ISC2 CISSP (Certified Information Systems Security Professional) flashcards

The systematic process of assessing the effectiveness and efficiency of security awareness, training, and education initiatives.

• Ensures programs meet their objectives and remain relevant.
• Involves tracking participation, testing comprehension, and reviewing content.
• Crucial for demonstrating due diligence and improving security posture.

Memory trick: Awareness is broad, Training is skills, Education is deep, and Evaluation keeps it all sharp.

A fully operational offsite data center that is immediately available and equipped to take over operations in the event of a disaster.

• Highest level of disaster recovery capability.
• Offers the lowest RTO and RPO.
• Most expensive disaster recovery option.

Memory trick: Hot is ready, Warm is warming, Cold is coming soon.

The obligations an organization must meet to adhere to applicable laws, regulations, standards, and internal policies.

• Includes legal, regulatory, and contractual obligations.
• Non-compliance can lead to fines, legal action, and reputational damage.
• Requires continuous monitoring and updates to stay current.

Memory trick: Governance guides us, laws define us, ethics binds us.

The system by which an organization directs and controls information security activities, ensuring they align with business objectives and risk appetite.

• Involves setting strategic direction, policies, and responsibilities.
• Ensures accountability and oversight of security efforts.
• Focuses on aligning security with overall business strategy and regulatory compliance.

Memory trick: CISO steers the ship: Strategy, Compliance, Oversight.

A formal testing process conducted to determine if the requirements of a specification or contract are met, and to verify if the system is acceptable for deployment.

• Performed by end-users or product owners.
• Often the final stage of testing before release.
• Ensures the software fulfills business needs and expectations.

Memory trick: Units built, integrated, system checked, then accepted by users.

The assurance that information is protected from unauthorized modification or destruction, and that it is accurate and complete.

• Ensures data trustworthiness and reliability.
• Often maintained through hashing, digital signatures, and access controls.
• Crucial for financial, medical, and legal data.

Memory trick: CIA: Keep secrets, always on, and true.