- ISC2
- The nonprofit organization that develops and administers the CISSP certification and other information security credentials.
- CBK (Common Body of Knowledge)
- The comprehensive framework of topics and domains that define the scope of knowledge covered by the CISSP exam.
- CAT (Computerized Adaptive Testing)
- An exam delivery method where question difficulty adjusts in real time based on the test-taker's prior answers.
- Pearson VUE
- The third-party testing vendor that administers the CISSP exam at authorized test centers.
- Associate of ISC2
- A designation for candidates who pass the CISSP exam but have not yet met the full required work experience.
- CIA Triad
- The foundational security model of Confidentiality, Integrity, and Availability that guides control selection and risk assessment.
- Confidentiality
- The security property ensuring that information is accessible only to authorized individuals or systems.
- Integrity
- The security property ensuring that data remains accurate and unaltered except by authorized action.
- Availability
- The security property ensuring that systems and data are accessible to authorized users when needed.
- Non-repudiation
- A security property ensuring that a party cannot deny having performed an action, typically enforced through digital signatures and logging.
- Least Privilege
- The security principle of granting subjects only the minimum access rights necessary to perform their duties.
- Separation of Duties
- A control that splits a sensitive task among multiple people to prevent any one person from committing fraud or error undetected.
- Defense in Depth
- A security strategy that layers multiple independent controls so no single point of failure compromises the entire system.
- DAC (Discretionary Access Control)
- An access control model in which the data owner determines and assigns permissions to other users.
- MAC (Mandatory Access Control)
- An access control model where the operating system enforces access based on predefined security classifications and clearances.
- RBAC (Role-Based Access Control)
- An access control model that assigns permissions to users based on their organizational role rather than individual identity.
- SLE (Single Loss Expectancy)
- The projected monetary loss from a single instance of a risk event, calculated as asset value multiplied by exposure factor.
- ALE (Annualized Loss Expectancy)
- The expected yearly financial loss from a given risk, calculated as SLE multiplied by the annualized rate of occurrence.
- ARO (Annualized Rate of Occurrence)
- An estimate of how many times a specific risk event is expected to occur in a given year.
- SIEM (Security Information and Event Management)
- A platform that collects, correlates, and analyzes security event data across an organization to enable detection and response.
- Penetration Testing
- An authorized, simulated attack against a system used to identify and exploit vulnerabilities to assess real-world security risk.
- Data Remanence
- Residual traces of data left on storage media after deletion attempts, which can potentially be recovered by unauthorized parties.
- Threat Modeling
- A proactive process of identifying, categorizing, and prioritizing potential threats and attack vectors against a system during design.