CIS – Risk and Compliance flashcards

Governance, Risk, Compliance

How much risk we'll take to hit goals

Acceptable variance from risk appetite

Control = action to manage risk

Meeting external regs, internal policies

Structured approach to identify, assess, respond to risk

Something's not right

What a control aims to achieve

Proof a control is working

Planned review of controls

Metric showing increasing risk exposure

Metric showing how well objectives are met

Law, regulation, standard

Automated checks for control performance

Person responsible for a control's effectiveness

Get the requirements right

Talk to the business

Start small

Minimum Viable Product

Who cares?

Old data into new system

Where does this talk to other systems?

Prove it works

What needs GRC?

Template for similar entities

High-level grouping

Parent-child relationships

For unique things

From CMDB

CI data becomes entity data

Data fields

Target specific entities for assessments, policies

Which risks apply to which entities

Which controls apply to which entities

Which policies apply to which entities

Another name for Entity Type

Another name for Entity Class

If this fails, what else breaks?

Map dependencies between entities

Who's accountable for this entity

How important is this entity

Per entity

What regulations apply to this entity

Active, Inactive, Draft

From creation to retirement

Parent entity controls apply to children

Parent entity risks apply to children

Automate assignment of controls, policies to entities

Based on entity attributes

Child entity risks aggregate to parent

Child entity control compliance aggregates to parent

UI to define entity attributes and relationships

Verify entity data accuracy

Keywords for grouping, searching entities

What to include, what to exclude

Direct selection of entities

Rules-based selection

Categorizing entities based on type, criticality, function

Collection of profiles/entities

Fallback if no specific type assigned

Pre-configured settings for new entities

What needs GRC?

Template for similar entities

High-level grouping

Parent-child relationships

For unique things

From CMDB

CI data becomes entity data

Data fields

Target specific entities for assessments, policies

Which risks apply to which entities

Which controls apply to which entities

Which policies apply to which entities

Another name for Entity Type

Another name for Entity Class

If this fails, what else breaks?

Map dependencies between entities

Who's accountable for this entity

How important is this entity

Per entity

What regulations apply to this entity

Active, Inactive, Draft

From creation to retirement

Parent entity controls apply to children

Parent entity risks apply to children

Automate assignment of controls, policies to entities

Based on entity attributes

Child entity risks aggregate to parent

Child entity control compliance aggregates to parent

UI to define entity attributes and relationships

Verify entity data accuracy

Keywords for grouping, searching entities

What to include, what to exclude

Direct selection of entities

Rules-based selection

Categorizing entities based on type, criticality, function

Collection of profiles/entities

Fallback if no specific type assigned

Pre-configured settings for new entities

What needs GRC?

Template for similar entities

High-level grouping

Parent-child relationships

For unique things

From CMDB

CI data becomes entity data

Data fields

Target specific entities for assessments, policies

Which risks apply to which entities

Which controls apply to which entities

Which policies apply to which entities

Another name for Entity Type

Another name for Entity Class

If this fails, what else breaks?

Map dependencies between entities

Who's accountable for this entity

How important is this entity

Per entity

What regulations apply to this entity

Active, Inactive, Draft

From creation to retirement

Parent entity controls apply to children

Parent entity risks apply to children

Automate assignment of controls, policies to entities

Based on entity attributes

Child entity risks aggregate to parent

Child entity control compliance aggregates to parent

UI to define entity attributes and relationships

Verify entity data accuracy

Keywords for grouping, searching entities

What to include, what to exclude

Direct selection of entities

Rules-based selection

Categorizing entities based on type, criticality, function

Collection of profiles/entities

Fallback if no specific type assigned

Centralized view

Automate control testing

Data points

Scripted checks

Human verification

Pre-defined checks

Created from failed indicators

Plan, fieldwork, report, respond

Manage engagements

Define scope, objectives, resources

Gather evidence

Identified issues

Summary of findings, recommendations

Management actions