Security Program Management and Oversight

Vocabulary study flashcards for CompTIA Security+ SY0-701 Domain 5, covering security governance, risk management, third-party risk, compliance, privacy, audits, and security awareness.

Governance

Defines how security decisions are made, who is accountable, how risk is managed, and how security supports business objectives.

Policy

High-level mandatory direction explaining what must be done and why.

Standard

Specific mandatory requirements that support a policy.

Procedure

Step-by-step instructions for performing a task.

Guideline

Recommended practices or advice that allow judgment or flexibility.

Baseline

Minimum approved configuration or security level used as a consistent starting point.

Security program

Coordinated people, processes, and technology used to manage security risks and meet organizational objectives.

Data owner

The role responsible for classifying data and approving access.

Data custodian

The role responsible for implementing protections and handling data storage and maintenance.

Separation of duties

Splitting sensitive tasks among multiple people so that one person cannot complete an entire high-risk process alone.

Dual control

A security mechanism requiring two people to authorize or perform a sensitive action.

Least privilege

A principle that gives users only the access needed for their role.

Need to know

A principle that limits access to information strictly required for a specific task.

Single Loss Expectancy (SLE)

A quantitative estimate calculated as asset value ($AV$) multiplied by exposure factor ($EF$): $SLE = AV \times EF$.

Annual Loss Expectancy (ALE)

A quantitative estimate calculated as single loss expectancy ($SLE$) multiplied by the annual rate of occurrence ($ARO$): $ALE = SLE \times ARO$.

Qualitative risk analysis

An analysis method that uses categories or rankings such as low, medium, and high to evaluate risk.

Quantitative risk analysis

An analysis method that uses numeric estimates, often monetary values and probabilities, to evaluate risk.

Risk register

A living record of risks, causes, likelihood, impact, rating, owner, response, controls, due dates, status, and residual risk.

Risk appetite

The overall amount and type of risk that leadership or an organization is willing to pursue or retain to achieve objectives.

Risk tolerance

The specific acceptable limit, threshold, or variation for a specific risk or objective.

Inherent risk

The level of risk that exists before controls are considered.

Residual risk

The risk remaining after controls and risk treatment have been applied.

Risk avoidance

A risk management strategy that involves stopping the activity that creates the risk.

Risk mitigation

A risk management strategy aimed at reducing likelihood and/or impact.

Risk transfer/share

A risk management strategy that shifts or shares some financial or contractual impact (e.g., insurance or contractual allocation).

Risk acceptance

Knowingly retaining a risk with proper approval from an authorized risk owner.

Business Impact Analysis (BIA)

Identifies critical processes, dependencies, and the effects of disruption over time to inform recovery priorities and continuity plans.

Recovery Time Objective (RTO)

The target maximum time permitted to restore a process or service (how quickly service must be restored).

Recovery Point Objective (RPO)

The target maximum acceptable amount of data loss, measured in time.

Security questionnaire

An artifact capturing a vendor's reported security practices, used during due diligence to verify material claims.

Service-Level Agreement (SLA)

A document defining measurable service expectations and service levels, such as availability or response times.

Statement of Work (SOW)

A document defining project scope, deliverables, work, and responsibilities.

Non-Disclosure Agreement (NDA)

A legal contract that establishes confidentiality obligations.

Data Processing Agreement (DPA)

An agreement specifying personal-data processing obligations and roles where personal data is processed by a processor on behalf of a controller.

Right to audit

A contractual provision allowing a customer to inspect or obtain evidence of a vendor's controls.

Rules of engagement

A document defining authorized test scope, timing, methods, contacts, prohibited actions, escalation paths, and stop conditions.

Compliance

Meeting applicable laws, regulations, contractual requirements, and adopted standards or policies.

Privacy

Appropriate handling, collection, use, sharing, retention, and deletion of personal information.

Data minimization

A privacy principle requiring organizations to collect and retain only what is necessary.

Retention limitation

A privacy principle requiring organizations to keep information only as long as justified or legally required.

Attestation

A formal assertion by a responsible party stating that specified information, controls, or conditions meet defined criteria.

Audit

A systematic review of evidence to determine whether controls, processes, or records meet defined criteria.

Internal audit

An audit performed by or for the organization to evaluate controls and processes from within, with suitable objectivity.

External audit

An independent review conducted by an outside party against defined criteria.

Vulnerability assessment

A security activity focused on finding and prioritizing likely weaknesses.

Penetration test

Authorized adversarial testing to safely test whether weaknesses can be exploited and determine what impact follows.

Black-box testing

Testing conducted with little to no internal knowledge of the target system.

White-box testing

Testing conducted with extensive internal knowledge of the target system.

Gray-box testing

Testing conducted with partial internal knowledge of the target system.

Security awareness

An educational program that teaches users to recognize common security risks and know how to report them.

Security training

Educational instruction that develops role-specific skills and security behaviors.