Encyclopedia
IT & GRC Encyclopedia
What each concept, method, document and standard means, how it works and how to apply it, with the official sources behind each answer.
Complete guidesRisk management
- What Is a Risk Register?A risk register is the running list of what could hurt a company: who answers for each risk, how serious it is, what is being done about it and how far that work has got.
- Risk Matrix ExplainedA risk matrix is a grid crossing likelihood with impact. It lets a company compare very different risks on one scale and decide which to handle first.
- Risk Assessment MethodologyA risk assessment methodology is the fixed way a company finds, analyses and evaluates its risks, so that two people assessing the same thing reach comparable results.
- Risk Treatment PlanA risk treatment plan says what will happen to each risk the company is not willing to leave as it stands: which option, which actions, who does them, by when, and what result to expect.
- Risk OwnershipA risk owner is the person accountable for a given risk, with the authority to decide its treatment, pay for it and accept whatever remains.
- ISO 27001 Risk AssessmentISO/IEC 27001 requires a defined process for assessing information security risks (clause 6.1.2), run at planned intervals (clause 8.2), which identifies risks and their owners, analyses them and evaluates them against set criteria.
- Asset InventoryAn asset inventory is the up-to-date list of the information, systems, devices and services a company depends on, each with an owner. You cannot protect what you do not know you have.
Compliance
- GDPR Risk AssessmentA GDPR risk assessment looks at the risks a processing activity creates for people's rights and freedoms. Where that risk is likely to be high, Article 35 requires a data protection impact assessment, or DPIA.
- What Is Compliance Management?Compliance management is the ongoing work of knowing which obligations apply to a company, meeting them, proving it, and correcting whatever falls short.
- Compliance Questionnaire GuideA compliance questionnaire is a structured set of questions showing where a company stands against a law, standard or contract, and where it falls short.
- Internal Controls ExplainedAn internal control is a measure that gives reasonable assurance a company will reach its objectives despite its risks: a required approval, a separation of duties, a review, a technical restriction.
- What Is ISO 27001?ISO/IEC 27001 is the international standard for an information security management system: the way a company governs, assesses and improves the security of its information.
- Statement of ApplicabilityThe Statement of Applicability is the mandatory ISO/IEC 27001 document stating which controls a company needs, why, whether they are implemented, and why any Annex A control is left out.
- What Is NIS2?NIS2 is the EU directive (2022/2555) setting cybersecurity obligations for medium and large entities in critical sectors: risk management measures, incident reporting and the accountability of management.
- NIS2 ChecklistA NIS2 checklist follows the directive's own structure: scope, the duties of the management body (Article 20), the ten measures of Article 21(2) and the reporting deadlines (Article 23).
- What Is GDPR?The General Data Protection Regulation (EU) 2016/679 sets the rules for using personal data in the European Union. It has applied since 25 May 2018.
- Compliance MonitoringCompliance monitoring is the regular checking, by those responsible, that obligations are still being met and controls are still working, so that problems surface before the audit does.
Business continuity
- What Is Business Continuity?Business continuity is a company's ability to keep delivering its most important products and services at an acceptable level during a disruption, whatever caused it.
- What Is Disaster Recovery?Disaster recovery is the set of plans and technical means that bring IT systems and data back after a serious disruption, within the times the business has agreed.
- Business Continuity vs Disaster RecoveryBusiness continuity keeps the business operating during a disruption, and disaster recovery restores the IT it depends on. Recovery is one part of continuity.
- Business Impact AnalysisA business impact analysis, or BIA, works out what happens over time if each activity stops, and uses that to set its priority and recovery targets.
- RTO ExplainedThe recovery time objective, or RTO, is the time within which an activity or system must be back after a disruption, before the consequences become unacceptable.
- RPO ExplainedThe recovery point objective, or RPO, is the most recent data a company can afford to lose, expressed as a length of time before the incident.
Audit
- Internal Audit GuideAn internal audit is an independent, planned and documented check of whether a company's practices meet its requirements and work as intended.
- Audit ChecklistAn audit checklist is the auditor's working document. For each criterion, it says what to look at, who to ask and what to sample, and it records what was found.
- Audit FindingsAn audit finding compares evidence with a criterion. It states what should be happening, what was seen, why it matters and why it happened.
- Network Audit ChecklistA network audit checklist verifies that a network is known, segmented, up to date, monitored and accessible only to those who should reach it, with evidence for each line.
Third-party risk
- Vendor Risk AssessmentA vendor risk assessment works out what could go wrong through a specific supplier, how well that supplier is prepared, and whether the remaining risk is acceptable.
- Third-Party Risk ManagementThird-party risk management is the programme that controls the risks of relying on suppliers and partners, from selecting them to ending the relationship.
- Security QuestionnairesA security questionnaire is the list of questions a buyer sends a supplier to check its security practices. Answering them well has become part of selling.