R-GLOSSARY

Question 1

Reciprocal agreement

Answer 1

Emergency processing agreements among two or more organizations with similar equipment or applications. Typically, participants promise to provide processing time to each other when an emergency arises.

Question 2

Recovery action

Answer 2

Execution of a response or task according to a written procedure

Question 3

Recovery point objective (RPO)

Answer 3

Determined based on the acceptable data loss in case of a disruption of operations. It indicates the earliest point in time to which it is acceptable to recover data. It effectively quantifies the permissible amount of data
loss in case of interruption.

Question 4

Recovery time objective (RTO)

Answer 4

The amount of time allowed for the recovery of a business function or resource after a disaster occurs

Question 5

Redundant Array of Inexpensive Disks (RAID)

Answer 5

Provides performance improvements and fault-tolerant capabilities, via hardware or software solutions, by writing to a series of multiple disks to improve performance and/or save large files simultaneously

Question 6

Redundant site

Answer 6

A recovery strategy involving the duplication of key information technology components, including data or other key business processes, whereby fast recovery can take place

Question 7

Request for proposal (RFP)

Answer 7

A document distributed to software vendors requesting them to submit a proposal to develop or provide a software product

Question 8

Residual risk

Answer 8

The remaining risk after management has implemented risk response

Question 9

Resilience

Answer 9

The ability of a system or network to resist failure or to recover quickly from any disruption, usually with minimal recognizable effect

Question 10

Return on investment (ROI)

Answer 10

A measure of operating performance and efficiency, computed in its simplest form by dividing net income by the total investment over the period being considered

Question 11

Return on security investment (ROSI)

Answer 11

An estimate of return on security investment based on how much will be
saved by reduced losses divided by the investment

Question 12

Risk

Answer 12

The combination of the probability of an event and its consequence.
(ISO/IEC 73). Risk has traditionally been expressed as Threat ×
Vulnerabilities = Risk.

Question 13

Risk analysis

Answer 13

The initial steps of risk management:
analyzing the value of assets to the business,
identifying threats to those assets and evaluating how vulnerable
each asset is to those threats.
It often involves an evaluation of the probable frequency of a particular event, as well as the probable impact of
that event.

Question 14

Risk appetite

Answer 14

The amount of risk, on a broad level, that an entity is willing to accept in pursuit of its mission

Question 15

Risk assessment

Answer 15

A process used to identify and evaluate risk and potential effects. Risk assessment includes assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probabilities of a particular event.

Question 16

Risk avoidance

Answer 16

The process for systematically avoiding risk, constituting one approach to managing risk

Question 17

Risk mitigation

Answer 17

The management and reduction of risk through the use of countermeasures and controls

Question 18

Risk tolerance

Answer 18

The acceptable level of variation that management is willing to allow for any particular risk while pursuing its objective

Question 19

Risk transfer

Answer 19

The process of assigning risk to another organization, usually through the purchase of an insurance policy or outsourcing the service

Question 20

Robustness

Answer 20

The ability of systems to withstand attack, operate reliably across a wide range of operational conditions and to fail gracefully outside of the operational range

Question 21

Role-based access control

Answer 21

Assigns users to job functions or titles. Each job function or title defines a specific authorization level.

Question 22

Root cause analysis

Answer 22

A process of diagnosis to establish origins of events, which can be used for learning from consequences, typically of errors and problems

Question 23

Rootkit

Answer 23

A software suite designed to aid an intruder in gaining unauthorized administrative access to a computer system