GRC on Sinetris's viewpointshttps://sinetris.info/glossary-contexts/grc/Recent content in GRC on Sinetris's viewpointsSine Die theme for HugoDuilio Ruggieroduilio@sinetris.info© 2023 - 2026, Duilio Ruggiero2025-12-07T23:58:31ZRisk Owner2025-12-07T23:58:31+00:002025-12-07T23:58:31Zhttps://sinetris.info/glossary/risk-owner/#atomPerson directly responsible for identifying, assessing, monitoring, reporting,
responding to, and defining intervention strategies in relation to risks associated
with an <a class="glossary-term" href="/glossary/information-technology-asset/">IT asset</a>.Information Technology Asset2025-12-07T23:19:32+00:002025-12-07T23:19:32Zhttps://sinetris.info/glossary/information-technology-asset/#atomHardware and software (e.g., applications, systems, virtual resources, data) that
an organization uses to support its business objectives.Access Recertification Campaigns2025-12-01T10:25:02+00:002025-12-01T10:25:02Zhttps://sinetris.info/glossary/access-recertification-campaigns/#atomPeriodic review of user <a class="glossary-term" href="/glossary/entitlements/">entitlements</a>
to enforce the <a class="glossary-term" href="/glossary/principle-of-least-privilege/">Principle of Least Privilege</a>,
ensure <a class="glossary-term" href="/glossary/orphaned-account/">orphaned accounts</a> are removed,
and reduce internal threats and compliance violations.Birthright Access2025-11-29T15:32:02+00:002025-11-29T15:32:02Zhttps://sinetris.info/glossary/birthright-access/#atom<a class="glossary-term" href="/glossary/entitlements/">Entitlements</a> automatically granted to a user when
they join an organization or change roles within it.Subject Matter Expert2025-11-24T07:28:53+00:002025-11-24T07:28:53Zhttps://sinetris.info/glossary/subject-matter-expert/#atomA professional with in-depth, specialized knowledge in a particular field, process,
or technology who acts as a trusted advisor, guiding teams, validating information,
and solving complex problems to ensure accuracy, efficiency, and successful project
outcomes.Asset Administrator2025-11-24T01:27:13+00:002025-11-24T01:27:13Zhttps://sinetris.info/glossary/asset-administrator/#atomManages user roles, account assignments, and performs access reviews and audits
for an <a class="glossary-term" href="/glossary/information-technology-asset/">IT asset</a>.Authentication Assurance Level2025-11-22T08:02:00+00:002025-11-22T08:02:00Zhttps://sinetris.info/glossary/authentication-assurance-level/#atomNIST standard to assess the degree of confidence and reliability of an authentication
process.Asset Owner2025-11-22T08:01:09+00:002025-11-22T08:01:09Zhttps://sinetris.info/glossary/asset-owner/#atomPerson or group responsible for an <a class="glossary-term" href="/glossary/information-technology-asset/">IT asset</a>.Information Technology Asset Management2025-11-10T14:55:30+00:002025-11-10T14:55:30Zhttps://sinetris.info/glossary/information-technology-asset-management/#atomSystems to manage the lifecycle of <a class="glossary-term" href="/glossary/information-technology-asset/">IT assets</a>, including tracking, maintaining and disposing of hardware
and software.Segregation of Duties2025-09-04T12:33:22+00:002025-09-04T12:33:22Zhttps://sinetris.info/glossary/segregation-of-duties/#atom<h2 id="description">Description</h2>
<p>Segregation of Duties (SoD) is a mechanism designed to prevent the risks of errors and fraudulent behavior by dividing the actions required to complete a task among different employees.</p>
<h3 id="examples">Examples</h3>
<ul>
<li>
<p>To prevent financial fraud: the person approving an invoice cannot be the same person who issued it.</p>
<blockquote>
<p><strong>Reason:</strong> they could potentially approve and pay fraudulent invoices to themselves or a fictitious supplier.</p>
</blockquote>
</li>
<li>
<p>To prevent both fraud and errors: the software engineer that approve code changes to critical assets cannot be the same person who submitted the changes.</p>
<blockquote>
<p><strong>Reason:</strong> they could miss mistakes made by them (prevent errors) or abuse the system to their own advantage (prevent fraud).</p>
</blockquote>
</li>
</ul>Information Assurance2025-03-17T10:43:09+00:002025-03-17T10:43:09Zhttps://sinetris.info/glossary/information-assurance/#atom<p>Information Assurance (IA) is the practice of assuring information quality and managing risks related to the use, processing, storage, and transmission of information.</p>
<p>The 5 pillars of information assurance includes protection of the <strong>Confidentiality</strong>, <strong>Integrity</strong>, <strong>Availability</strong>, <strong>Authenticity</strong>, and <strong>Non-repudiation</strong> of information.</p>
<p>In IT systems, when possible, assets should be tagged/labeled with proper Information Assurance level.</p>
<h2 id="confidentiality">Confidentiality</h2>
<p>The property that information is not made available or disclosed to unauthorized individuals, entities, or processes.</p>Recovery Point Objective2023-08-06T10:10:15+00:002023-08-06T10:10:15Zhttps://sinetris.info/glossary/recovery-point-objective/#atomTargeted duration of time between the event of failure and the point where operations resume.Recovery Time Objective2023-08-06T10:10:15+00:002023-08-06T10:10:15Zhttps://sinetris.info/glossary/recovery-time-objective/#atomAgreed maximum time, based on risk analysis, between the failure event and the restoration of operations.Software Bill of Materials2023-08-06T10:10:15+00:002023-08-06T10:10:15Zhttps://sinetris.info/glossary/software-bill-of-materials/#atom<p>A Software Bill of Materials (SBOM) is a comprehensive inventory of all the components,
including dependencies and related installed tools, used in a software.</p>