Glossary

Question 1

acceptable use policy (AUP)

Answer 1

acceptable use policy (AUP) A formal statement of policy signed by management and
acknowledged by the user with their signature. This policy typically is enforced by the
Human Resources department. The policy should state that computing resources are for
company business only and that noncompany activities, including those related to religion
or topics of questionable use, are prohibited. The AUP should state that possession of
administrative system utilities and related system tools not specifically authorized are
prohibited as contraband. This eliminates any excuses or misunderstanding and enforces
separation of duties.

Question 2

access control list (ACL)

Answer 2

access control list (ACL) A table of user login IDs specifying each user’s individual
authorized level of access to use computer resources. The access control list tells the
computer which files the user is allowed to access.

Question 3

access rights

Answer 3

access rights The level of permission granted to an individual user for the purpose of
reading data, writing data, or executing specific programs. Access does not ensure any form
of integrity or confidentiality.

Question 4

accountability

Answer 4

accountability Responsibility, liability. To be accountable is to be liable for the final
result or to be held responsible for one’s actions.

Question 5

accreditation

Answer 5

accreditation A formal approval by management based on perceived fitness of use.
Approval may be granted for a system, site location, or function. Accreditation occurs after system certification for a period of 90 days, 180 days, or one year. Systems must be
reaccredited prior to expiration of their current accreditation period.

Question 6

ACID principle

Answer 6

ACID stands for atomicity (write all or nothing), consistency (data is
restored to its original state if the write fails), isolation (each transaction is independent),
and durability (completed data is retained in the database).

Question 7

activation criteria

Answer 7

Conditions that, when met, dictate the activation of disaster recovery
or business continuity plans. Any delay or failure to activate indicates negligence. Typically,
the criteria are based on impact, anticipated duration of outage, or immediate lack of
sufficient information to calculate the actual impact. It’s always better to overreact when
compared to the consequences of an inadequate response.