Maps 1–3 — Requirements, Risk, Identity/Access
Map 1 — Security Requirement Sources
Rebuild first
Stakeholders ─┐
Regulation ───┤
Proprietary ──┤
Legitimate ───┼─> SECURITY REQUIREMENTS ─> Policy / Standards / Controls
Access ───────┤
Contracts ────┘
Interpretation: Security starts with requirements, not a favorite tool. A correct map must include legitimate access; “lock everything down” is not the objective.
Answer check: stakeholder expectations + regulation + proprietary concerns + legitimate business access + contracts/industry obligations.
Map 2 — Risk Chain
VULNERABILITY (weakness)
+
THREAT (potential adverse action)
↓
RISK (likelihood + impact/cost)
↓
PRIORITIZE → CONTROL → MONITOR
Interpretation: A weakness is not yet a complete risk assessment. Risk translates the vulnerability/threat condition into business exposure and prioritization.
Answer check: weakness → what might happen → what it could cost/affect.
Map 3 — Four A’s + Entitlement
Authentication → Authorization → Access → Audit
who? what may? actual independent proof
│
└──> Entitlement = total data/capability exposure
Interpretation: The authorization decision produces an effective entitlement. Audit independently evaluates evidence; it is not merely “access happened.”
Exam discriminator: correctly authenticated does not mean correctly authorized.
Source anchors: Chapter 7 requirement, risk, and Four-A sections, pp. 209–218.