Asset Security

17 terms

AccountabilityISC2 · D2

Accountability ensures that account management has assurance that only authorized users are accessing the system and using it properly.

AssetISC2 · D2

Anything of value that is owned by an organization. Assets include both tangible items such as information systems and physical property and intangible assets such as intellectual property.

Asset LifecycleISC2 · D2

The phases that an asset goes through from creation (collection) to destruction.

BaselineISC2 · D2

A documented, lowest level of security configuration allowed by a standard or organization.

CategorizationISC2 · D2

The process of grouping sets of data, information or knowledge that have comparable sensitivities (impact or loss ratings), and have similar security needs mandated by law, contracts or other compliance regimes.

ClassificationISC2 · D2

The process of recognizing the impacts to the organization if its information suffers any security compromise—to its confidentiality-, integrity-, availability-, non-repudiation-, authenticity-, privacy- or safety-related characteristics. Classifications are derived from the compliance mandates the organization must operate within, whether these be law, regulation, contract-specified standards or other business expectations.

ClearingISC2 · D2

The removal of sensitive data from storage devices in such a way that there is assurance the data may not be reconstructed using normal system functions or software recovery utilities.

Data Custodian, CustodianISC2 · D2

The individual who manages permissions and access on a day-to-day basis based on instructions from the data owner. Responsible for protecting an asset that has value, while in the custodian's possession.

Defensible DestructionISC2 · D2

Eliminating data using a controlled, legally defensible and regulatory compliant way.

InventoryISC2 · D2

Complete list of items.

PurgingISC2 · D2

The removal of sensitive data from a system or storage device with the intent that the data cannot be reconstructed by any known technique.

QualitativeISC2 · D2

Measuring something without using numbers, using adjectives, scales or grades.

QuantitativeISC2 · D2

Using numbers to measure something, usually monetary values.

RecoveryISC2 · D2

The process of jointly addressing business resiliency and restoration of critical infrastructure and functionality after a disruption.

ResponsibilityISC2 · D2

Obligation for doing something. Can be delegated.

ScopingISC2 · D2

Limiting the general baseline recommendations by removing those that do not apply.

TailoringISC2 · D2

The process by which a security control baseline is modified based on (i) the application of scoping guidance, (ii) the specification of compensating security controls, if needed and (iii) the specification of organization-defined parameters in the security controls via explicit assignment and selection statements.