Glossary

A security assessment activity undertaken to assess security controls for a system and its environment to determine if they have been implemented correctly and are operating as intended.

An organisation’s cyber security strategy; system-specific security documentation; and any supporting diagrams, plans, policies, processes, procedures and registers.

A system or collection of systems operating under a consistent security policy that defines the classification, releasability and special handling caveats for data processed within the domain.

A weakness in a system that gives a threat agent the opportunity to mount an attack.

The level of security risk to which a system is exposed. A system with a strong security posture is exposed to a low level of security risk while a system with a weak security posture is exposed to a high level of security risk.

The likelihood and consequence of an event that could result in the compromise, loss of integrity or unavailability of systems, their resources or data, or deliberate harm to people.

Statements that communicate the expectations of an organisation’s senior management about their security risk tolerance. These criteria help an organisation identify security risks, prepare appropriate treatments and provide a benchmark against which the success of mitigations can be measured.

The process of identifying, assessing and taking steps to reduce security risks to an acceptable level.

An artefact of Common Criteria evaluations that specifies conformance claims, threats and assumptions, security objectives, and security requirements for an evaluated product.

Updates to the security on your system.