Resources

Organization-wide approach to identifying, assessing, and managing risks that could affect strategic objectives.

Plans and procedures to maintain critical operations during and after disruptions, disasters, or emergencies.

Strategies and processes for restoring IT systems, data, and infrastructure after a disruptive event.

Assessment that identifies critical business functions, dependencies, and the potential impact of disruptions.

Executive responsible for establishing and maintaining the enterprise information security program.

Systematic process of identifying threats, vulnerabilities, and the likelihood and impact of potential security events.

Measurable metrics that provide early warning signals of increasing risk exposure across the organization.

Metrics that measure the effectiveness and performance of security controls over time.

Process where business units evaluate their own control effectiveness and risk exposure against defined criteria.

Assessment and ongoing monitoring of security risks introduced by vendors, suppliers, and external partners.

Formal evaluation of an organization's controls, processes, and compliance by an independent party.

Internal evaluation method where control owners assess the design and operating effectiveness of their controls.

Documented remediation plan that tracks identified weaknesses, corrective actions, resources, and target completion dates.

Automated, ongoing assessment of control effectiveness to detect deviations and maintain compliance between audits.

Software that centralizes governance, risk, and compliance activities including policy management, risk registers, and audit tracking.

Voluntary framework of standards, guidelines, and best practices for managing cybersecurity risk. Organized around six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.

Comprehensive catalog of security and privacy controls for federal information systems. Used as the control baseline for FedRAMP, FISMA, and many private-sector programs.

NIST's structured approach for integrating security and risk management into the system development life cycle. Required for federal agencies under FISMA.

AICPA framework for evaluating service organizations across five trust service criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

International standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) within an organization.

Guidelines for information security risk management, supporting the requirements of ISO 27001. Provides a systematic approach to risk identification, analysis, and treatment.

DoD certification framework with three maturity levels for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the defense supply chain.

Government-wide program providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.

ISACA's framework for governance and management of enterprise IT. Provides a comprehensive set of controls and best practices for aligning IT with business objectives.

Federal law establishing national standards for protecting sensitive patient health information from disclosure without consent or knowledge.

European Union regulation governing the collection, processing, and storage of personal data. Applies to any organization handling EU residents' data regardless of location.

Industry standard for organizations that handle credit card data. Defines requirements for secure network architecture, access controls, vulnerability management, and monitoring.

Federal law mandating internal controls and audit procedures for financial reporting. IT General Controls (ITGCs) are a critical component of SOX compliance programs.

California Consumer Privacy Act and its amendment (CPRA) granting consumers rights over their personal data including the right to know, delete, opt-out of sale, and non-discrimination.

Federal law requiring agencies to develop, document, and implement information security programs. Provides the legislative mandate behind NIST's security standards and guidelines.