5. Program Management Flashcards
5.1 AUP
Acceptable Use Policy
5.1 SDLC
Software Development Lifecycle
5.1 Data Owner
responsible for classification, protection, and quality
5.1 Data Steward
Subject matter expert for data, including its meaning and correct usage
5.1 Data Custodian
responsible for the technical environment, including database structure. Implement security controls
5.1 Data Subject
Person whose data is being processed or stored
5.2 Risk Assessment Types
Ad hoc (RA completed for a specific situation or application)
Recurring
One-Time
Continuous
5.2 SLE
Single Loss Expectancy
5.2 ALE
Annualized Loss Expectancy (How much will a threat cost you over a year?)
5.2 ARO
Annualized Rate of Occurrence (projected number of times an incident will happen in a year)
5.2 Risk Register
Document used to identify and track risks
5.2 Risk Register Components
Risk Indicators: measureable variables that determine likelihood of a risk
Risk Owners: Person responsible for mitigating a certain risk
Risk Threshold: area determined by which risks are acceptable and which are addressed
5.2 Risk Appetite (and kinds of appetite)
How much risk is an organization willing to accept to achieve its goals.
Expansion: Organization wants to expand, thus increasing the attack surface area
Conservative: Organization is focused on mitigating all risks and conserving capital rather than taking business risks
Neutral: Balanced approach. Organization only accepts risks that are essential to a predetermined strategic goal.
5.2 Components of Business Impact Analysis
RTO
RPO
MTTR
MTBF
5.2 RTO
Recovery Time Objective
acceptable amount of time for a service to be unavailable before too much damage is done
5.2 RPO
Recovery Point Objective
maximum amount of data loss that an organization can tolerate
5.2 MTTR and MTBF
Mean Time to Repair
Mean Time Between Failures
5.3 SLA
Service Level Agreemenet
Defines what services to be provided and expected performance
5.3 MOA
Memorandum of Agreement
outlines terms and details of an agreement between parties
5.3 MOU
Memorandum of Understanding
Less formal version of MOA that may not have legal implications. Used to express mutual agreement between parties.
5.3 MSA
Master Service Agreement
determines terms and conditions that govern future transactions and agreements. Framework for the entire relationship, long-term document
5.3 SOW or WO
Statement of Work Order. Outlines work to be performed for a specific project.
5.3 BPA
Business Process Agreement, focuses on overall client experience and satisfaction
5.3 Security Attestation
Document that declares the existence of something, such as compliance or proof of secure status
