Page 402 - CyberSecurityEssentialsEnglish

Term Common abbreviation Plain-language explanation

Accepting an automated output because it appears
Automation bias -
neutral or authoritative.
Loss of human capability through over-reliance on
Skill erosion -
a tool.

Deciding per task whether to automate, augment,
Task redesign -
protect, or create new work.

A measure of the conditions that prevent
Leading indicator -
problems, taken before outcomes.

Lagging indicator - A measure of outcomes after they have occurred.

Total cost of All costs of adoption, operation, review, incidents,
TCO
ownership and exit.

A description of levels of institutional capability and
Maturity model -
the next step.

A small team providing patterns, templates,
Center of excellence -
testing, and enablement.

Central standards and register with ownership and
Federated model -
delivery inside units.

Community of A cross-unit group sharing evidence, failures, and
-
practice reusable practice.

Controls placed around a model rather than inside
Guardrails - it: permissions, validation, allowlists, and approval
gates.

The ability to see what a running system is doing,
Observability - through traces, logs, cost, latency, and recorded
failures.

Review Questions
1. What is the difference among governance, management, compliance, assurance, and audit?

2. Why is a written policy not enough to build institutional capability?
3. How do the four functions of governing, mapping, measuring, and managing organize a risk
cycle?

4. Which factors determine the risk level of a use case?
5. When is human oversight a formality rather than meaningful?
6. What is the difference between pre-release testing and post-release monitoring?

7. What additional requirements apply when a system is given tools and executive
permissions?

401