Glossary terms starting with R

Terms

RACI MatrixGovernance

A responsibility assignment matrix that defines roles as Responsible, Accountable, Consulted, or Informed for each task or deliverable. RACI matrices clarify ownership and prevent gaps or overlaps in responsibilities.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

RBAC (Role-Based Access Control)Information Security

An access control model where permissions are assigned to roles rather than individual users. Users are then assigned to roles based on their job functions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

RPO (Recovery Point Objective)Risk Management

The maximum acceptable amount of data loss measured in time. An RPO of 4 hours means the organisation can tolerate losing up to 4 hours of data.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, NIST SP 800-53 Rev 5

RTO (Recovery Time Objective)Risk Management

The maximum acceptable time to restore a system or process after a disruption. An RTO of 2 hours means the system must be back online within 2 hours.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Railway CybersecurityInformation Security

Security standards for protecting railway systems, signaling infrastructure, and passenger information systems from cyber threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

RansomwareInformation Security

Malicious software that encrypts a victim's files or systems and demands payment (ransom) for the decryption key. Ransomware has become one of the most financially damaging forms of cyber attack affecting organisations worldwide.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Ransomware PreparednessInformation Security

Organizational readiness to prevent, detect, respond to, and recover from ransomware attacks through planning, controls, and exercises.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Ransomware RecoveryInformation Security

The processes and procedures for restoring systems and data following a ransomware attack, including backup restoration, system rebuilding, and root cause analysis.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Re-identification RiskPrivacy and Data Protection

The possibility that anonymized or pseudonymized data could be linked back to specific individuals through additional data or techniques.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Readiness AssessmentCompliance

A preliminary evaluation of an organisation's preparedness for a formal compliance audit or certification. Readiness assessments identify gaps between current practices and target framework requirements before the formal audit.Used in: ISO 27001:2022

Real Estate ComplianceCompliance and Regulatory

Regulations governing real estate transactions and property management including fair housing, disclosure requirements, and anti-money laundering.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Reasonable AssuranceAudit and Assurance

A high but not absolute level of assurance that the subject matter is free from material misstatement, the standard for financial and compliance audits.Used in: ISO 27001:2022, PCI DSS v4.0

Recertification AuditAudit and Assurance

A comprehensive audit conducted at the end of a certification cycle to renew an organization's certification for another period.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

ReconnaissanceInformation Security

The initial phase of a cyberattack where threat actors gather information about target systems, networks, and organizations to plan their attack strategy.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Record KeepingPrivacy and Data Protection

The systematic creation, maintenance, and disposal of records documenting data processing activities as required by privacy regulations.Used in: GDPR, ISO 27001:2022

Records ManagementGovernance

The systematic control of records throughout their lifecycle from creation through maintenance, use, and disposition according to retention policies.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Records of Processing ActivitiesPrivacy and Data Protection

Documentation maintained by data controllers and processors listing all categories of data processing activities, purposes, data types, and safeguards.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Records of Processing Activities (ROPA)Privacy

Documentation required under GDPR Article 30 that describes the personal data processing activities carried out by an organisation. ROPAs must include purposes, data categories, recipients, transfers, retention periods, and security measures.Used in: GDPR, ISO 27001:2022

Recovery CapabilityBusiness Continuity

An organization's ability to restore operations within defined timeframes using available resources, plans, and procedures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Recovery ExerciseBusiness Continuity

A planned test of recovery procedures to verify that systems and data can be restored within defined timeframes and objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Recovery Point ObjectiveBusiness Continuity

The maximum acceptable amount of data loss measured in time, determining how frequently data backups or replication must occur.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, NIST SP 800-53 Rev 5

Recovery PriorityBusiness Continuity

The ranking of business functions and systems based on their criticality, determining the order in which they should be restored after a disruption.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Recovery StrategyBusiness Continuity

The selected approach for recovering critical business functions and IT systems after a disruption, based on recovery time and cost analysis.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Recovery TestingBusiness Continuity

The verification that backup data and disaster recovery procedures can successfully restore systems and data within defined timeframes.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Recovery Time ObjectiveBusiness Continuity

The maximum acceptable duration for restoring a business function or IT system after a disruption before unacceptable consequences occur.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Rectification RightPrivacy and Data Protection

The right of individuals to have inaccurate personal data corrected and incomplete data completed by the data controller.Used in: GDPR, ISO 27001:2022

Red TeamInformation Security

A group of security professionals authorised to simulate real-world attacks against an organisation to test its defences. Red team exercises are more comprehensive than penetration tests and evaluate people, processes, and technology holistically.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Red Team AssessmentInformation Security

A comprehensive, goal-oriented security engagement that simulates real-world attacks to test an organization's detection and response capabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

RedactionPrivacy and Data Protection

The process of removing or obscuring sensitive personal information from documents or datasets before sharing or publication.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

RedundancyInformation Security

The duplication of critical components or functions of a system with the intention of increasing reliability. In security, redundancy ensures that the failure of one component does not result in a complete system failure.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8

Regional Privacy RegulationPrivacy and Data Protection

Data protection laws specific to a geographic region that impose requirements on organizations processing personal data of residents in that region.Used in: GDPR, ISO 27001:2022

Regulatory AuditCompliance and Regulatory

An examination conducted by or on behalf of a regulatory body to verify compliance with applicable laws, regulations, and industry standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory BodyCompliance and Regulatory

A government or independent authority responsible for creating, implementing, and enforcing regulations within a specific industry or jurisdiction.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory ChangeCompliance and Regulatory

A modification to existing regulations or introduction of new regulations that may affect an organization's compliance obligations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory Change ManagementCompliance and Regulatory

Processes for monitoring, assessing, and implementing changes to regulations and compliance requirements that affect an organization.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Regulatory ComplianceCompliance

The process of adhering to laws and regulations relevant to an organisation's operations. Non-compliance can result in fines, legal action, and reputational damage.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Regulatory Compliance AuditAudit and Assurance

An examination specifically focused on verifying adherence to applicable laws, regulations, and regulatory standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Regulatory Compliance ManagementCompliance and Regulatory

The systematic approach to identifying, implementing, monitoring, and reporting on compliance with all applicable regulations.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Regulatory FilingCompliance and Regulatory

The submission of required documents, reports, and disclosures to regulatory authorities within prescribed deadlines and formats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory FrameworkCompliance and Regulatory

The system of rules and guidelines established by regulatory bodies that organizations must follow in their operations and practices.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory Impact AssessmentCompliance and Regulatory

An analysis of the potential effects of proposed regulations on businesses, individuals, and the economy before they are enacted.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory InvestigationPrivacy and Data Protection

A formal inquiry by a data protection authority into an organization's data processing practices following a complaint, breach, or routine oversight.Used in: GDPR, ISO 27001:2022

Regulatory LandscapeCompliance and Regulatory

The overall environment of laws, regulations, and standards that affect an organization's operations, varying by industry and jurisdiction.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory PenaltyCompliance and Regulatory

A financial or operational sanction imposed by a regulatory body on an organization for failing to comply with applicable requirements.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Regulatory ReportingCompliance and Regulatory

The process of preparing and submitting mandated reports to regulatory authorities demonstrating compliance and providing required disclosures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory RiskCompliance and Regulatory

The potential impact on an organization from changes in laws and regulations that could affect its operations, profitability, or market position.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory SandboxCompliance and Regulatory

A framework established by regulators that allows businesses to test innovative products, services, or business models in a controlled environment with reduced regulatory requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Regulatory TechnologyCompliance and Regulatory

Technology solutions (RegTech) that help organizations efficiently comply with regulations through automation, data analytics, and real-time monitoring.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Release ManagementGovernance

The process of planning, scheduling, and controlling software deployments to production environments while maintaining service quality.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

RemediationAudit and Assurance

The process of correcting identified deficiencies, vulnerabilities, or non-conformities to bring systems or processes into compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Remediation EvidenceAudit and Assurance

Documentation proving that corrective actions for audit findings or compliance gaps have been successfully implemented.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Remediation PlanCompliance

A documented plan of action for addressing identified compliance gaps, audit findings, or security vulnerabilities. Remediation plans include specific actions, owners, timelines, and priorities for closing each identified gap.Used in: ISO 27001:2022

Remediation TrackingInformation Security

The process of monitoring and managing the progress of vulnerability fixes from identification through verification of successful remediation.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Remediation VerificationInformation Security

Testing performed after vulnerability fixes are applied to confirm that the vulnerabilities have been successfully addressed without introducing new issues.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Remote AccessInformation Security

Technology and processes enabling authorized users to connect to organizational networks and resources from external locations securely.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Remote Access SecurityInformation Security

Controls and technologies for securing connections from remote users and devices to organizational networks and resources, including VPN and zero trust approaches.Used in: NIST SP 800-53 Rev 5, CIS Controls v8, NIST Cybersecurity Framework 2.0

Remote Access VPNInformation Security

A virtual private network that allows individual users to connect to a private network from a remote location over the internet. Remote access VPNs encrypt all traffic between the user's device and the corporate network.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

Remote Browser IsolationInformation Security

A security technology that executes web browsing activity in a remote environment, preventing web-based threats from reaching the user's local device.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Remote MonitoringInformation Security

The continuous observation of systems and networks from a remote location using automated tools and managed security services.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Remote WipeInformation Security

The capability to remotely delete all data from a lost or stolen mobile device to prevent unauthorized access to sensitive information.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

Replay AttackInformation Security

A network attack in which a valid data transmission is maliciously repeated or delayed. The attacker intercepts data and retransmits it at a later time to gain unauthorised access or duplicate a transaction.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Reporting ObligationCompliance and Regulatory

A legal or regulatory requirement to disclose specific information to authorities, stakeholders, or the public within defined timeframes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Reputational RiskRisk Management

The potential for damage to an organization's public image and stakeholder trust resulting from negative events, actions, or perceptions.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Residual RiskRisk Management

The risk that remains after controls have been applied. If residual risk exceeds the organisation's risk appetite, additional controls or risk treatment is required.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

ResilienceBusiness Continuity

The ability of an organization, system, or process to withstand disruptions, adapt to changing conditions, and recover quickly to maintain operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Resource ManagementGovernance

The efficient and effective deployment of an organization's resources including personnel, budget, technology, and facilities.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Responsible AIAI & Technology

The practice of developing and deploying AI systems in a manner that is ethical, transparent, accountable, and aligned with human values and societal norms. Responsible AI encompasses fairness, privacy, safety, and sustainability.Used in: GDPR, ISO 27001:2022

Responsible DisclosureInformation Security

A security vulnerability reporting practice where researchers privately inform the affected vendor and allow time for patching before public disclosure.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022

Restricted AreaInformation Security

A designated zone within a facility where access is limited to authorized personnel only, requiring enhanced security controls.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Restriction of ProcessingPrivacy and Data Protection

The right of individuals to request that a controller limit the processing of their personal data under certain circumstances defined in privacy law.Used in: GDPR, ISO 27001:2022

Retail ComplianceCompliance and Regulatory

Regulatory requirements for retail businesses including consumer protection, payment security, product safety, and data privacy.Used in: GDPR, ISO 27001:2022, PCI DSS v4.0

Retention SchedulePrivacy and Data Protection

A documented timetable specifying how long different categories of personal data should be retained before secure disposal or anonymization.Used in: GDPR, ISO 27001:2022

Return on Security InvestmentRisk Management

A metric that quantifies the financial benefit of security investments relative to their cost, supporting budget justification.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Reverse EngineeringInformation Security

The process of analyzing software, hardware, or protocols to understand their design and functionality, used in security research and malware analysis.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Right to AccessPrivacy and Data Protection

A data subject right to obtain confirmation of whether personal data concerning them is being processed and to receive a copy of that data.Used in: GDPR, ISO 27001:2022

Right to ExplanationPrivacy and Data Protection

The right of individuals to receive a meaningful explanation of the logic behind automated decisions that significantly affect them.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Right to ObjectPrivacy

The right of data subjects under GDPR Article 21 to object to processing of their personal data based on legitimate interests or public interest grounds. When exercised for direct marketing purposes, the controller must stop processing immediately.Used in: GDPR, ISO 27001:2022

Right to RestrictionPrivacy and Data Protection

The data subject's right to limit how an organization processes their personal data under specified circumstances while the data is retained.Used in: GDPR, ISO 27001:2022

Right to be ForgottenPrivacy

The right of individuals to request the erasure of their personal data under certain circumstances. Established under GDPR Article 17, also known as the right to erasure, it applies when data is no longer necessary, consent is withdrawn, or processing is unlawful.Used in: GDPR, ISO 27001:2022

Risk AcceptanceRisk Management

A conscious decision to acknowledge and tolerate a specific risk without additional mitigation when the cost of treatment exceeds the potential impact.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk AggregationRisk Management

The process of combining individual risks to understand their cumulative effect and total exposure across the organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk AnalysisRisk Management

The systematic examination of risk components including threat sources, vulnerabilities, likelihood, and potential impact to understand and characterize risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk AppetiteRisk Management

The amount and type of risk an organisation is willing to accept in pursuit of its objectives. Set by the board and communicated throughout the organisation.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Appetite StatementGovernance

A formal document expressing the board-approved levels and types of risk an organization is willing to accept in pursuit of its objectives.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022

Risk AssessmentRisk Management

The process of identifying, analysing, and evaluating risks. Includes identifying assets and threats, assessing likelihood and impact, and determining risk treatment options.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Assessment MethodologyRisk Management

The defined approach and procedures used to identify, analyze, and evaluate risks in a consistent and repeatable manner.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk AvoidanceRisk Management

A risk treatment strategy that eliminates a risk entirely by choosing not to engage in the activity or process that gives rise to the risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Based AuditingRisk Management

An audit approach that prioritizes areas for examination based on risk assessment results, focusing resources on the highest-risk areas.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Risk CapacityRisk Management

The maximum amount of risk an organization can absorb before it threatens its continued viability and ability to achieve core objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk CatalogRisk Management

A comprehensive inventory of identified risks organized by category, including descriptions, owners, ratings, and treatment plans.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk CommitteeGovernance

A committee of the board of directors responsible for overseeing the organisation's risk management framework, policies, and risk appetite. Risk committees are required or recommended by banking regulations and corporate governance codes.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0, COBIT 2019

Risk CommunicationRisk Management

The exchange of information about risks between decision-makers, stakeholders, and affected parties to support informed risk-based decisions.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ConcentrationRisk Management

The accumulation of exposure to a single risk factor, counterparty, or geographic area that could result in significant losses.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk CorrelationRisk Management

The statistical relationship between different risks that determines whether they tend to occur together or independently.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk CriteriaRisk Management

The benchmarks and thresholds used by an organization to evaluate the significance of identified risks and determine appropriate responses.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk CultureRisk Management

The shared values, beliefs, knowledge, and attitudes within an organization that influence how risks are identified, assessed, and managed.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk DashboardRisk Management

A visual display that presents key risk metrics, indicators, and status information to management for real-time risk monitoring and decision support.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Risk DecompositionRisk Management

The process of breaking down complex risks into smaller, more manageable components for detailed analysis and treatment.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk EscalationRisk Management

The process of reporting risks that exceed defined thresholds to higher levels of management or governance for decision-making and action.Used in: COBIT 2019, ISO 27001:2022

Risk EventRisk Management

An occurrence or change in circumstances that has a negative impact on the achievement of organizational objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ExceptionRisk Management

A formal approval to accept a risk that exceeds normal tolerance levels, typically requiring senior management or board authorization.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Risk ExposureRisk Management

The degree to which an organization is vulnerable to a particular risk, typically measured by the potential loss and likelihood of occurrence.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk FrameworkRisk Management

A structured approach that provides the principles, policies, and processes for managing risk consistently across an organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk GovernanceRisk Management

The organizational structures, policies, and processes that direct and control risk management activities across the enterprise.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022

Risk Heat MapRisk Management

A visual representation of risks plotted on a matrix with likelihood on one axis and impact on the other. Risk heat maps use colour coding (typically red, amber, green) to highlight the most significant risks.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk IdentificationRisk Management

The process of finding, recognizing, and describing risks that could affect the achievement of organizational objectives.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Risk IndicatorRisk Management

A measurable variable that signals changes in risk exposure and helps organizations monitor their risk profile over time.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk IntelligenceRisk Management

The capability to gather, analyze, and act upon information about risks to make better-informed decisions about risk management.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk InterdependencyRisk Management

The relationship between risks where the occurrence or treatment of one risk affects the likelihood or impact of another.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk LandscapeRisk Management

The overall picture of an organization's risk environment, including the types, sources, and interconnections of risks it faces.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Management FrameworkRisk Management

A set of components that provide the foundations and organizational arrangements for designing, implementing, and improving risk management.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Management PlanRisk Management

A documented plan describing how risk management activities will be structured, resourced, and performed throughout a project or program.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Management PolicyRisk Management

A formal statement of an organization's intentions and direction regarding risk management, established by senior leadership.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Management ProcessRisk Management

The systematic application of policies, procedures, and practices to activities of communicating, consulting, establishing context, and managing risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk MaterialityRisk Management

The significance of a risk in terms of its potential impact on the organization's objectives, financial statements, or operations.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk MatrixRisk Management

A tool used in risk assessment that maps identified risks on a grid based on their likelihood and impact to determine priority levels.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk MetricRisk Management

A quantifiable measure used to track and communicate the level of risk exposure and the effectiveness of risk management activities.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk MitigationRisk Management

Actions taken to reduce the likelihood or impact of an identified risk to an acceptable level through implementing controls or other measures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk MonitoringRisk Management

The continuous tracking and review of risk levels, control effectiveness, and risk indicators to detect changes in the risk environment.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Risk OpportunityRisk Management

A potential event or condition that, if it occurs, would have a positive effect on one or more organizational objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk OptimizationRisk Management

The process of balancing risk reduction measures with their costs and benefits to achieve the most efficient risk management approach.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk OwnerRisk Management

The individual or team accountable for managing a specific risk, including implementing risk treatment plans and monitoring risk levels. Risk ownership ensures clear accountability for risk management activities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Risk PerceptionRisk Management

How stakeholders subjectively view and interpret risk, which may differ from objective risk assessments and influence decision-making.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk PrioritizationRisk Management

The ranking of identified risks based on their assessed severity to determine the order in which they should be addressed.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ProfileRisk Management

A comprehensive description of an organization's overall risk exposure, including the types, levels, and distribution of risks across the enterprise.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk QuantificationRisk Management

The process of assigning numerical values to risk factors including probability, impact, and exposure to enable objective comparison and prioritization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk RatingInformation Security

A classification assigned to a vulnerability or finding that indicates its severity and potential impact, guiding prioritization of remediation efforts.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022

Risk ReductionRisk Management

Actions taken to decrease the probability or impact of a risk event through the implementation of controls and other mitigation measures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk RegisterRisk Management

A documented inventory of identified risks, their assessments, treatment plans, and current status. A key tool in enterprise risk management.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ReportingRisk Management

The communication of risk information to stakeholders through reports that summarize risk levels, trends, incidents, and the status of mitigation activities.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ResponseRisk Management

The selection and implementation of options for addressing risk, including avoidance, reduction, sharing, transfer, or acceptance.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk RetentionRisk Management

A deliberate decision to accept the burden of loss from a particular risk, typically when the cost of mitigation exceeds the expected loss.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ReviewRisk Management

A periodic assessment of the risk landscape, control effectiveness, and risk management processes to ensure they remain current and effective.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ScenarioRisk Management

A description of a possible sequence of events that could lead to an adverse outcome, used for risk assessment and contingency planning.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ScoringRisk Management

A methodology for assigning numerical values to risks based on defined criteria, enabling consistent comparison and prioritization across the organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk SharingRisk Management

A risk treatment strategy where the risk is shared with another party, such as through joint ventures, partnerships, or outsourcing arrangements.Used in: NIST SP 800-53 Rev 5, CIS Controls v8, NIST Cybersecurity Framework 2.0

Risk SourceRisk Management

An element that alone or in combination with other elements has the potential to give rise to a risk event.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk StatementRisk Management

A structured description of a risk that clearly identifies the risk source, the event, and its potential consequences.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk TaxonomyRisk Management

A classification system that categorizes risks into a hierarchical structure of risk types and sub-types for consistent identification and reporting.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ThresholdRisk Management

A predefined level of risk at which specific actions must be taken, such as escalation to management or implementation of additional controls.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk ToleranceRisk Management

The acceptable level of variation an organisation is willing to tolerate around specific risk objectives. Risk tolerance provides specific, measurable thresholds that translate the broader risk appetite into operational guidance.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk TransferRisk Management

A risk treatment strategy that shifts the financial impact of a risk to another party, typically through insurance policies or contractual arrangements.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0

Risk TreatmentRisk Management

The process of selecting and implementing measures to modify risk. Options include: mitigate (reduce), accept (retain), avoid (eliminate), or transfer (share) the risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Treatment OptionRisk Management

The different approaches available for addressing a risk, including avoidance, reduction, sharing, transfer, and acceptance.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Treatment PlanRisk Management

A documented plan specifying the actions, resources, timelines, and responsibilities for implementing risk treatment measures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk Trend AnalysisRisk Management

The examination of risk data over time to identify patterns, emerging risks, and changes in the risk environment.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk VelocityRisk Management

The speed at which a risk event could impact an organization after it occurs, influencing the urgency of response preparations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Risk-Based ApproachRisk Management

A methodology that prioritises compliance activities and control implementation based on the level of risk they address. Risk-based approaches are central to ISO 27001, NIST CSF, GDPR, and most modern compliance frameworks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, GDPR

Risk-Based Audit PlanningAudit and Assurance

An approach to audit planning that prioritizes areas for review based on risk assessment results and organizational risk appetite.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Risk-Based AuthenticationInformation Security

An adaptive authentication approach that adjusts security requirements based on the assessed risk level of a login attempt, considering factors like location and device.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Risk-Based SecurityRisk Management

An approach to security that prioritizes investments and efforts based on the level of risk to the organization rather than applying uniform controls.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Robotic Process AutomationAI and Technology

Software technology that uses bots to automate repetitive, rule-based tasks across applications, requiring governance for access control and audit trails.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, COBIT 2019

Robotic Process Automation (RPA)AI & Technology

The use of software robots to automate repetitive, rule-based tasks typically performed by humans. RPA in compliance can automate evidence collection, control testing, report generation, and data entry tasks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Rogue Access PointInformation Security

An unauthorized wireless access point installed on a network that can enable unauthorized network access or serve as a launch point for attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Role EngineeringInformation Security

The process of defining roles and their associated access permissions based on job functions, responsibilities, and the principle of least privilege.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Role MiningInformation Security

The analysis of existing user access patterns to discover and define roles for implementation in role-based access control systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Role-Based Access ControlInformation Security

An access management approach that assigns permissions to defined roles rather than individual users, simplifying administration and enforcing least privilege.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Role-Based Access Control (RBAC)Information Security

An access control method that assigns permissions to users based on their role within an organisation rather than their individual identity. RBAC simplifies access management by grouping permissions into roles aligned with job functions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Roles and ResponsibilitiesGovernance

Clear definitions of what each position or team is expected to do, their authority levels, and their accountability relationships within an organization.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Root Cause AnalysisAudit

A systematic process for identifying the fundamental causes of problems, nonconformities, or incidents. Root cause analysis ensures that corrective actions address underlying issues rather than symptoms.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

RootkitInformation Security

Malicious software designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer. Rootkits operate at the operating system level.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Router SecurityInformation Security

Configuration and hardening measures applied to network routers to prevent unauthorized access, routing attacks, and information disclosure.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Rules of EngagementInformation Security

Documented guidelines that define the scope, methods, timing, and constraints for authorized security testing activities.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

RunbookInformation Security

A documented set of standardized procedures and actions that guide operators in performing routine operations and responding to specific scenarios.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Runtime Application Self-ProtectionInformation Security

A security technology embedded within an application that detects and blocks attacks in real time by monitoring the application's behavior from within.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8