Chapter 4 (Flash Cards)

The process of identifying and documenting threats to critical resources.

The ability to perform job functions without having to be physically confined to one office or location

The maximum acceptable level of data loss after a disaster

A policy that specifies how an organization collects, uses, and disposes of information about individuals

Risk as it currently exists, with any current controls in place

A set of policies that establish how an organization secures its facilities and IT infrastructure.

The difference between the security controls in place and the controls needed to address all vulnerabilities

A nonprofit international organization of project managers that promotes the field of project management

An organization-wide policy defines what is allowed/disallowed regarding use of IT assets by employees

The people, information, financials, and performance goals that support business objectives

A list of identified risks that results from the risk-identification process

A defined metric for how long it must take to recover an IT system, application, and data access

A comparison of security controls in place and the controls that are needed to address all identified threats

A description of how risk is managed overall. Includes the approach, required info, and techniques to address each risk

Process of recording audit trails and events in log files when monitoring access controls IS and applications

A collection of the knowledge and best practices of the project management profession