SEC+

CIA Triad: Confidentiality

means that information can only be read by people who have been explicitly authorized to access it.

CIA Triad: Integrity

means that the data is stored and transferred as intended, and any modification is unauthorized unless explicitly authorized through proper channels.

CIA Triad: Availability

means that information is readily accessible to those authorized to view or modify it.

Non-repudiation

means that a person cannot deny doing something, such as creating, modifying, or sending a resource

Protect

procure/develop, install, operate, and decommission IT hardware and software assets with security as an embedded requirement of every stage of this operation's lifecycle.

Identify

develop security policies and capabilities. Evaluate risks, threats, and vulnerabilities and recommend security controls to mitigate them.

Detect

perform ongoing, proactive monitoring to ensure that controls are effective and capable of protecting against new types of threats.

Respond

identify, analyze, contain, and eradicate threats to systems and data security.

Recover

implement cybersecurity resilience to restore systems and data if other controls are unable to prevent attacks.

Cybersecurity Framework

A structured set of guidelines that directs the selection and configuration of controls, helping an organization assess capabilities and prioritize security investments.

Security Controls

Safeguards and countermeasures implemented to achieve specific protection outcomes and address risks across technical functions.

Gap Analysis

A process that identifies how an organization's security systems deviate from those required or recommended by an adopted framework.

Primary Outputs of a Gap Analysis Report

An overall score for each section, a detailed inventory of missing or misconfigured controls, and specific recommendations for remediation.

Triggers for Conducting a Gap Analysis

Adopting a framework for the first time, meeting new legal or industry compliance mandates, or periodically validating changes and updates.

Identification

creating an account or ID that uniquely represents the user, device, or process on the network.

Authentication

proving that a subject is who or what it claims to be when it attempts to access the resource. An authentication factor determines what sort of credential the subject can use. For example, people might be authenticated by providing a password; a computer system could be authenticated using a token such as a digital certificate.

Authorization

determining what rights subjects should have on each resource, and enforcing those rights. An authorization model determines how these rights are granted. For example, in a discretionary model, the object owner can allocate rights. In a mandatory model, rights are predetermined by system-enforced rules and cannot be changed by any user within the system.

Accounting

tracking authorized usage of a resource or use of rights by a subject and alerting when unauthorized use is detected or attempted.

Managerial

the control gives oversight of the information system. Examples could include risk identification or a tool allowing the evaluation and selection of other security controls.

Operational

the control is implemented primarily by people. For example, security guards and training programs are operational controls.

Technical

the control is implemented as a system (hardware, software, or firmware). For example, firewalls, antivirus software, and OS access control models are technical controls.

Physical

controls such as security cameras, alarms, gateways, locks, lighting, and security guards that deter and detect access to premises and hardware are often placed in a separate category from technical controls.

Preventive Control

A security control that operates before an attack to eliminate or reduce the likelihood that an attack will succeed (e.g., firewalls, ACLs, antimalware).

Detective Control

A security control that operates during an attack to identify and record an attempted or successful intrusion (e.g., system logs).

Corrective Control

A security control deployed after an attack to eliminate or reduce the impact of a security policy violation (e.g., restoring systems from backups).

Directive Control

A security control that enforces a rule of behavior or compliance, such as security policies, standard operating procedures (SOPs), and employee training.

Deterrent Control

A security control that psychologically discourages an attacker from attempting an intrusion (e.g., warning signs, posted penalties for trespassing).

Compensating Control

A substitute security measure that affords equivalent protection when a recommended principal control is not feasible (e.g., isolating an unpatchable legacy system via network segmentation).

Security Policy

A formalized statement that defines how security will be implemented within an organization to protect the confidentiality, integrity, and availability of sensitive data and resources.

Security Posture

The overall cybersecurity readiness and defense capability of an organization, established through formal security policies and framework-based controls.

Chief Information Officer (CIO)

The executive with overall responsibility for the organization's IT function, who may also have direct responsibility for cybersecurity.

Chief Technology Officer (CTO)

An executive responsible for evaluating and ensuring the effective use of new and emerging IT products and solutions to support business goals.

Chief Information Security Officer (CISO)

An executive dedicated to leading the cybersecurity department and managing internal organizational security operations.

Information Systems Security Officer (ISSO)

A technical specialist or administrator responsible for the day-to-day implementation, maintenance, and monitoring of security controls and policies.

External Responsibility for Security (Due Care/Liability)

Legal and fiduciary accountability for protecting data and assets that rests primarily with company directors or owners.

Information Security Competencies

The diverse disciplines—ranging from network and application design to procurement and human resources (HR)—required of IT security personnel to effectively safeguard an organization.

Risk Assessment and Testing

A core security activity involving evaluating vulnerabilities and threats, assessing system defenses, and recommending corrective security controls.

Secure Procurement and Configuration

A security role activity centered on specifying, sourcing, deploying, and hardening hardware devices and software assets according to security requirements.

Access Control and Privilege Management

A security responsibility involving creating, configuring, documenting, and maintaining user rights, permissions, and privilege profiles on resources.

Log Monitoring and Auditing

The ongoing activity of tracking audit logs, verifying document access controls, and reviewing user privileges to detect anomalies or policy violations.

Incident Response and Reporting

The operational duty of identifying, managing, mitigating, and documenting security-related events and breaches.

Business Continuity and Disaster Recovery (BCDR) Planning

The process of designing, maintaining, and testing recovery procedures to ensure organizational resilience and system restoration during a disruptive event.

Security Training and Education

The responsibility of conducting or participating in educational programs to reinforce security policy adherence and employee threat awareness.

security operations center (SOC)

provides resources and personnel to implement rapid incident detection and response, plus oversight of cybersecurity operations.

computer incident response team (CIRT)

computer security incident response team (CSIRT)/computer emergency response team (CERT) is a single point of contact for the notification of security incidents

Development and operations (DevOps)

encourage much more collaboration between developers and systems administrators. By creating a highly orchestrated environment, IT personnel and developers can build, test, and release software faster and more reliably.

Chief Information Officer (CIO)

Overall responsibility for the IT function lies with a Chief Information Officer (CIO). This role might also have direct responsibility for security

Chief Technology Officer (CTO)

with more specific responsibility for ensuring effective use of new and emerging IT products and solutions to achieve business goals.

CISO Chief Information Security Officer

security might be allocated to a dedicated department, run by a Chief Security Officer (CSO) or Chief Information Security Officer (CISO).

Information Systems Security Officer (ISSO).

Security might be made of a core competency of systems and network administrators, or there may be dedicated security administrators