CERG GLOSSARY

Canonical Terms, Record Types, and Conversion Rules

Table of Contents

1. Purpose and Scope
2. How to Use This Glossary
3. Canonical Terms
4. Record Types and Their Terms
5. Conversion Rules
6. Role Names
7. Document Control

1. Purpose and Scope

CERG uses specific terms with specific meanings. “Finding” is not a vulnerability. “Risk” is not a finding. “Exception” is not an exception to risk acceptance. Confusing these terms produces records that do not match what auditors and adopters expect.

This document is the canonical glossary for CERG. It collects the terms that appear across the corpus and gives each one a definition, an authoritative record type, and a statement of what it converts to. Where the same word appears with different meanings in different documents (for example, “control” in POL-001 vs CB-001), this document disambiguates.

The glossary is the first place to look when a term is ambiguous. The Flow F-04 walkthrough (in CERG-GOV-FLOW-001) and the day-in-the-life stories use the terms defined here.

The glossary does not redefine terms that already have a published definition in another CERG artifact. Where a term’s authoritative definition lives elsewhere (for example, “Risk Appetite” lives in CERG-GOV-RMF-001), this document points to that source rather than restating the definition.

2. How to Use This Glossary

• A leader adopting CERG for the first time should read §3 and §4 once before reading any other CERG document. The 30 minutes invested pays back across every subsequent read.
• A contributor writing a new CERG artifact should check this glossary before coining a new term. If a term does not appear here and is not defined in the parent artifact, add it to §3 of this glossary before using it elsewhere.
• An auditor or assessor reviewing CERG adoption can use this glossary as the authoritative vocabulary against which to test that records, evidence, and reports use the same term consistently.

3. Canonical Terms

These terms appear throughout the CERG corpus with specific meanings.

4. Record Types and Their Terms

Every material workflow in CERG resolves to one of the following primary record types. Each record type is owned by one source-of-truth system. Where multiple systems hold similar data, the source-of-truth wins.

Conversion Rules

These are the rules that govern when one record type becomes another. They appear in CERG-GOV-FLOW-001 §2 and are repeated here for discoverability.

• A Vulnerability becomes a Finding when triaged. It may be directly remediated without becoming a Risk.
• A Finding promotes to a Risk Record when: the SLA is exceeded, the affected asset is Tier 0 or Tier 1, exploitation is active, remediation requires a business decision, or compensating controls are needed.
• A Risk that involves a control deviation creates an Exception Record.
• An Exception that expires without renewal auto-creates a Finding (severity: High).
• A recurring Finding in the same control family triggers a Control Change Record (F-01).
• A Control Gap (a missing or ineffective control, a systemic condition) is usually recorded as a Risk because of its systemic impact.
• An Incident declaration does not replace a Finding. Lessons learned from an Incident may create Findings, Risks, or Control Change Records, but the Incident Record itself is the authoritative artifact for the event.

5. Conversion Rules (extended)

These extended rules cover record-to-record transitions that appear less frequently but still matter.

• A Risk Acceptance that expires without renewal auto-creates a Finding (severity: High). The original acceptance approver is notified.
• An Exception that is renewed without a change in scope does not create a new Finding; the existing Exception Record is updated with a new expiration date.
• A Finding that is closed as a False Positive does not create a Risk or an Exception. The determination method and evidence are recorded in the Finding Record’s closure rationale.
• A Risk that is closed by treatment does not automatically close the underlying Finding. Each is closed independently based on its own closure criteria.
• A Control Change Record that is closed does not close related Findings. The Findings close when their remediation evidence is validated.

6. Role Names

These are the canonical role names used across CERG artifacts. Roles collapse onto fewer heads in CERG Lite per CERG-GOV-IMP-003 §4. The questions the role owns do not collapse.

Executive and Pillar Leadership

• CISO (Chief Information Security Officer) - accountable for the security program overall
• Executive Sponsor - accountable executive outside the security team
• Engineering Pillar Leader - accountable for the Engineering pillar
• Risk Pillar Leader - accountable for the Risk pillar
• Governance Pillar Leader - accountable for the Governance pillar

Engineering Pillar Roles

• Cloud Security Engineer
• Identity Engineer
• OT Security Engineer
• Application Security Engineer
• Endpoint Engineer
• Cryptography Engineer
• Pre-production Reviewer

Risk Operations Pillar Roles

• Exposure Management Lead
• Adversarial Testing Lead
• Threat Intelligence Analyst
• Detection Engineer
• OT Risk Analyst
• Identity Risk Analyst
• Vendor Risk Analyst

Governance and Compliance Pillar Roles

• NERC-CIP Compliance Manager
• CMMC / Federal Compliance Manager
• SOX ITGC Lead
• Policy & Standards Manager
• Risk Register Owner
• Evidence Librarian

Adjunct Function Roles (Incident Response)

• Incident Commander - accountable during a declared incident
• Lead Investigator - accountable for incident investigation

7. Document Control

Revision History

Review Triggers

• A new record type is added to CERG-GOV-FLOW-001 §4.
• A new term is introduced in any CERG artifact that does not appear in this glossary.
• A canonical role is added to or removed from the roles directory.
• A new pillar or sub-pillar is added to CERG-GOV-FRM-001.
• A maintainer review identifies a term whose meaning has drifted from the original definition.

Related Documents

• CERG-GOV-FLOW-001 - Source of the record type definitions and conversion rules in §4 and §5.
• CERG-GOV-RMF-001 - Authoritative source for “Risk Appetite” and risk treatment vocabulary.
• CERG-GOV-CB-001 - Authoritative source for control vocabulary.
• CERG-GOV-OM-001 - Authoritative source for role definitions and pillar descriptions.
• CERG-GOV-FRM-001 - Three-pillar model and CERG philosophy.
• CERG-GOV-STY-001 - Style conventions for CERG documents.
• roles/CERG-GOV-JF-001_Job_Families_Overview.md - Job family structure and per-role descriptions.

Source: governance/CERG-GOV-GEN-001_CERG_Glossary.md · Download .md · View on GitHub