C

Question 1

Capability Maturity Model Integration (CMMI)

Answer 1

An integrated model of best practices that enable businesses to improve performance by improving their processes. Product teams developed the model with global members from across industry. The CMMI provides
a best-practice framework for building, improving, and sustaining process capability.

Question 2

Certificate (Certification) authority (CA)

Answer 2

A trusted third party that serves authentication infrastructures or enterprises and registers entities and issues them certificates

Question 3

Certificate revocation list (CRL)

Answer 3

An instrument for checking the continued validity of the certificates for which the certification authority (CA) has responsibility

Question 4

Certification practice statement (CPS)

Answer 4

A detailed set of rules governing the certificate authority’s operations. It provides an understanding of the value and trustworthiness of certificates issued by a given certificate authority (CA).

Question 5

Chain of custody

Answer 5

The process of evidence handling from collection to presentation that is necessary to maintain the validity and integrity of evidence

Question 6

Challenge/response token

Answer 6

A method of user authentication that is carried out through use of the Challenge Handshake Authentication Protocol (CHAP).

Question 7

Change management

Answer 7

A methodical approach for controlling and implementing changes in a planned and structured manner (CMMI)

Question 8

Change management

Answer 8

A holistic and proactive approach to managing the transition from a current to a desired organizational state, focusing specifically on the critical human or “soft” elements of change (ISACA)

Question 9

Checksum

Answer 9

A checksum value is generated by an algorithm and associated with an input value and/or whole input file. The checksum value can be used to assess its corresponding input data or file later and verify that the input has not
been maliciously altered. If a subsequent checksum value no longer matches the initial value, the input may have been altered or corrupted.

Question 10

Chief information officer (CIO)

Answer 10

The most senior official of the enterprise who is accountable for IT advocacy, aligning IT and business strategies, and planning, resourcing and managing the delivery of IT services, information and the deployment of associated human resources

Question 11

Chief information security officer (CISO)

Answer 11

The person in charge of information security within the enterprise

Question 12

Chief security officer (CSO)

Answer 12

The person usually responsible for all physical and digital security matters in an enterprise

Question 13

Chief technology officer (CTO)

Answer 13

The individual who focuses on technical issues in an enterprise.

Question 14

COBIT

Answer 14

A broad and comprehensive I&T governance and management framework and continues to establish itself as a generally accepted framework for I&T governance. Formerly known as Control Objectives for Information and related Technology.

Question 15

Compensating control

Answer 15

An internal control that reduces the risk of an existing or potential control weakness resulting in errors and omissions.

Question 16

Computer forensics

Answer 16

The application of the scientific method to digital media to establish factual information for judicial review

Question 17

Confidentiality

Answer 17

Preserving authorized restrictions on access and disclosure, including means for protecting privacy and proprietary information

Question 18

Content filtering

Answer 18

Controlling access to a network by analyzing the contents of the incoming and outgoing packets and either letting them pass or denying them based on a list of rules.

Question 19

Contingency plan

Answer 19

A plan used by an enterprise or business unit to respond to a specific systems failure or disruption.

Question 20

Contingency planning

Answer 20

Process of developing advance arrangements and procedures that enable an enterprise to respond to an event that could occur by chance or unforeseen circumstances.

Question 21

Continuous monitoring

Answer 21

The process implemented to maintain a current security status for one or more information systems or for the entire suite of information systems on which the operational mission of the enterprise depends.

Question 22

Control center

Answer 22

Hosts the recovery meetings where disaster recovery operations are managed

Question 23

Control

Answer 23

The means of managing risk, including policies, procedures, guidelines, practices or organizational structures, which can be of an administrative, technical, management or legal nature

Question 24

Corporate governance

Answer 24

The system by which enterprises are directed and controlled. The board of directors is responsible for the governance of their enterprise. It consists of the leadership and organizational structures and processes that
ensure the enterprise sustains and extends strategies and objectives.

Question 25

COSO

Answer 25

Committee of Sponsoring Organizations of the Treadway Commission

Question 26

Cost-benefit analysis

Answer 26

An analysis that relies on the addition of positive factors and the subtraction of negative factors to determine a net result, and is a method used to build a business case to support a risk response.

Question 27

Countermeasure

Answer 27

Any process that directly reduces a threat or vulnerability

Question 28

Criticality analysis

Answer 28

An analysis to evaluate resources or business functions to identify their importance to the enterprise, and the impact if a function cannot be completed or a resource is not available.

Question 29

Criticality

Answer 29

The importance of a particular asset or function to the enterprise, and the impact if that asset or function is not available

Question 30

Cryptography

Answer 30

The study of mathematical techniques related to aspects of information security, such as confidentiality, data integrity, entity authentication and data origin authentication

Question 31

Cyclical redundancy check (CRC)

Answer 31

A method to ensure that data have not been altered after being sent through a communication channel