Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CISM 1.0 - ISACA > CISM Vocabulary > Flashcards

CISM Vocabulary Flashcards

1
Q

Administrative controls

A

policies, processes, procedures, standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Annualized Loss Expectancy

A

ALE = SLExARO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

architecture standard

A

defines technology architecture at the database, system, or network level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

assessment

A

an examination that determines the effectiveness of a system or process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

asset value

A

the value of an IT asset - usually but not always the Replacement Value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Asynchronous Replication

A

writing to data in a remote system is not synchronized with the local system.

No guarantee that remote system is identical to local system

Might be a time lag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Attestation of compliance

A

assertion of compliance to a law, standard or requirement

Typically signed by high ranking official

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

authentication

A

asserting an identity and providing proof of it

typically requires an ID (assertion) and a password (proof)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

business email compromise

ceo fraud

A

perpetrator impersonates a CEO and gets company personnel to transfer large amounts of money, typically for a “secret merger” or “acquisition”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Business Impact Analysis

A

Study to identify the impact that different disaster scenarios will have on business operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Business Recovery Plan

A

activities required to recover and resume critical business processes and activities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

capability maturity model

A

measures relative maturity of an organization and its processes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

capability maturity model for Development

CMMi-DEV

A

maturity model used to measure software development process maturity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

certification practicer statement (CPS)

A

describes practices used by the CA to issue and manage digital certificates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Change Control Board
aka
Change Advisory Board

A

stakeholders from IT and Business who propose, discuss, approve changes to the IT systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

CIS Controls

A

framework maintained by the Center for Internet Security (CIS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

COBIT

A

published by ISACA

control framework for managing information systems and security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

COSO

A

Committee of Sponsoring Organizations of the Treadway Commission

Organization providing control frameworks and guidance on enterprise risk management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

COOP

A

Continuity of Operations Plan

activities required to continue critical and strategic business functions at alternate site

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Control

A

Policy, Process or Procedure created to ensure desired outcomes or to avoid unwanted outcomes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Control Framework

A

Collection of controls organized in logical categories

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Covered Entity

A

any organization that stores or processes information covered by HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Critical Path Methodology (CPM)

A

Technique used to identify the most critical path in a project to understand which tasks are most likely to affect the project schedule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Criticality Analysis (CA)

A

Study of each system and process, a consideration of the impact on the organization if it’s incapacitated, the likelihood of incapacitation and the estimated cost of mitigating the impact (risk)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Digital envelope
method of using two layers of encryption symmetric key is used to encrypt a message and a public or private key is used to encrypt the symmetric key
26
Disaster
unexpected and unplanned event that results in the disruption of business operations
27
Dwell Time
amount of time from the start of an incident to the organization's awareness of the incident
28
e-vaulting
backing up information to an off-site location, usually a 3rd-party service provider
29
Exposure Factor
financial loss resulting from realization of a threat. expressed as a percentage of the asset's total value
30
Facilities Classification
methods for assigning risk levels to facilities based based on their operational criticality or other risk factors
31
fiduciary
person who has a legal trust relationship with another party
32
fiduciary duty
highest standard of care that a fiduciary renders to a beneficiary
33
File Activity Monitoring (FAM)
monitoring the use of files on a computer as a way to detect indicators of compromise
34
File Integrity Monitoring (FIM)
periodically scanning file systems to detect changes to file contents or permissions that may indicate compromise
35
HITRUST
healthcare control framework and certification servers as external attestation of an organization's IT controls
36
Hybrid cryptography
cryptosystem that uses two or more iterations of cryptography
37
Impact
actual or expected result from a threat or disaster
38
incident
any event not part of standard operation of a service and that causes or may cause interruption or reduction in quality of service
39
Information Risk
business risk associated with use, ownership, operation, involvement, influence and adoption of information in an enterprise
40
ISMS | Information Security Management System
ISO/IEC 27001 - activities for managing information security in an organization
41
inherent risk
the risk that there are material weaknesses in existing business processes and no compensating controls to detect or prevent them
42
integrated audit
financial and operational audit
43
intrusion kill chain
intrusion model developed by Lockheed Martin ``` Phases are: reconnaissance weaponization delivery exploitation installation command and control actions on objective ```
44
ISAE 3402 | International Standard on Assurance Engagement
external audit of a service provider performed according to rules from International Auditing and Assurance Standards Board
45
ISO/IEC 20000
standard for IT service management (ITSM)
46
ISO/IEC 27001
standard for IT security management
47
ISO/IEC 27002
standard for IT security controls
48
ITIL
standard for IT service management
49
Key Performance Indicator (KPI)
Measure of business process' performance and quality Used to reveal trends related to efficiency and effectiveness of key processes in the organization
50
Key Risk Indicator (KRI)
measure of information risk used to reveal trends related to levels of risk of security incidents in the organization
51
Maximum Tolerable Downtime (MTD)
Amount of time after a disaster, after which, an organization's survival is at risk
52
Maximum Tolerable Outage (MTO)
Maximum period of time that an organization can tolerate operating in recovery mode
53
North American Reliability Corporation (NERC)
maintains resilience and security controls for use by public utitilities
54
North American Reliability Corporation Infrastructure Protection (NERC CIP)
Standards and Requirements defined by NERC to protect power plants and grids
55
Operationally Critical Threat Asset and Vulnerability Evaluation (OCTAVE)
Qualitative risk analysis methodology from Carnegie Mellon
56
orchestration
in context of SIEM, it is the scripted automated response when specific events occur
57
PCI-DSS
Security standard to protect credit card numbers in storage, processing and transmission. Developed by consortium of credit card companies
58
Policy
Specifies what must be done or not done in an organization Defines who is responsible for monitoring and enforcing policy
59
Population
Complete set of entities, transactions or events that are the subject of an audit
60
Process
collection of procedures that perform a business function
61
Responsible, Accountable, Consulted, Informed (RACI) Chart
Tool to assign roles to people and groups according to their responsibilities
62
Recovery Capacity Objective (RCapO)
Processing and/or Storage capacity of an alternate system as compared to the normal system. Usually expressed as a percentage compared to the primary processing site
63
Recovery Capacity Objection (RCO)
Measure of the consistency and integrity of processing at a recovery site, compared to the primary site. Calculated as 1 - (number of inconsistent objects) / (number of objects)
64
Recovery Consistency Objective (RCO)
Measure of the consistency and integrity of processing at a recovery site, compared to the primary site. Calculated as 1 - (number of inconsistent objects) / (number of objects)
65
Recovery Point Objective (RPO)
Period of acceptable data loss from an incident. Usually measured in hours or days
66
Recovery Time Objective (RTO)
Time from the onset of an outage until the resumption of service. Usually measured in hours or days
67
Reperformance
audit technique where an IS auditor repeats actual tasks done by auditees in order to confirm they were performed correctly
68
Replication (aka Synchronous replication)
activity where data written to a storage system is also copied to another storage system. Result is the presence of up-to-date data on two or more storage systems, each of which could be in different locations
69
Residual Risk
risk that remains after being reduced through other risk treatments
70
Response Document
Required action of personnel after a disaster strikes. Includes business recovery plan, occupant emergency plan, emergency communication plan, contact lists, disaster recovery plan, continuity of operations plan, security incident response plan
71
Risk
event scenario that can result in property damage or disruption
72
Risk Appetite (Risk Tolerance)
level of risk an organization is willing to accept to pursue its mission and before action is needed to treat the risk
73
Risk Capacity
Objective amount of loss an organization can tolerate without its existence being called into question
74
Risk Treatments
mitigate avoid transfer accept
75
Roadmap
steps needed to achieve strategic objective
76
Sample
portion of a population that's selected for auditing
77
Sample Mean
sum of all samples divided by number of samples
78
Sample Standard Deviation
measures the spread of values in the sample Computation of the variance of sample values from the sample mean
79
Sarbanes Oxley
law requiring public corporations to enact controls, perform internal and external audits
80
SAS 70 | Statement of Accounting Standards No. 70
external audit of a service provider
81
Security Incident
event where the confidentiality, integrity or availability of information has been compromised
82
Service Delivery Objective (SDO)
level of service needed after an event, compared to normal business operations
83
Single Loss Expectancy (SLE)
financial loss when a threat is realized SLE = AV x EF
84
Snapshot
a continuous auditing technique Uses special audit modules embedded in online applications, that sample specific transactions
85
Standard
defines technologies, protocols, suppliers, methods used by an IT organization
86
Statements on Standards for Attestation Engagements No. 16 (SSAE 16)
Audit standard superseded by SSAE 18
87
Statements on Standards for Attestation Engagements No. 18 (SSAE 18)
Audit standard for financial service provider audits Performed by AICPA (American Institute of CPAs)
88
System and Organization Controls 1 (SOC1)
External audit of a service provider SOC1 audit is performed according to the SSAE 18 standard
89
System and Organization Controls 2 (SOC2)
External audit of a service provider on one or more of the following trust principles: ``` security availability processing integrity confidentiality privacy ``` SOC 2 audits performed according to audit standards from the AICPA
90
System and Organization Controls 3 (SOC3)
external audit of a service provider like SOC 2
91
Stratified Sampling
sampling technique where population is divided into classes (strata) based on the value of one of the attributes Samples selected from each class (strata)
92
The Open Group Architecture Framework (TOGAF)
lifecycle architecture framework used for the design, plan, implementation and governance of a security architecture
93
Threat modeling
activity of looking for potential threats in a business process, information system or application
94
Zachman Framework
architecture framework used to describe IT architecture in increasing levels of details
95
Procedure
Written sequence of instructions to perform a task

CISM 1.0 - ISACA (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions