IT & Security Risk Management Terminology Guide

Assets

List of systems, databases, applications, products, and any physical locations. Identifying assets supported by a rich attribute library to detail both qualitative and quantitative insights will help you discover where data is stored, accessed, and protected and will help uncover and calculate risk exposure.

Category

The associated category that the risk is assigned to. Example categories include:

• Financial

• Geographic

• Operational

• Regulatory/Compliance

• Security

For more information, see Adding and Managing Risk Categories and Categorizing Risks.

Control

The requirements used by process owners to insure organizational adherence to the policies, standards, and frameworks. Controls are used to define requirements which are put into place to avoid risks, errors, or to define measures that will take place if an error or risk is found.

Control Implementations

Mechanisms put in place by an organization to ensure that its operations adhere to applicable laws, regulations, standards, and internal policies. These controls are designed to mitigate risks, prevent violations, and promote ethical conduct within the organization.

Date Closed

The date in which the risk treatment status was approved, and the risk record closed.

Date Created

The date in which the risk record was created.

Deadline

The deadline in which the risk must be resolved.

Entities

List to identify legal entities, separate business units or other organization groups with structured information about the parties involved with your organization and its data. Legal entity records can be used with assets, processing activities, and vendors to create a full view of your organization's processes and relationships.

Framework

A series of formal policies and guidelines that define best practices and methodologies for effectively managing adherence to domain specific objectives, such as privacy or security. Frameworks outline a set of requirements an organization can choose to follow. The requirements can be strict or flexible, but offer guidelines for organizations who are looking to improve their GRC program.

For more information, see Supported Control Frameworks.

Inherent Risk Impact Level

The impact that a risk would have on an organization if it occurred without controls to mitigate.

Inherent Risk Probability Level

The probability of the risk occurring if there were no controls in place.

Inherent Risk Score

The overall risk score without considering existing controls.

Privacy Controls

The administrative, technical, and physical safeguards employed within an organization to protect and ensure the proper handling of personally identifiable information or to prevent activities that create privacy risks. For example, the NIST Framework Controls listed below:

Processing Activities

List of all of the operations related to processing data including sensitive, personal, confidential or proprietary information, to better understand data-as-an-asset. Identifying processing activities helps you discover what data your organization is collecting, from who, and for what purpose. Understanding the context for processing and different types of data involved allows you to classify data according to sensitivity and ensure the necessary controls are in place to demonstrate accountability with regulators, customers, employees, auditors and other third-party partners.

Residual Risk Impact Level

The impact a risk would have on an organization if it occurred with the current controls that are implemented.

Residual Risk Probability Level

The probability of the risk occurring with the current controls that are implemented.

Residual Risk Score

The overall risk score after considering existing controls.

Result

The action taken on the risk. Actions include:

• Accepted

• Avoided

• Ignored

• Reduced

• Rejected

• Transferred

Risk

The probability of exposure, loss of critical assets and sensitive information or reputational harm as a result of a cyber-attack or breach within an organization. This does not only apply for attacks and breaches, but also for accidental or unlawful destruction, disclosure, modification, or loss of data. Examples include:

• Phishing Attack

• Ransomware

• DDoS Attack

• Lack of Security Measures

For more information, see Assessing Risks.

Risk Appetite

The level of risk your organization is willing to accept.

Risk Management

The strategies, policies, and controls used to reduce the damage caused by certain risks and incidents.

Risk Scale

A universal way of quantifying a risk. For example, a risk matrix.

For more information, see Setting Up Risk Scoring.

Security Controls

The safeguards or countermeasures that help to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. The controls should protect the CIA of an organization's information. Controls are specific measures put in place to help provide security. Examples include:

• Identity and Access Management

• Data Loss Prevention

• Encryption and Pseudonymization

• Incident Management Plan

• Third-Party Risk Management

• Policy Management

• Multi-Factor Authentication

Standard

A series of strict requirements that is often defined by the organization. Standards are generally accepted as a direct requirement, offering no flexibility. Organizational standards are created and used to ensure all controls are operated in the way that supports the needs of the organization.

Target Risk Impact Level

The desired impact that a risk would have on an organization if it occurred.

Target Risk Probability Level

The desired probability of the risk occurring.

Target Risk Score

The desired risk score.

Threat

An incident that has the potential to cause harm or expose vulnerabilities.

For more information, see Threat Library Management.

Treatment Plan

A plan that includes completing specific tasks, assigning a risk owner, and adding controls to mitigate the risk.

Treatment

The process by which the risk owner actively mitigates the risk.

Vendors

List of all of the partners and suppliers, including IT and SaaS-based solutions, hardware, and other service providers that you contract. The goal of the vendor inventory is to understand what IT security and risk coverage may be outsourced, which organizations may have access to data, and understand how the risks associated with these parties may impact your data and organization.

Vulnerability

A known weakness that would allow attacks if not contained.