Your FREE CISA Flashcards 2026 – 250+ Cards

Confidentiality, Integrity, Availability — the three core goals of information security and assurance.

An independent, systematic examination of information systems and controls to provide assurance over CIA and compliance.

ISACA's Information Technology Assurance Framework — the standards, guidelines, and tools for IS audit and assurance work.

Mandatory requirements in ITAF that every IS auditor must follow (vs. guidelines, which are recommended).

Recommended best-practice guidance in ITAF — helpful but not mandatory, unlike standards.

Allocating limited audit resources to the areas of greatest risk and business impact to the organization.

The complete inventory of auditable areas/entities from which the risk-based audit plan is built.

A document, approved by senior management/the board, that defines the audit function's authority, scope, and responsibility.

Freedom from conditions that threaten objectivity; the auditor must be impartial in fact and appearance.

An unbiased mental attitude that lets the auditor perform work and form conclusions without compromise.

Applying the diligence and skill a prudent, competent auditor would exercise in the same situation.

The threshold at which a finding is significant enough to influence decisions or require reporting.

The risk an auditor reaches a wrong conclusion; a function of inherent, control, and detection risk.

The risk that exists before any controls are considered, due to the nature of the activity.

The risk that a material error is not prevented or detected by the internal control system.

The risk that the auditor's procedures fail to detect a material error; the part the auditor controls.

A policy, procedure, or mechanism that reduces risk by preventing, detecting, or correcting an event.

A control that stops an incident before it occurs (e.g., access controls, segregation of duties, firewalls).

A control that identifies an incident after it occurs (e.g., audit logs, monitoring, reconciliations).

A control that restores systems and fixes the cause after an incident (e.g., backups, incident response).

An alternative control used when the ideal (primary) control cannot feasibly be implemented.

A control that discourages a threat actor from acting (e.g., warning banners, visible cameras).

Testing whether a control is operating as designed (e.g., are change requests approved before deployment?).

Testing the integrity of data or results themselves (e.g., recomputing values, confirming balances).

Sufficient, reliable, and relevant information that supports the auditor's findings and conclusions.

Computer-Assisted Audit Techniques — software/analytics used to test large data populations directly.

CAAT tools that read, extract, sort, and analyze data files independent of the audited application.

A CAAT that processes fictitious test transactions through the live system to verify processing controls.

A CAAT technique that runs known input through a program to confirm it produces the expected output.

Performing audit procedures automatically and frequently, often in near real time, on transactions.

Management's ongoing, automated oversight of controls and performance (a management activity, not audit).

Selecting a sample using probability so results can be projected to the population with measurable confidence.

Sample selection based on auditor judgment; results cannot be statistically projected to the population.

Sampling that estimates the rate of occurrence of a condition (e.g., % of items missing approval).

Sampling that estimates a numeric value or total (e.g., the dollar value of an account).

The risk that the sample is not representative and leads the auditor to a wrong conclusion.

Process owners assess the adequacy of their own controls; supplements, never replaces, independent audit.

A documented condition where a control is missing, inadequate, or not operating, with its risk and cause.

Confirming that management acted on agreed recommendations and that the risk was actually reduced.

The auditor's objective communication of scope, findings, risk, and recommendations to management/the committee.

An irregularity is intentional deception (fraud); an illegal act violates laws/regulations — both must be reported.

A high but not absolute level of assurance — controls reduce risk to an acceptable level, not to zero.

An agreement defining the objectives, scope, responsibilities, and deliverables of a specific audit engagement.

A board subcommittee that oversees the audit function, financial reporting, and internal controls.

Management owns/controls risk (1st line); risk & compliance oversee (2nd); internal audit assures (3rd).

A sampling approach that lets the auditor stop early once enough evidence supports a low error rate.

An auditor independently executing a control or calculation to verify it produces the correct result.

Tracing a transaction end to end through a process to confirm the auditor understands the controls.

Controls can't give absolute assurance due to human error, collusion, and management override.

Two or more people cooperating to bypass segregation of duties and conceal fraud.

Senior management bypassing controls — a key reason controls give only reasonable, not absolute, assurance.

A chronological record of system activity that lets an auditor reconstruct and verify events.

Code built into an application that continuously captures audit data on selected transactions.

A CAAT that captures the state of data before and after processing to verify a transaction's path.

Identifying and analyzing risks to determine likelihood and impact, prioritizing audit and control effort.

The boundaries of an engagement — what systems, processes, and time period the audit will cover.

A questioning mindset that critically assesses evidence rather than assuming management's honesty.

The evidence-gathering phase of an audit, where tests of controls and substantive tests are performed.

ISACA's framework for the governance and management of enterprise IT, separating governance from management.

The board/senior management's responsibility to set IT direction, define risk appetite, and monitor value.

Planning, building, running, and monitoring IT day to day — execution, distinct from governance.

COBIT governance objectives: Evaluate, Direct, and Monitor — the board's governance role.

The plan that aligns IT investments and capabilities with the organization's business objectives.

A senior cross-functional group that prioritizes IT investments and aligns IT with business needs.

A blueprint of business processes, data, applications, and technology and how they fit together.

A high-level statement of management intent and goals; mandatory direction for the organization.

A specific, mandatory requirement that supports a policy (e.g., 'use AES-256 for data at rest').

Detailed, step-by-step instructions for performing a task in line with policy and standards.

Recommended, discretionary best practice — the only document type that is not mandatory.

A defined minimum level of security or configuration that systems must meet.

Splitting a sensitive task so no one person can both perform and conceal an error or fraud.

A responsibility matrix: who is Responsible, Accountable, Consulted, and Informed for each activity.

Accountable = ultimately answerable (one person); responsible = does the work (one or more people).

The organization-wide process to identify, assess, treat, and monitor risk against the risk appetite.

The amount and type of risk an organization is willing to accept in pursuit of its objectives.

The acceptable variation around the risk appetite for a specific objective or activity.

The risk that remains after controls are applied; senior management formally accepts it.

Reducing risk to an acceptable level by implementing controls.

Shifting the financial impact of a risk to a third party, such as via insurance.

Eliminating a risk by ceasing the activity that creates it.

A documented, management-approved decision to tolerate a risk and its potential impact.

A scale (e.g., 0–5) used to assess and improve how capable and consistent a process is.

A metric that measures how well an activity achieves its objective (e.g., uptime, project on-time rate).

A metric that signals rising exposure to a risk before it materializes.

A performance tool linking objectives across financial, customer, internal, and learning perspectives.

Managing the set of IT investments to maximize value and align with strategy.

Confirming that an IT investment actually delivered the value promised in its business case.

Contracting a third party to perform an IT function; the organization retains accountability for risk.

Overseeing outsourced/cloud providers via contracts, SLAs, right-to-audit clauses, and monitoring.

A contract term allowing the customer (or its auditors) to audit a service provider's controls.

The framework of roles, policies, and standards ensuring data is accurate, available, and controlled.

The senior business manager accountable for data who sets its classification and protection requirements.

The party (usually IT) responsible for implementing and maintaining controls protecting data day to day.

Embedding privacy protections into systems and processes from the outset, not as an add-on.

Adhering to applicable laws, regulations, and industry standards (e.g., GDPR, SOX, PCI DSS).

The Payment Card Industry Data Security Standard governing the handling of cardholder data.

A situation where a person's private interest could improperly influence their professional duties.

A documented set of processes ensuring IT services and products consistently meet requirements.

Aligning IT resource investment with forecast business demand to deliver value efficiently.

Ensuring IT plans, investments, and operations directly support business goals.

The ethical climate set by leadership, which strongly shapes the organization's control environment.

The overall attitude, awareness, and actions regarding controls — the foundation of internal control.

A framework defining internal control over five components, widely used for governance and SOX compliance.

The Sarbanes-Oxley Act — U.S. law requiring management/auditors to assess internal control over financial reporting.

The EU General Data Protection Regulation governing the processing and protection of personal data.

Under privacy law, the entity that decides why and how personal data is processed.

A party that processes personal data on behalf of, and on the instructions of, the controller.

Assessing and monitoring the risk introduced by third-party suppliers and service providers.

Overseeing cloud services for security, compliance, cost, and the shared-responsibility model.

Cloud security split between provider (of the cloud) and customer (in the cloud).

A metric that shows whether an IT process achieved its business goal (outcome-focused).

Aligning IT performance to business value across multiple perspectives, not just cost.

System Development Lifecycle — feasibility, requirements, design, build, test, implement, and review.

An early analysis of whether a proposed system is technically, operationally, and economically viable.

The justification for a project — costs, benefits, risks, and alignment with strategy.

Capturing what the system must do (functional) and how well (non-functional) before design.

A sequential SDLC where each phase completes before the next; suits stable, well-understood requirements.

An iterative SDLC delivering working software in short sprints; suits changing requirements and fast feedback.

Building an early working model to refine unclear requirements before full development.

Integrating development and operations to deliver and run software faster and more reliably.

A method to estimate software size/effort from the functionality delivered to the user.

Planning, executing, and controlling a project's scope, schedule, cost, quality, and risk.

Project Management Office — the function that governs and supports project delivery and standards.

Scheduling technique identifying the longest sequence of dependent tasks that sets the minimum duration.

A bar chart showing project tasks against a timeline, used to plan and track schedule.

Uncontrolled growth of project scope without corresponding adjustments to time, cost, or resources.

Testing individual components or modules in isolation to confirm each works correctly.

Testing that combined components work together as expected.

Testing the complete, integrated system against its requirements.

Testing by end users to confirm the system meets business requirements before go-live.

Re-testing after a change to confirm existing functionality still works.

Running old and new systems together until the new one is proven — safest, but most costly.

Rolling out a new system in stages (by module, site, or function) to limit risk.

Deploying a new system to one group/location first before a wider rollout.

Switching the old system off and the new one on at once (big-bang) — cheapest but riskiest.

Migrating data from the old system to the new one — must be complete, accurate, and reconciled.

An after-stabilization evaluation of whether a system met its objectives, benefits, and controls.

Controlling and tracking versions of code, documents, and components throughout development.

Managing approved changes to requirements, design, or code during a project.

Depositing source code with a third party so the customer can access it if the vendor fails.

Process-focused activities that build quality into development (vs. QC, which inspects the product).

Product-focused inspection and testing to detect defects in the deliverable.

A connection allowing two systems to exchange data; a key control and audit point during integration.

A system that helps managers analyze data and make semi-structured decisions.

Enterprise Resource Planning — an integrated suite managing core business processes on shared data.

The detailed plan and checklist for switching from the old system to the new one, including fallback.

A documented way to revert to the prior system or state if an implementation fails.

Controls within an application over input, processing, and output of transactions.

Application controls ensuring data entered is accurate, complete, and authorized (e.g., edit checks).

An input control that verifies data meets defined rules (range, format, completeness) before processing.

Controls ensuring processed results are accurate, complete, and distributed only to authorized recipients.

Formal management/user approval that a system is ready to move into production.

Designing software around reusable objects that bundle data and behavior.

A fast, iterative methodology using prototyping and user feedback to speed delivery.

An iterative SDLC that performs heavy risk analysis at each cycle before proceeding.

Linking each requirement to its design, build, and test so nothing is missed or unverified.

A document defining test scope, approach, cases, data, and pass/fail criteria.

Testing functionality against requirements without knowledge of internal code.

Testing based on knowledge of internal code structure and logic.

Examining source code to find defects and security flaws (static analysis or peer review).

Tools that control and track access to and movement of program source and object code.

The conditions a deliverable must meet for users to accept it as complete and correct.

Recovery Time Objective — the target time to restore a system after disruption; must be less than the MTD.

Recovery Point Objective — the maximum acceptable data loss measured backward in time; drives backup frequency.

Maximum Tolerable Downtime — the longest a process can be unavailable before unacceptable harm.

Identifies critical processes and sets recovery objectives (MTD, RTO, RPO); the heart of resilience planning.

A plan to keep critical business functions operating during and after a disruption.

The IT-focused plan to restore systems, data, and infrastructure; it supports the broader BCP.

A fully equipped recovery site with near-real-time data, ready for near-immediate failover (costliest).

A recovery site with hardware and connectivity but needing data restored and configuration (moderate).

A recovery site with power and cooling only (empty space) — cheapest, slowest to bring online.

A mutual-aid arrangement where two organizations agree to host each other in a disaster (rarely reliable).

A fully redundant site kept in sync with production for the fastest possible failover.

A backup of all selected data — fastest to restore (one set), slowest/largest to create.

Backs up data changed since the last backup of any type — fast backup, slow restore (full + all increments).

Backs up data changed since the last full backup — slower backup, faster restore (full + one differential).

A backup rotation scheme keeping daily (son), weekly (father), and monthly (grandfather) copies.

Transmitting backup data to an offsite location to reduce data loss and speed recovery.

The controlled process to request, approve, test, document, and deploy changes to production.

An urgent change that follows an expedited path but still requires after-the-fact review and documentation.

Maintaining an accurate baseline of what hardware and software is in production and controlling changes.

A discrete, tracked component (hardware, software, service) recorded in the configuration baseline.

Acquiring, testing, and applying software updates that fix vulnerabilities and defects.

Planning, scheduling, and controlling the build, test, and deployment of releases into production.

Detecting, responding to, recovering from, and learning from disruptions and service incidents.

Finding and eliminating the root cause of recurring incidents to prevent recurrence.

A documented agreement defining service targets (e.g., uptime) and how they are measured.

An internal agreement between IT teams that supports delivery of an external-facing SLA.

Ensuring IT resources meet current and forecast demand, using trend analysis.

Ensuring services meet agreed availability targets, measured by metrics like MTBF and MTTR.

Mean Time Between Failures — the average operating time between failures; higher is more reliable.

Mean Time To Repair — the average time to restore a failed component; lower is better.

Automating and sequencing batch jobs so they run, complete, and are monitored for failure.

User-built tools (spreadsheets, small apps) — a common, under-controlled operational risk.

The single point of contact that logs, triages, and routes user incidents and requests.

Software that stores, retrieves, and controls access to data with integrity and concurrency controls.

Organizing data to reduce redundancy and improve integrity by structuring tables and relationships.

A database control ensuring relationships between tables stay valid (no orphaned foreign keys).

Redundant Array of Independent Disks — combines drives for fault tolerance and/or performance.

A system's ability to keep operating despite the failure of a component (e.g., redundancy).

Designing systems to minimize downtime, often via clustering, redundancy, and failover.

Validating a plan: checklist, structured walk-through (tabletop), simulation, parallel, full interruption.

A discussion-based test where the team walks through the plan against a scenario, no systems affected.

Bringing up recovery systems alongside production to verify they work, without stopping production.

Shutting down production and running on recovery systems — the most realistic and riskiest test.

The chosen approach (sites, backups, redundancy) that meets the RTO and RPO set by the BIA.

A component whose failure would stop the whole system; eliminated through redundancy.

A control total computed over a field to detect data loss or alteration in processing or transfer.

A recovery feature that saves processing state so a long job can resume after failure.

A high-speed network providing block-level shared storage to servers.

File-level shared storage attached to a network for multiple clients.

Offsite backup to a cloud provider, improving resilience and offsite copy management.

The group that leads response and decision-making during a major disruption.

A pre-defined contact chain for rapidly notifying staff during an incident or disaster.

Ensuring IT services can be restored within agreed timeframes after a disruption.

Validating patches in a non-production environment before deploying to production.

A defined utilization level that triggers action before performance degrades.

Granting users and processes only the minimum access needed to do their job, and nothing more.

Proving a claimed identity with a credential — something you know, have, or are.

Determining what an authenticated identity is permitted to access and do.

A subject claiming an identity (e.g., a username) — the first step of access control.

Tying actions back to a specific identity through logging and monitoring.

Using two or more factors from different categories — something you know, have, and are.

An authentication factor based on knowledge — password, PIN, or passphrase.

An authentication factor based on possession — token, smart card, or phone.

An authentication factor based on a biometric — fingerprint, iris, or face.

Restricting access to the specific information required to perform a task, even within a clearance level.

Periodic review of user access rights to catch privilege creep and remove unneeded access.

Access decided by the data owner (e.g., file permissions, access control lists).

Access enforced by the system from labels and clearances; rigid and high-security.

Access granted by job role rather than the individual; scales well in enterprises.

Access decided by attributes and policy (user, resource, time, location); the most granular.

One authentication that grants access to multiple systems (e.g., via Kerberos or SAML).

Controls that secure, monitor, and limit the use of high-privilege accounts.

Encryption using one shared secret key for both encryption and decryption (e.g., AES); fast.

Encryption using a public/private key pair (e.g., RSA, ECC); solves key exchange and enables signatures.

A one-way function producing a fixed-length digest used to verify integrity (e.g., SHA-256); not reversible.

A hash of a message encrypted with the sender's private key — integrity, authenticity, non-repudiation.

The certificate authorities, certificates, and policies that manage public keys and trust.

A trusted entity that issues and signs digital certificates binding identities to public keys.

Assurance that a party cannot deny having performed an action, via digital signatures and logging.

Encrypt with the RECIPIENT's public key — only their private key can decrypt.

Sign with YOUR private key — anyone can verify with your public key.

Layering multiple, overlapping controls so that if one fails, others still protect the asset.

A network control that permits or blocks traffic between networks based on a defined ruleset.

A control that detects and alerts on malicious or anomalous network/host activity.

A control that detects and actively blocks malicious traffic in line.

Dividing a network into zones (VLANs/subnets) to limit the spread of an attack.

A buffer network segment between the internet and the internal network that hosts public-facing services.

A Virtual Private Network — an encrypted tunnel that protects data in transit over an untrusted network.

Transport Layer Security — encrypts application traffic in transit (e.g., HTTPS).

A protocol suite that secures IP traffic at the network layer, commonly used for VPN tunnels.

Labeling data by sensitivity so the right level of protection is applied throughout its lifecycle.

Controls that detect and block unauthorized movement or exfiltration of sensitive data.

Stored data — protected with full-disk or database encryption.

Moving data — protected with TLS, IPsec, or VPNs.

Residual data left on media after deletion or formatting that may still be recoverable.

Removing data via clearing, purging, or destruction so it cannot be recovered (NIST SP 800-88).

Security Information and Event Management — aggregates and correlates logs for detection and analysis.

An automated check that identifies known weaknesses without exploiting them.

An authorized, simulated attack that actively exploits weaknesses to demonstrate real impact.

Manipulating people into revealing information or granting access (e.g., phishing, pretexting).

A social-engineering attack using fraudulent messages to steal credentials or deliver malware.

Malicious software (viruses, worms, ransomware, trojans) designed to harm or exploit systems.

Documentation showing who handled evidence and when, preserving its integrity for legal use.

Prepare, detect & analyze, contain, eradicate, recover, and conduct post-incident review.

Limiting the spread and damage of a security incident before eradication and recovery.

Controls protecting facilities and equipment (badges, locks, mantraps, guards, cameras).

Protection against environmental threats — HVAC, fire suppression, UPS, and water detection.

Educating users to recognize and resist threats — a key administrative control.

A decoy system that lures attackers to detect, study, and divert malicious activity.

A symmetric-key SSO protocol using tickets and a Key Distribution Center (KDC).

An XML standard for exchanging authentication and authorization data for web SSO and federation.

An authorization framework that lets apps access resources on a user's behalf without sharing credentials.

FAR — the rate at which a biometric system wrongly accepts an unauthorized user.

FRR — the rate at which a biometric system wrongly rejects an authorized user.

The point where a biometric's FAR equals its FRR; lower CER means a more accurate system.

A physical access control with two interlocking doors that allows one person through at a time.

A security model that trusts no user or device by default and verifies every access request.

Replacing sensitive data with a non-sensitive token, keeping the real data in a secure vault.

Controls (anti-malware, EDR, hardening) that secure end-user devices and servers.

An event that actually or potentially compromises the confidentiality, integrity, or availability of an asset.

The disciplined collection and examination of digital evidence to investigate an incident.