Page 95 - ITGC_Audit Guides

patch – Fixes to software programming errors and vulnerabilities [ISACA Online Glossary].

privacy – The rights of individuals to trust that others will appropriately and respectfully use,
store, share, and dispose of their associated personal and sensitive information within the
context, and according to the purposes, for which it was collected or derived. Scope notes:
What is appropriate depends on the associated circumstances, laws, and the individual’s
reasonable expectations. Individuals also have the right to reasonably control and be aware
of the collection, use, and disclosure of their associated personal and sensitive information
[adapted from ISACA Online Glossary].
production support – Processes to configure, administer, and troubleshoot applications. (See
also “system administration,” Techopedia.com).

remote access – Access to an organizational system by a user (or a process acting on behalf of a
user) communicating through an external network [NIST SP 800-53r5 Glossary].

risk* – The possibility of an event occurring that will have an impact on the achievement of
objectives. Risk is measured in terms of impact and likelihood.

risk management* – A process to identify, assess, manage, and control potential events or
situations to provide reasonable assurance regarding the achievement of the organization’s
objectives.

Standard* – A professional pronouncement promulgated by the International Internal Audit
Standards Board that delineates the requirements for performing a broad range of internal
audit activities and for evaluating internal audit performance.

subnetworks – Engineered partitions of an enterprise network that help control access to
specified sets of resources. Subnetworks are often aligned with security categories, to
enable commensurate access control mechanisms. (See also “subnetwork (subnet),”
Techopedia.com Dictionary).
system development life cycle (SDLC) – The phases deployed in the development or
acquisition of a software system. Typical phases of SDLC include the feasibility study,
requirements study, requirements definition, detailed design, programming, testing,
installation, and post-implementation review, but not the service delivery or benefits
realization activities [adapted from ISACA Glossary].

technology planning – Activities to align IT-IS resources with business needs, ensuring
objectives of confidentiality, integrity, availability, privacy, and security are met. (See also
ISACA’s definition for “strategic planning” and NIST SP 800-53r5’s definition of “enterprise
architecture”).

virtual private network (VPN) – A secure private network that uses the public
telecommunications infrastructure to transmit data. Scope notes: In contrast to a much
more expensive system of owned or leased lines that can only be used by one enterprise,
VPNs are used by enterprises for both extranets and wide areas of intranets. Using
encryption and authentication, a VPN encrypts all data that pass between two internet
points, maintaining privacy and security [ISACA Glossary].

20 — theiia.org