Operationally critical threat and vulnerability evaluation

1. A process by which frequency and magnitude of IT risk scenarios are estimated. 2. The initial steps of risk management: analyzing the value of assets to the business - identifying threats to those assets and evaluating how vulnerable each asset is

Committee of sponsoring organizations

A phase of a system development life cycle (SDLC) methodology that researches the feasibility and adequacy of resources for the development or acquisition of a system solution to a user need

An aptitude - competency or resource that an enterprise may possess or require at an enterprise - business function or individual level that has the potential - or is required - to contribute to a business outcome and to create value

The set of shared values and beliefs that governs attitudes toward risk-taking - care and integrity - and determines how openly risk and losses are reported and discussed

The individual(s) and department(s) responsible for the storage and safeguarding of computerized data

Risk management framework