FAQ
Glossary
Short answers to the questions we hear most often about running ARC. For the full walkthrough of every workspace, open the user documentation linked at the bottom of this page.
- I×L×V
- Impact × Likelihood × Vulnerability. ARC multiplies three ratings, each from 1 to 5, to estimate a risk score.
- Inherent risk
- The risk before controls or other safeguards are taken into account.
- Residual risk
- The risk remaining after controls and safeguards are taken into account.
- CAP
- Corrective action plan: work assigned to fix a problem and prevent it happening again.
- SoA
- Statement of Applicability: a record of which controls apply, why, and whether they are implemented.
- ISMS
- Information security management system: the people, policies and processes used to manage information security.
- AIMS
- AI management system: the people, policies and processes used to govern artificial intelligence.
- Post-market monitoring
- Checking an AI system after deployment for performance, harm and changes that require action.
- Nonconformity
- A requirement that has not been met, supported by evidence and usually followed by corrective action.
- Inheritance
- A control provided partly or wholly by another team, platform, supplier or parent control.
- Locked control
- A control protected from automated rebuild changes. Its current wording and mappings are retained.
- RTO
- Recovery time objective: the target maximum time to restore a service after disruption.
- RPO
- Recovery point objective: the maximum acceptable amount of data loss, measured in time.
- C·I·A
- Confidentiality, Integrity and Availability: keeping data private, accurate and accessible when needed.
- CAB member
- A Change Advisory Board member authorised to review and approve proposed changes. Independence rules still apply.
- ILV band
- The risk category for an I×L×V score: Low, Medium, High or Critical. Boundaries follow the configured risk matrix.
Open user documentationOpens in a new tab