CISA Questions, Answers and Explanations Database 2024 Glossary

A comprehensive set of vocabulary flashcards covering key auditing, governance, security, controls, networking, and risk management definitions directly from the CISA 2024 database.

Acceptable use policy (AUP)

A policy that establishes an agreement between users and the enterprise that defines, for all parties, the ranges of use that are approved before gaining access to a network or the Internet

Access control list (ACL)

An internal computerized table of access rules regarding the levels of computer access permitted to logon IDs and computer terminals

Access Control

The processes, rules and deployment mechanisms that control access to information systems, resources and physical access to premises

Access control table

An internal computerized table of access rules regarding the levels of computer access permitted to logon IDs and computer terminals

Access method

The technique used for selecting records in a file, one at a time, for processing, retrieval or storage. The access method is related to, but distinct from, the file organization, which determines how the records are stored.

Access rights

The permission or privileges granted to users, programs or workstations to create, change, delete or view data and files within a system, as defined by rules established by data owners and the information security policy

Administrative controls

The rules, procedures and practices dealing with operational effectiveness, efficiency and adherence to regulations and management policies

Anonymous File Transfer Protocol (AFTP)

A method of downloading public files using the File Transfer Protocol (FTP). AFTP does not require users to identify themselves before accessing files from a particular server.

Antivirus software

An application software deployed at multiple points in an IT architecture. It is designed to detect and potentially eliminate virus code before damage is done and repair or quarantine files that have already been infected.

Application controls

The policies, procedures and activities designed to provide reasonable assurance that objectives relevant to a given automated solution (application) are achieved

Application layer

Provides services for an application program to ensure that effective communication with another application program in a network is possible in the Open Systems Interconnection (OSI) communications model

Application programming interface (API)

A set of routines, protocols and tools referred to as building blocks used in business application software development

Asymmetric key (public key)

A cipher technique in which different cryptographic keys are used to encrypt and decrypt a message

Audit Plan

A plan containing the nature, timing and extent of audit procedures to be performed by engagement team members in order to obtain sufficient appropriate audit evidence to form an opinion. Scope Notes: Includes the areas to be audited, the type of work planned, the high-level objectives and scope of the work. It also includes topics such as budget, resource allocation, schedule dates, type of report and its intended audience and other general aspects of the work.

Audit Program

A step-by-step set of audit procedures and instructions that should be performed to complete an audit

Audit risk

The risk of reaching an incorrect conclusion based upon audit findings

Audit trail

A logical path linking a sequence of events, in the form of data, used to trace the transactions that have affected the contents of a record

Balanced scorecard (BSC)

A coherent set of performance measures organized into four categories that include traditional financial measures and customer, internal business process and learning and growth perspectives. Developed by Robert S. Kaplan and David P. Norton.

Benchmarking

A systematic approach to comparing enterprise performance against peers and competitors in an effort to learn the best ways of conducting business

Biometrics

A security technique that verifies an individual's identity by analyzing a unique physical attribute, such as a handprint

Black box testing

A testing approach that focuses on the functionality of the application or product and does not require knowledge of the code intervals

Brouter

A device that performs the functions of both a bridge and a router

Bus configuration

A configuration in which all devices (nodes) are linked along one communication line where transmissions are received by all attached nodes

Business case

Documentation of the rationale for making a business investment that is used both to support a business decision on whether to proceed with the investment and as an operational tool to support management of the investment through its full economic life cycle

Business continuity plan (BCP)

A plan used by an enterprise to respond to the disruption of critical business processes (depends on the contingency plan for the restoration of critical systems)

Business impact analysis (BIA)

The process of evaluating the criticality and sensitivity of information assets by determining the impact of losing the support of any resource to an enterprise. This establishes the escalation of a loss over time, identifies the minimum resources needed to recover and prioritizes the recovery of processes and the supporting system.

Business process reengineering (BPR)

The thorough analysis and significant redesign of business processes and management systems to establish a better-performing structure that is more responsive to the customer base and market conditions while yielding material cost savings

Capability Maturity Model Integration (CMMI)

An integrated model of best practices that enable businesses to improve performance by improving their processes. Product teams developed the model with global members from across the industry. The CMMI provides a best-practice framework for building, improving and sustaining process capability.

Certificate (Certification) authority (CA)

A trusted third party that serves authentication infrastructures or enterprises, registers entities and issues entities certificates

Certificate revocation list (CRL)

An instrument for checking the continued validity of the certificates for which the certification authority (CA) has responsibility

Certification practice statement (CPS)

A detailed set of rules governing the certificate authority's (CA) operations. It provides an understanding of the value and trustworthiness of certificates issued by a given CA.

Chain of custody

The process of evidence handling (from collection to presentation) that is necessary to maintain the validity and integrity of evidence

Challenge/response token

A method of user authentication carried out through use of the Challenge Handshake Authentication Protocol (CHAP)

Change management (CM)

A holistic and proactive approach to managing the transition from a current to a desired organizational state, focusing specifically on the critical human, or "soft," elements of change (ISACA)

Ciphertext

Information generated by an encryption algorithm to protect the plaintext that is unintelligible to the unauthorized reader

Circuit-switched network

A data transmission service that requires establishing a circuit-switched connection before data can be transferred from source data terminal equipment (DTE) to a sink DTE

Circular routing

In open systems architecture, the logical path of a message in a communication network based on a series of gates at the physical network layer in the open systems interconnection (OSI) model

Cloud computing

Convenient, scalable on-demand network access to a shared pool of resources that can be provisioned rapidly and released with minimal management effort or service provider interaction

Coaxial cable

A cable composed of an insulated wire that runs through the middle of each cable, a second wire that surrounds the insulation of the inner wire like a sheath and the outer insulation that wraps the second wire Scope Notes: Has a greater transmission capacity than standard twisted-pair cables but has a limited range of effective distance

Cold site

An IS backup facility that has the necessary electrical and physical components of a computer facility but does not have the computer equipment in place

Compensating control

An internal control that reduces the risk of an existing or potential control weakness resulting in errors and omissions

Completely connected (mesh) configuration

A network topology in which devices are connected with many redundant interconnections between network nodes (primarily used for backbone networks)

Compliance testing

Control tests designed to obtain evidence on both the effectiveness of the controls and their operation during the audit period

Computer-assisted audit technique (CAAT)

Any automated audit technique, such as generalized audit software (GAS), test data generators, computerized audit programs and specialized audit utilities

Computer emergency response team (CERT)

A group of people integrated at the enterprise with clear lines of reporting and responsibilities for standby support in case of an information systems emergency. This group acts as an efficient corrective control and should also be the single point of contact for all incidents and issues related to information systems.

Computer forensics

The application of the scientific method to digital media to establish factual information for judicial review

Configuration management (CM)

The control of changes to a set of configuration items over a system life cycle

Continuous auditing approach

Allows IS auditors to monitor system reliability on a continuous basis and to gather selective audit evidence through the computer

Control Practice

Key control mechanism that supports the achievement of control objectives through responsible use of resources, appropriate management of risk and alignment of IT with business

Control risk

Risk that assets are lost/compromised or that financial statements are materially misstated, due to lack of, or ineffective, design and/or implementation of internal controls

Corrective control

A control designed to correct errors, omissions, unauthorized uses and intrusions, once they are detected

Database management system (DBMS)

A software system that controls the organization, storage and retrieval of data in a database

Data custodian

Individual(s) and department(s) responsible for the storage and safeguarding of computerized data

Data owner

Individual(s) who has responsibility for the integrity, accurate reporting and use of computerized data

Decision support systems (DSS)

An interactive system that provides the user with easy access to decision models and data to support semistructured decision-making tasks

Degauss

The application of variable levels of alternating current for the purpose of demagnetizing magnetic recording media.

Detective control

Controls designed to detect and report when errors, omissions and unauthorized uses or entries occur

Digital certificate

An electronic credential that permits an entity to exchange information securely via the Internet using the public key infrastructure (PKI)

Digital signature

An electronic identification of a person or entity using a public key algorithm that serves as a way for the recipient to verify the identity of the sender, integrity of the data and proof of transaction

Disaster recovery plan (DRP)

A set of human, physical, technical and procedural resources to recover, within a defined time and cost, an activity interrupted by an emergency or disaster

Discovery sampling

A form of attribute sampling that is used to determine a specified probability of finding at least one example of an occurrence (attribute) in a population.

Discretionary access control (DAC)

Logical access control filters that may be configured or modified by the users or data owners

Domain name system (DNS) poisoning

Corrupts the table of an Internet server's DNS, replacing an Internet address with the address of a vagrant or scoundrel address

Dry-pipe fire extinguisher system

A sprinkler system that does not have water in the pipes during idle usage, unlike a fully charged fire extinguisher system that has water in the pipes at all times

Dynamic Host Configuration Protocol (DHCP)

A protocol used by networked computers (clients) to obtain IP addresses from DHCP servers, and parameters such as default gateways, subnet masks and domain name system (DNS) server IP addresses

Electronic data interchange (EDI)

The electronic transmission of transactions (information) between two enterprises. EDI promotes a more efficient paperless environment. EDI transmissions can replace the use of standard documents, including invoices or purchase orders.

Electronic funds transfer (EFT)

The exchange of money via telecommunications. EFT refers to any financial transaction that originates at a terminal and transfers a sum of money from one account to another.

Embedded audit module (EAM)

Integral part of an application system that is designed to identify and report specific transactions or other information based on pre-determined criteria. Identification of reportable items occurs as part of real-time processing. Reporting may be real-time online or may use store and forward methods. Also known as integrated test facility or continuous auditing module.

Enterprise resource planning (ERP)

A packaged business software system that allows an enterprise to automate and integrate the majority of its business processes; to share common data and practices across the entire enterprise; and to produce and access information in a real-time environment

eXtensible Markup Language (XML)

Promulgated through the World Wide Web Consortium, XML is a web-based application development technique that allows designers to create their own customized tags, thus, enabling the definition, transmission, validation and interpretation of data between applications and enterprises.

Extranet

A private network that resides on the Internet and allows a company to securely share business information with customers, suppliers or other businesses as well as to execute electronic transactions.

Fallback procedures

A plan of action or set of procedures to be performed if a system implementation, upgrade or modification does not work as intended.

False Authorization

Also called false acceptance, occurs when an unauthorized person is identified as an authorized person by the biometric system.

False enrollment

Occurs when an unauthorized person manages to enroll into the biometric system.

Fiber optic cable

Glass fibers that transmit binary signals over a telecommunications network.

File Transfer Protocol

A protocol used to transfer files over a Transmission Control Protocol/ Internet Protocol (TCP/IP) network (Internet, UNIX, etc.)

Firewall

A system or combination of systems that enforces a boundary between two or more networks, typically forming a barrier between a secure and an open environment such as the Internet

Fourth generation language (4GL)

High-level, user-friendly, nonprocedural computer language used to program and/or read and process computer files.

Frame relay

A packet-switched wide-area-network (WAN) technology that provides faster performance than older packetswitched WAN technologies.

Function point analysis (FPA)

A technique used to determine the size of a development task, based on the number of function points

Generalized audit software (GAS)

Multipurpose audit software that can be used for general processes, such as record selection, matching, recalculation and reporting

Governance

The method by which an enterprise evaluates stakeholder needs, conditions and options to determine balanced, agreed-upon enterprise objectives to be achieved. It involves setting direction through prioritization, decision making and monitoring performance and compliance against the agreed-upon direction and objectives.

Honeypot

A specially configured server, also known as a decoy server, designed to attract and monitor intruders in a manner so that their actions do not affect production systems

Hot site

A fully operational offsite data processing facility equipped with both hardware and system software to be used in the event of a disaster

Inherent risk

The level of risk or exposure that does not account for the actions management has taken or might take (e.g., implementing controls)

Integrated test facilities (ITF)

A testing methodology in which test data are processed in production systems

IT steering committee

An executive-management-level committee that assists in the delivery of the IT strategy, oversees day-to-day management of IT service delivery and IT projects, and focuses on implementation aspects.

IT strategic plan

A long-term plan (i.e., three- to five-year horizon) in which business and IT management cooperatively describe how IT resources will contribute to the enterprise's strategic objectives (goals).

Key goal indicator (KGI)

A measure that tells management, after the fact, whether an IT process has achieved its business requirements; usually expressed in terms of information criteria.

Key performance indicator (KPI)

A type of performance measurement

Leased line

A communication line permanently assigned to connect two points, as opposed to a dial-up line that is only available and open when a connection is made by dialing the target machine or network. Also known as a dedicated line.

Logical access controls

The policies, procedures, organizational structure and electronic access controls designed to restrict access to computer software and data files

Mandatory access control (MAC)

Logical access control filters used to validate access credentials that cannot be controlled or modified by normal users or data owners

Media access control (MAC)

Lower sublayer of the OSI Model Data Link layer

Network attached storage (NAS)

Utilizes dedicated storage devices that centralize storage of data.

Network interface card (NIC)

A communication card that when inserted into a computer, allows it to communicate with other computers on a network.

Operating system (OS)

A master control program that runs the computer and acts as a scheduler and traffic controller

Operational audit

An audit designed to evaluate the various internal controls, economy and efficiency of a function or department.

Paper test

A walk-through of the steps of a regular test, but without actually performing the steps. Scope Notes: Usually used in disaster recovery and contingency testing; team members review and become familiar with the plans and their specific roles and responsibilities

Patch management

An area of systems management that involves acquiring, testing and installing multiple patches (code changes) to an administered computer system to maintain up-to-date software and often to address security risk