Appendices A and E

Glossary

One term per idea. The first table is the resolved vocabulary of risk: the term the framework keeps, its definition, and the retired terms kept as aliases with the source that used them. The second explains the technical terms and acronyms the book uses from data, software and the sources themselves.

The resolved vocabulary

Kept term	Definition	Aliases (with source)
appetite Acceptable amount	The amount and kind of risk the governing body wants in pursuit of objectives, stated per category on a scale.	risk appetite (COSO, Orange Book, IRM, NIST, IIA)
tolerance Acceptable amount	The measurable variation around a performance objective that the organization will accept.	tolerance as variation (COSO); tolerance, measurable (NIST); tolerable position (Orange Book, renamed accepted position); tolerance boundary (IRM, renamed risk universe boundary)
limit Acceptable amount	A hard boundary on an exposure, enforced by a system; its breach is an event.	limit (Basel, trading); hard limit, cap
threshold Acceptable amount	The value of an indicator at which escalation is owed.	KRI threshold (Basel PSMOR, NIST); trigger (PMI, EBA management actions)
inherent exposure Before and after controls	Exposure before any control.	inherent (COSO, Orange Book, NIST); gross (IRM, UK practice)
expected exposure Before and after controls	Exposure the controls in place should achieve; a forecast.	residual (COSO, Orange Book, ISO); net (IRM); current (NIST)
measured exposure Before and after controls	Exposure actually observed after the fact.	residual, in registers that measure (NIST detail record: measured)
target exposure Before and after controls	The exposure the organization intends to reach.	target risk (COSO)
event What happened	An occurrence that departs from the expected and may or may not cause harm.	event (ISO Guide 73, COSO, IRM); failure, nonconformity (ASQ)
loss event What happened	An event with a measurable consequence; enters the loss base.	loss event (Basel PSMOR); loss (FSB)
near miss What happened	An event with no consequence this time; enters the loss base with a flag.	near miss (Basel PSMOR, ISO Guide 73)
incident What happened	An event that has been detected, classified and is under response.	incident (FSB FIRE, NIST, Orange Book)
response What is done about it	The decision about a risk: accept, avoid, mitigate, share, transfer, realize, enhance; decided by a named owner.	risk response (COSO, NIST); treatment (ISO); mitigation (one option)
control What is done about it	A measure in place that maintains or modifies risk; carries level, mode and originating response.	control (ISO, COSO, Orange Book); safeguard, countermeasure (NIST SP 800); barrier (ASQ, after an event); control activity (COSO)
consequence How bad	What follows from a scenario, stated against an objective; where several objectives are affected the highest governs.	impact (COSO, PMI, NIST, Orange Book); effect (ASQ); adverse effect (NIST)
severity How bad	The scored magnitude of a consequence on a defined scale.	severity (ASQ FMEA, Basel, INFORM Severity)
likelihood How often	The chance of a scenario, expressed in calibrated words or numbers.	likelihood (ISO, NIST); occurrence (ASQ FMEA)
probability How often	A likelihood expressed as a number between zero and one.	probability (PMI, NASA, risk-engineering.org)
frequency How often	A likelihood expressed as a count per period.	frequency (Basel operational risk)
risk The thing itself	The effect of uncertainty on objectives, recorded as a scenario: condition, departure, asset, consequence.	risk (ISO); risk scenario (NASA, NIST 8286A)
hazard The thing itself	A source of potential harm; coded where a dictionary exists.	hazard (UNDRR HIPs, INFORM, NIOSH); source of risk (ISO)
threat The thing itself	A hazard with intent behind it.	threat (NIST, CISA, FSB)
exposure The thing itself	The value, people or operations in the way of a hazard.	exposure (UNDRR, INFORM, Basel)
vulnerability The thing itself	The susceptibility of what is exposed.	vulnerability (UNDRR, INFORM, NIST, FSB)
taxonomy The structure	The whole hierarchy of categories, organized by source at the first level.	risk breakdown structure (PMI); categories (Orange Book); core (NIST CSF)
category The structure	One node of the taxonomy at any level.	category, subcategory (NIST CSF); class, type (UNDRR); domain
owner The person	The single named person accountable for a risk, control or objective.	risk owner (ISO, COSO, NIST); accountable (IIA); sponsor, champion (PMI)
responsible The person	Whoever performs the work; may be several people.	responsible (RACI usage)
assurance The proof	An opinion given by a party independent of the thing opined on.	assurance (IIA, Orange Book); independent assurance
assessment The proof	An evaluation that may be done by the owner.	risk assessment (ISO, NIST SP 800-30); self-assessment (Basel PSMOR)
testing The proof	Exercise of a control or model against known cases.	control testing (IIA); backtesting (Basel); exercise (Ready.gov)
validation The proof	Confirmation that a model or method is fit for purpose.	model validation (Basel); validation against closed form (risk-engineering.org)
verification The proof	Confirmation that something was done as specified.	verification (ASQ); confirmation of action plans (IIA 15.2)
register The record	The governed list of risks with their fields, in the open schema.	risk register (NIST IR 8286, ISO, PMI); risk log (PMI, older usage)
detail record The record	The full record behind a register row.	Risk Detail Record (NIST IR 8286)
profile The record	A summary of a register against outcomes or tiers; current and target.	profile (NIST CSF 2.0, AI RMF); enterprise risk profile (NIST 8286C)
log The record	A time-ordered record of events or actions.	incident log, decision log, loss database (Basel)
scenario The plan	A described future state with its drivers.	scenario (NGFS, EBA, NASA, NIST 8286A, WEF)
stress test The plan	The projection of the organization's position under an adverse scenario.	stress test (EBA, Basel)
reverse stress test The plan	The search for the scenario that breaks a stated objective.	reverse stress test (EBA)
simulation The plan	The method by which a distribution of outcomes is produced.	Monte Carlo (risk-engineering.org, PMI, NASA)
governing body Governance	The board or equivalent to which management is accountable.	board (COSO, Orange Book); governing body (IIA); accountable executive
three lines Governance	Management, oversight functions, internal audit, each with defined roles.	three lines (IIA); first, second, third line
culture Governance	The shared attitudes and behaviors toward risk, measured in aspects.	risk culture (IRM, COSO, Orange Book)
objective Objectives	A stated aim against which risk and consequence are measured, with a tolerance.	objective (COSO, ISO, NASA); performance measure (NASA RIDM); outcome (NIST CSF)
tier Objectives	The level of the organization a risk is recorded at: enterprise, organization or process, system.	tier (NIST SP 800-39, IR 8286); level (IRM: strategic, tactical, operational)
indicator Indicators	A measured quantity with a threshold; leading if it anticipates, lagging if it records.	key risk indicator (Basel PSMOR, NIST); early-warning indicator (Basel liquidity); metric
trend Indicators	The direction of an indicator or score over time.	trend (Orange Book, INFORM, WEF)
business impact analysis Continuity	The assessment of impact over time per process, giving tolerable outage and recovery targets.	BIA (Ready.gov, NIST 8286D, ISO 22301)
recovery time objective Continuity	How quickly a function or resource must be restored.	RTO (Ready.gov, ISO 22301)
recovery point objective Continuity	How much data loss is tolerable, which dictates backup frequency.	RPO (Ready.gov)
maturity Maturity	The degree to which practices are defined, repeated and improved, expressed as a tier or profile.	tiers (NIST CSF, as the framework itself cautions); maturity model (COSO 2026, IIA)
third party Third parties	An external provider of a service, product or component.	vendor, supplier (CISA); service provider (FSB); third party (IIA)
nth party Third parties	A provider to a provider; visible through bills of materials.	nth party (FSB, CISA)
component Third parties	A unit of software or hardware within a product, identified in a bill of materials.	component (CISA SBOM, HBOM)
opportunity Opportunity	A risk with a favorable consequence; a first-class register entry with the responses realize, share, enhance.	opportunity (ISO, COSO, IRM, NIST IR 8286, NASA, NIST CSF GV.RM-07)
decision record Decision	The documented choice among alternatives with rationale, owner and date.	selection report (NASA RIDM); plan of action and milestones (NIST); minute
acceptance above appetite Decision	A decision to run a risk whose measured exposure exceeds the appetite position; communicated to the governing body.	acceptance above appetite (IIA 11.5)
composite index Aggregation	A score built from indicators by normalization and aggregation, published with its reliability.	index (INFORM); score; rating
portfolio view Aggregation	Risk looked at across objectives or entities rather than one risk at a time.	portfolio view (COSO); aggregated risk (NASA); enterprise aggregation (NIST 8286C)
technique Method	A declared method for identification or analysis, from a recognized catalog.	technique (IEC 31010); tool (ASQ); method
criteria Method	The written rules, set before assessment, for judging likelihood, consequence and acceptability.	risk criteria (ISO 31000); scales (PMI); risk model (NIST SP 800-30)
calibration Method	The confrontation of estimates with outcomes and the adjustment that follows.	calibration (PMI library); backtesting (Basel)
precision Method	How sure an estimate is, recorded with it.	precision (PMI); confidence; uncertainty (NASA)
version Currency	The identified edition of a source, scenario or input, with its retraction status.	version, vintage (NGFS); revision (NIST); edition (ISO, COSO)

Technical terms and acronyms

Term	Meaning, and where it matters in the book
Action Priority (AP)	The AIAG-VDA replacement for the risk priority number in FMEA: a table that reads severity, occurrence and detection together and returns high, medium or low, with the rule that a high severity cannot be diluted by a low occurrence. Component C3.3 [8].
Agent (software agent)	A program, usually built on a language model, that reads documents and data, draws conclusions and takes actions with limited supervision: drafting a self-assessment from logs, reconciling a register with an appetite statement, answering a questionnaire. Chapters 2, 3 and 23 argue that agents expose the cost of the dialects because they read only the text.
AIAG-VDA	The joint FMEA handbook of the Automotive Industry Action Group and the German automotive association (Verband der Automobilindustrie), source of the Action Priority. Section 6.1 [8].
ARIA	Assessing Risks and Impacts of AI, the NIST program that evaluates AI systems in realistic use rather than on benchmarks alone. Section 7.3 [21].
Backtesting	Comparing a model's forecasts with what actually happened over a fixed window: Basel counts the days in the last 250 on which the loss exceeded the model's estimate and raises the capital multiplier as the exceptions accumulate. Component C3.6 [5].
BCBS	The Basel Committee on Banking Supervision, the committee of central banks and supervisors that writes the Basel Framework. Chapter 5 [5] [17] [19].
BIA (business impact analysis)	The continuity exercise that establishes, for each function, how long it can be interrupted and what the interruption costs over time. Section 8.1 and component C5.6 [16].
Calibration	Checking that the scores or probabilities an organization assigns agree with what later happens: a likelihood band that says once in one to three years should, over enough risks and enough years, be right about that often. Component C5.5.
Composite index	A single score built from many indicators brought to a common scale and weighted, such as INFORM Risk; the book requires that the weights, the scale transformations and the reliability of the underlying data be published with the score. Component C3.5 [7].
Controlled vocabulary	A fixed, published list of allowed values for a field, each with a definition and usually a code, so that two records using the same value mean the same thing. The hazard dictionary and the global risks list are controlled vocabularies. Component C2.5 [24] [22].
Convergence	In a simulation, the point at which running more trials no longer changes the result materially; a simulation that reports its result without showing that it converged has not proved itself. Component C3.4 [26].
CRE, MAR, SRP	The chapter codes of the consolidated Basel Framework: CRE for credit risk, MAR for market risk, SRP for the supervisory review process (SRP31 covers interest rate risk in the banking book). A number after the code is the chapter, as in MAR12. Chapter 5 [5] [19].
CSF 2.0	The NIST Cybersecurity Framework, version 2.0, whose six functions, Govern, Identify, Protect, Detect, Respond and Recover, put governance first. Section 7.4 and component C0.4 [23].
Data lineage	The recorded path of a number from the system where it originated, through every transformation, to the report in which it appears, so that the number can be traced and reproduced. Component C5.1 [17].
Dioptra	A NIST test platform for measuring how AI models behave under attack and under changes in their inputs. Section 7.3 [21].
Early Warnings for All	The United Nations initiative to give every person on earth coverage by a multi-hazard early-warning system; the book takes from it the four elements of a warning chain. Section 8.2 [24].
FIRE	Format for Incident Reporting Exchange, the Financial Stability Board's common format for reporting operational incidents, with eighty-seven information items in four sections and a published taxonomy. Component C5.4 [27].
FMEA	Failure mode and effects analysis: for each function of a product or process, the ways it can fail, the effect of each failure, its cause, the controls that prevent or detect it, and a priority. Section 6.1 and component C2.3 [8].
GAR	The Global Assessment Report on Disaster Risk Reduction, published by UNDRR. Section 8.2 [24].
Hash	A short fixed-length fingerprint computed from a file, such that any change to the file changes the fingerprint; a software bill of materials records a hash for each component so that the component can be identified exactly. Component C2.7 [15].
HBOM, SBOM	Hardware bill of materials and software bill of materials: the list of the components inside a product, with name, version, supplier and, for software, a hash and the dependency relationships, so that a vulnerability announced in a component can be traced to the products that contain it. Section 7.5 and component C2.7 [15].
Hierarchy of controls	The five levels of control in decreasing order of effectiveness: eliminate the hazard, substitute something less hazardous, engineer the hazard away from the person, administer the work, protect the person. Section 6.3 and component C4.2 [10].
ICT	Information and communications technology; CISA's supply-chain work is about ICT products and services. Section 7.5 [15].
IEC 31010	The companion standard to ISO 31000 that catalogs risk assessment techniques, from brainstorming to Bayesian networks. Section 4.1 [1].
INFORM	The open risk index of the Joint Research Centre and its partners: a tree from some fifty indicators through hazard and exposure, vulnerability and lack of coping capacity to one score per country, with a reliability index for the data. Section 8.3 and component C3.5 [7].
Inter-rater agreement	A statistic for how far two or more people, coding the same material independently, reach the same result; used in the book's research agenda to test whether the placement of sources on the cycle is a property of the sources or of the author. Chapter 10, For the researcher.
IRRBB	Interest rate risk in the banking book: the effect of interest-rate movements on the earnings and the economic value of the positions a bank does not trade. Section 5.1 [5].
JSON	JavaScript Object Notation, a plain-text format for structured data that any program can read: a record is a list of named fields and their values, which may themselves be lists or records. Despite the name it is independent of any programming language and is the common format for exchanging data between systems. The NIST register series publishes its register row and detail record as JSON files [9]; appendix C is written in it.
JSON Schema	A JSON file that describes what another JSON file must look like: which fields are required, of what type, with which allowed values. A validator reads the schema and says whether a record conforms. This is what the book means by a machine-readable format as opposed to an idea. Chapter 13 and appendix C [9].
KRI (key risk indicator)	A measured quantity, with a threshold, that moves before a risk materializes or records that it has; the book keeps the word indicator and defines leading and lagging. Component C5.2.
Language model	A program trained on large quantities of text to predict and generate language; the engine behind most software agents in use today. Chapters 2, 7 and 23.
Machine-readable	Published in a format with defined fields, types and rules, such that a program can read, validate and exchange it without a person interpreting the text. Four of the twenty-seven sources are machine-readable in this sense. Chapter 13.
Monte Carlo simulation	A method that estimates the distribution of an outcome by computing a model many thousands of times with inputs drawn at random from their own distributions. Section 6.5 and component C3.4 [26].
NGFS	The Network for Greening the Financial System, the group of central banks and supervisors that publishes the climate scenarios used in stress testing. Section 5.6 and component C3.8 [13].
NPR 8000.4C	The NASA procedural requirement for agency risk management, read with the NASA Risk Management Handbook. Section 6.4 [11].
Ordinal	A scale whose values are ordered but not spaced: a 4 is worse than a 3, but not necessarily twice as bad as a 2, so ordinal scores cannot be multiplied or averaged without a stated rule. Component C3.2 [12].
Persistent identifier	A code assigned to a thing that never changes and is never reused, so that a hazard, a component or a record means the same thing in every dataset and every year. The hazard dictionary assigns one to each of its two hundred and eighty-one hazards. Component C2.5 [24].
PRA (probabilistic risk assessment)	The engineering method that models how a system can fail as sequences of events with probabilities, and combines them into a likelihood and consequence for each outcome. Section 6.4 [11].
PtD (Prevention through Design)	The NIOSH initiative to remove hazards at the design stage rather than control them in operation. Section 6.3 and component C4.4 [10].
RBS (risk breakdown structure)	A hierarchy of the sources of risk, three levels deep, by analogy with the work breakdown structure of a project. Section 9.1 and component C2.1 [3].
Retraction	The withdrawal of a published input, such as a scenario or a dataset, by its publisher; the seventh principle requires every external input to carry its version and its retraction status as data. Component C3.8 [13].
Reverse stress test	A stress test run backwards: start from the outcome that would break the organization and search for the scenarios that produce it. Component C3.7 [25].
RMF	Risk Management Framework, the NIST lifecycle in which an information system is categorized, its controls selected, implemented, assessed and authorized, and then monitored. Section 7.2 and component C5.7 [20]. Not to be confused with the NIST AI RMF, the AI Risk Management Framework [21].
Roll-up	The summarizing of records from a lower tier into a higher one, system to process to organization to enterprise, which works only when the fields mean the same thing at every tier. Components C1.7 and C6.1 [9] [20].
Scenario triplet	The three questions of probabilistic risk assessment, what can go wrong, how likely it is, and what the consequences are, each answered with its uncertainty. Component C3.1 [11].
Schema	A formal description of the structure of a record: its fields, their types and the rules they obey. See JSON Schema. Chapter 13 and appendix C.
SCRM (supply chain risk management)	The management of the risk that a product or service carries from the components and suppliers behind it; CISA's task force and vendor template are about the ICT supply chain. Section 7.5 [15].
Version number (three-part)	The numbering the catalog and the schema use: the third part rises for a correction, the second for a change that keeps what adopters built valid, the first for a change that may not. Chapter 25.
Sendai Framework	The United Nations framework for disaster risk reduction 2015 to 2030, with four priorities, seven targets and thirty-eight indicators. Section 8.2 [24].
Sensitivity analysis	Varying each input of a model in turn to see how much the output moves, which tells the analyst which inputs deserve the most care. Component C3.4 [26].
Taxonomy	A classification of things into a hierarchy of categories; the book requires the risk taxonomy to be organized by source, with an other branch at every level. Component C2.1 [3].
Validator	A program that checks a record against a schema and reports whether it conforms, so that the check is run by software rather than argued in a meeting. Chapter 13.