Section 5 - Governance, Risk, and Compliance Flashcards
Control categories
- Managerial
- Operational
- Technical
Control type
- Preventive
- Detective
- Corrective
- Deterrent
- Compensating
- Physical
General Data Protection Regulation (GDPR)
Is a regulation in EU law on data protection and privacy in the EU and the European Economic Area. GDPR governs the way in which we can use, process, and store personal data (information about an identifiable, living person).
The Payment Card Industry Data Security Standard (PCI DSS)
Is a set of security standards designed to ensure that ALL companies that accept, process, store or transmit credit card information maintain a secure environment.
Center for Internet Security (CIS)
CIS Benchmarks are frameworks for calibrating a range of IT services and products to ensure the highest standards of cybersecurity and a vital part of your organizations CIS compliance objectives.
The NIST Risk Management Framework (RMF)
Provides a comprehensive, flexible, repeatable, and measurable 7-step process that any organization can use to manage information security and privacy risk for organizations and systems and links to a suite of NIST standards and guidelines to support implementation of risk management programs to meet the requirements of the Federal Information Security Modernization Act (FISMA).
NIST RMF steps
Essential activities to prepare the organization to manage security and privacy risks
Categorize the system and information processed, stored, and transmitted based on an impact analysis
Select the set of NIST SP 800-53 controls to protect the system based on risk assessment(s)
Implement the controls and document how controls are deployed
Assess to determine if the controls are in place, operating as intended, and producing the desired results
Senior official makes a risk-based decision to authorize the system (to operate)
Continuously monitor control implementation and risks to the system
National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)
Institute at the U.S. Department of Commerce. The NIST Cybersecurity Framework helps businesses of all sizes better understand, manage, and reduce their cybersecurity risk and protect their networks and data. The Framework is voluntary.
ISO 27001
Was developed to “provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an information security management system.”
The specification includes details for documentation, management responsibility, internal audits, continual improvement, and corrective and preventive action
ISO 27002
Is a collection of information security guidelines that are intended to help an organization implement, maintain, and improve its information security management
ISO/IEC 27701
Is a data privacy extension to ISO 27001. It assists organizations to establish systems to support compliance with the European Union General Data Protection Regulation (GDPR) and other data privacy requirements but as a global standard it is not GDPR specific.
ISO 31000
Is the international Standard for risk management, created by the International Organization of Standardization (ISO). It creates a framework of best-practice processes that enable an organization to manage risks, protect it from internal and external threats and improve overall crisis management.
SSAE-16 SOC 2 Type 2
Stands for Standards of Attestations Engagement No. 16, System and Organizations Controls Report 2, Type 2. This AICPA-developed auditing report assesses how well organizations handle data security, system privacy, data confidentiality and data processing processes.
Cloud Security Alliance (CSA)
Is a not-for-profit organization with the mission to “promote the use of best practices for providing security assurance within cloud computing, and to provide education on the uses of cloud computing to help secure all other forms of computing
CSA Cloud Controls Matrix (CCM)
Is a cybersecurity control framework for cloud computing. It is composed of 197 control objectives that are structured in 17 domains covering all key aspects of cloud technology. It can be used as a tool for the systematic assessment of a cloud implementation, and provides guidance on which security controls should be implemented by which actor within the cloud supply chain.
CSA Enterprise Architecture (EA)
Is both a methodology and a set of tools. It is a framework, a comprehensive approach for the architecture of a secure cloud infrastructure, and can be used to assess opportunities for improvement, create roadmaps for technology adoption, identify reusable security patterns, and assess various cloud providers and security technology vendors against a common set of capabilities.
Benchmarks/secure configuration guides
The best-practice security configuration guides for software and hardware configuration. Typically, made by the manufacturers.
Typical personnel policies
- Acceptable use policy
- Job rotation
- Mandatory vacation
- Separation of duties
- Least privilege
- Clean desk space
- Background checks
- Non-disclosure agreement (NDA)
- Social media analysis
- Onboarding
- Offboarding
- User training
Memorandum of understanding (MOU)
Is a nonbinding agreement that states each party’s intentions to take action, conduct a business transaction, or form a new partnership. This type of agreement may also be referred to as a letter of intent (LOI) or memorandum of agreement (MOA).
Measurement system analysis (MSA)
Is a thorough assessment of a measurement process, and typically includes a specially designed experiment that seeks to identify the components of variation in that measurement process.
