The process of identifying, assessing, and prioritizing risks to minimize their impact on business operations.

Formal documents that outline an organization's security expectations, procedures, and responsibilities.

A structured approach to addressing and managing the aftermath of a cybersecurity incident.

Strategies and processes that ensure critical business functions continue during and after a disruption.

Structured guidelines that help organizations manage and reduce cybersecurity risks.

The process of evaluating potential risks that could negatively impact an organization.

Identifying and prioritizing potential threats to a system or business to enhance security.

A systematic review of security weaknesses in an information system.

The National Institute of Standards and Technology, which provides a framework for improving cybersecurity.

An international standard for managing information security risks.

Plans and actions taken to reduce the severity or likelihood of risks.

A visual tool used to assess and prioritize risks based on their likelihood and impact.

Involving individuals or groups who have an interest in the security framework's outcome.

Adhering to laws, regulations, and standards related to cybersecurity.

Plans developed to restore business operations after a cybersecurity incident.

Programs designed to educate employees about security policies and procedures.

Actions taken to prevent security incidents before they occur.

A discussion-based simulation where team members discuss their roles during a hypothetical incident.

Safeguards or countermeasures to protect information systems.

An incident where unauthorized access to sensitive data occurs.

The process of aligning security policies with established cybersecurity frameworks.

A detailed guide on how to manage and respond to security incidents.

Assessment of the potential effects of a disruption on business operations.

Processes for collecting input on security policies to facilitate continuous improvement.

Training employees in multiple roles to enhance organizational resilience.

Any attempted or actual breach of an organization's information systems.