment based on their specific circumstances. They are especially useful when rigid rules would be impractical.

Procedure

A procedure is a detailed, step-by-step document that describes exactly how a specific task or process must be performed. Procedures are the most granular level of security documentation and are mandatory when defined. They ensure that critical tasks are carried out consistently and correctly every time.

Privacy by design

Privacy by Design is a principle that calls for privacy protections to be built into systems, products, and processes from the start — not added as an afterthought. It means that data minimization, access controls, and privacy considerations are embedded into the design phase. This approach reduces risk and supports regulatory compliance proactively.

Data Controller vs Data Processor

A data controller is the entity that determines why and how personal data is collected and used — they own the purpose. A data processor is a third party that processes data on behalf of the controller, following the controller's instructions. The controller bears primary legal responsibility for compliance; the processor is bound by contract to act within defined limits.

COPPA

The Children's Online Privacy Protection Act is a US federal law restricting the collection of personal information from children under age 13 without verifiable parental consent. It applies to operators of websites and online services directed at children and to general-audience services that knowingly collect data from children. Operators must post a privacy policy, provide parental notification, and allow opt-out.

Organizational Code of Ethics

An organizational code of ethics is a formal document defining acceptable behavior, values, and conduct standards for employees. In security, it addresses acceptable use of systems, confidentiality obligations, conflict of interest rules, and reporting requirements for unethical behavior. Employees are typically required to acknowledge and sign the code as a condition of employment.

Risk Appetite

Risk appetite is the amount and type of risk an organization is broadly willing to accept in pursuit of its objectives, set at the board or executive level. It reflects the organization's overall attitude toward risk-taking and serves as the boundary within which risk management decisions are made. Risk appetite differs from risk tolerance, which describes the acceptable deviation around that threshold.

Algorithmic Bias

A systematic error in an AI or ML model's output that produces unfair or skewed results due to flawed assumptions in the training data, model design, or objective function. Mitigations include diverse and representative training datasets, regular bias audits, fairness metrics, and human-in-the-loop review for high-stakes decisions.

NIST AI RMF

A voluntary framework published by NIST in 2023 to help organisations manage risks specific to AI systems throughout their lifecycle. Structured around four functions: Govern (establish accountability), Map (identify AI context and risks), Measure (analyse and prioritise AI risks), and Manage (respond to and monitor AI risks). CISSPs use it to integrate AI risk into existing enterprise risk management programs.

Bias Documentation

Formal records describing the known limitations, demographic performance disparities, and potential bias sources in an AI model. Common formats include model cards and datasheets for datasets. In third-party AI procurement, demanding bias documentation is analogous to demanding a penetration test report — it provides evidence the vendor has assessed and disclosed known weaknesses.