Glossary
A glossary so security, IT and leadership mean the same thing.
Around 150 terms from information security, business continuity, data protection and AI governance, each with the standard it comes from and what it means in daily work.
153 of 153 terms
Foundations
34
- Acceptable Use PolicyA policy that defines how employees may use an organisation's systems, devices, and data, and what behaviour is prohibited.
- AccreditationFormal recognition that a certification body is competent to carry out audits and issue certificates against a given standard.
- Audit EvidenceRecords, statements, and other verifiable information that an auditor uses to determine whether requirements are met.
- Certification BodyAn independent organisation, accredited for the purpose, that audits a management system and issues a certificate when it conforms to a standard.
- Context of the OrganisationThe internal and external issues, and the needs of interested parties, that shape what a management system must achieve.
- Continual ImprovementThe ongoing effort to raise the effectiveness of a management system over time, a core requirement of every ISO standard.
- Corrective ActionAction taken to eliminate the root cause of a nonconformity so that it does not happen again.
- Documented InformationThe records and documents an ISO management system requires to be created, controlled, and maintained as evidence.
- GRC (Governance, Risk, and Compliance)An integrated approach that aligns governance, risk management, and regulatory compliance so an organisation can pursue objectives while staying within its risk appetite and the law.
- Information Security ObjectivesMeasurable targets an organisation sets to improve information security, consistent with its security policy.
- Inherent RiskThe level of risk before any control is applied. Compared against residual risk, it shows how much a set of controls actually removes.
- Interested PartiesThe stakeholders whose needs and expectations a management system must consider, such as customers, regulators, employees, and suppliers.
- Internal AuditA planned, independent review that checks whether a management system conforms to its own requirements and to the relevant standard, and whether it is effective.
- KPI (Key Performance Indicator)A metric that shows how well a process or control is performing against its goal.
- KRI (Key Risk Indicator)A metric used to monitor whether an identified risk is changing or approaching the organisation's risk-tolerance threshold.
- Lead AuditorThe qualified auditor who plans and directs an audit, leads the audit team, and is responsible for its conclusions.
- Management ReviewA regular review by top management of whether the management system remains suitable, adequate, and effective, with decisions on changes and resources.
- Management SystemA structured set of policies, processes, and controls an organisation uses to direct and improve a specific discipline, such as information security or business continuity.
- NonconformityA failure to meet a requirement, whether from the standard, a policy, or a legal obligation, identified through audits or operations.
- PDCA CyclePlan, Do, Check, Act: the iterative four-step model behind continual improvement in every ISO management system.
- Recertification AuditA full audit at the end of a certificate's cycle, usually every three years, to renew certification for another period.
- Residual RiskThe risk that remains after controls have been applied to treat it, and that the risk owner has to accept, transfer or treat further.
- Risk AppetiteThe amount and type of risk an organisation is willing to accept in pursuit of its objectives.
- Risk AssessmentThe process of identifying risks, then analyzing and evaluating them by their likelihood and impact to decide which need treatment.
- Risk MatrixA grid that plots risks by likelihood and impact to help rank and compare them.
- Risk OwnerThe person accountable for a specific risk and the decisions about how it is treated.
- Risk RegisterThe central record of identified risks, their assessment, owners, and treatment status.
- Risk TreatmentThe step where an organisation decides how to handle each assessed risk: reduce it, accept it, avoid the activity, or share it.
- ScopeThe boundaries of a management system: the parts of the organisation, locations, assets, and activities it covers.
- Security PolicyA high-level document approved by top management that states an organisation's intentions and direction for protecting information.
- Stage 1 AuditThe first part of an initial certification audit, a readiness review that checks whether the management system is documented and ready for the main audit.
- Stage 2 AuditThe main certification audit, where an auditor gathers evidence that the management system is implemented and operating effectively.
- Surveillance AuditA periodic audit during a certificate's validity period that confirms the management system continues to operate and improve.
- Top ManagementThe person or group that directs and controls an organisation at the highest level, accountable for the management system under ISO standards.
Information security
61
- Access ControlThe selective restriction of who can view or use resources, enforced through identification, authentication, and authorization.
- Annex A ControlsThe catalogue of information security controls in ISO/IEC 27001, grouped into organisational, people, physical, and technological themes.
- AssetAnything of value to an organisation that needs protection, such as data, systems, people, or facilities.
- Attack SurfaceThe sum of all points where an attacker could try to enter or extract data from a system or organisation.
- AvailabilityThe property that information and systems are accessible and usable when authorised users need them.
- BackupA protected, recoverable copy of data or system state used to restore information and services after loss, corruption, failure, or attack.
- BSI C5The BSI's Cloud Computing Compliance Criteria Catalogue, a German standard for assessing the security of cloud service providers.
- BSI IT-GrundschutzBSI IT-Grundschutz explained: the BSI's methodology and module catalogue, the 200-series standards and the route to ISO 27001 certification on that basis.
- CIA TriadThe three core goals of information security: confidentiality, integrity, and availability.
- ConfidentialityThe property that information is accessible only to those authorised to have it.
- ControlA measure that reduces risk, by modifying a threat, a vulnerability, or the impact of an incident.
- CVE (Common Vulnerabilities and Exposures)A public, standardised identifier assigned to a specific known security vulnerability.
- CVSS (Common Vulnerability Scoring System)An open framework that rates the severity of a vulnerability on a scale from 0 to 10.
- Cyber Resilience Act (CRA)An EU regulation that sets cybersecurity requirements for products with digital elements across their entire lifecycle.
- Data ClassificationThe practice of labelling information by sensitivity so that the right level of protection is applied to each category.
- Defense in DepthA strategy of layering multiple, independent security controls so that if one fails, others still protect the asset.
- DLP (Data Loss Prevention)Technology and rules that detect and block sensitive data from leaving an organisation through email, uploads, or removable media.
- DORA (Digital Operational Resilience Act)An EU regulation that sets uniform requirements for the digital operational resilience of the financial sector, including ICT risk management and third-party oversight.
- EDR (Endpoint Detection and Response)Software on laptops, servers, and devices that continuously monitors for malicious activity and helps responders investigate and contain it.
- EncryptionThe process of converting information into a coded form so that only authorised parties holding the key can read it.
- FirewallA network security control that filters traffic between networks based on defined rules, allowing legitimate connections and blocking unwanted ones.
- Identity and Access Management (IAM)The framework of policies and technology that manages digital identities and controls their access to resources.
- ImpactThe magnitude of harm if a risk scenario occurs, assessed against defined operational, financial, legal, safety, and reputational criteria.
- Incident ResponseThe organised approach to detecting, containing, eradicating, and recovering from security incidents, and learning from them.
- IntegrityThe property that information remains accurate, complete, and unaltered except by authorised means.
- ISMS (Information Security Management System)The management system that governs how an organisation identifies, treats, and monitors information security risks, defined primarily by ISO/IEC 27001.
- ISO/IEC 27001The international standard that specifies the requirements for an information security management system (ISMS) and is the most widely recognised security certification.
- ISO/IEC 27002The companion guidance to ISO/IEC 27001 that explains how to implement each information security control in detail.
- ISO/IEC 27017A guidance standard that adds cloud-specific information security controls on top of ISO/IEC 27002.
- IT-Grundschutz ModelingThe assignment of suitable IT-Grundschutz Compendium modules to the target objects identified during structural analysis.
- KRITIS (Critical Infrastructure)The German term for critical infrastructure: sectors whose failure would seriously threaten public supply and safety.
- Least PrivilegeThe principle of granting each user or process only the access rights it needs to do its job, and no more.
- LikelihoodThe chance that a given risk scenario will actually occur, used together with impact to rate a risk.
- Logging and MonitoringThe recording of system and security events and their ongoing review to detect anomalies and support investigations.
- MalwareMalicious software designed to damage, disrupt, or gain unauthorized access to systems and data.
- Multi-Factor Authentication (MFA)An authentication method that requires two or more independent factors to verify a user's identity.
- NIS2 DirectiveThe EU directive that expands cybersecurity obligations for essential and important entities, including risk management measures and incident reporting.
- NIST Cybersecurity Framework (CSF)A voluntary US framework that organizes cybersecurity activities into a set of high-level functions to help organisations manage risk.
- Patch ManagementThe process of acquiring, testing, and applying software updates to fix vulnerabilities and keep systems current.
- PCI DSSThe Payment Card Industry Data Security Standard, a mandatory standard for organisations that store, process, or transmit cardholder data.
- Penetration TestAn authorised, simulated attack on systems or applications to find and demonstrate exploitable security weaknesses.
- PhishingA social engineering attack that tricks people into revealing credentials or sensitive data, usually through deceptive messages.
- Protection Needs Assessment (Schutzbedarfsfeststellung)The IT-Grundschutz step that determines how strongly an information domain and its target objects need confidentiality, integrity and availability to be protected.
- RansomwareMalicious software that encrypts or blocks access to data and demands payment to restore it.
- Security Awareness TrainingEducation that helps staff recognise and respond correctly to security risks such as phishing and social engineering.
- Security IncidentAn event, or series of events, that compromises or threatens the confidentiality, integrity, or availability of information.
- Security Operations Center (SOC)A team and facility that continuously monitors, detects, and responds to security threats across an organisation.
- Segregation of DutiesThe control of splitting a sensitive task across more than one person so that no single individual can complete it alone.
- SIEM (Security Information and Event Management)A system that collects and correlates log and event data across an organisation to detect and investigate security incidents.
- SOC 2A US attestation report on a service organisation's controls relevant to security, availability, processing integrity, confidentiality, and privacy.
- Social EngineeringManipulating people into revealing information or taking actions that compromise security, rather than attacking technology directly.
- Statement of Applicability (SoA)The document that lists every ISO/IEC 27001 Annex A control, states whether it applies, and justifies each inclusion or exclusion.
- Supply Chain AttackAn attack that compromises an organisation indirectly by targeting a trusted supplier, vendor, or software component it relies on.
- Third-Party Risk ManagementThe process of assessing and controlling the security and continuity risks that suppliers and service providers introduce.
- ThreatA potential cause of an unwanted incident that could harm an asset, such as malware, human error, or a natural event.
- Threat ModelingA structured exercise to identify potential threats to a system early, so they can be designed out or mitigated.
- TISAXAn assessment and exchange mechanism for information security in the automotive industry, based on the VDA ISA catalogue.
- VulnerabilityA weakness in an asset or control that a threat can exploit to cause harm.
- Vulnerability DisclosureA defined process for receiving, assessing, and acting on reports of security weaknesses from researchers or the public.
- Vulnerability ScanAn automated check of systems against a database of known weaknesses to identify missing patches and misconfigurations.
- Zero TrustA security model that trusts no user or device by default and verifies every access request, regardless of network location.
Business continuity
11
- BCMS (Business Continuity Management System)The management system that prepares an organisation to keep critical operations running during disruptions and to recover quickly, defined by ISO 22301.
- Business Continuity Plan (BCP)The documented procedures that guide an organisation in responding to a disruption and continuing or recovering critical activities.
- Business Impact Analysis (BIA)The analysis that identifies an organisation's critical activities and the effect over time of their disruption, setting the basis for recovery priorities.
- Crisis ManagementThe capability to lead, decide, and communicate during a major disruptive event that exceeds normal response.
- Disaster RecoveryThe technology-focused part of continuity that restores IT systems, data, and infrastructure after a disruptive event.
- ISO 22301The international standard for a business continuity management system (BCMS), specifying how to prepare for, respond to, and recover from disruptions.
- Maximum Tolerable Period of Disruption (MTPD)The longest time an activity can be unavailable before the resulting harm to the organisation becomes unacceptable.
- Recovery Point Objective (RPO)The maximum amount of data, measured as time, that an organisation can afford to lose in a disruption.
- Recovery Test (Wiederanlauftest)The test that measures whether a process is workable again within its RTO after an outage, and how much data is actually lost on the way there.
- Recovery Time Objective (RTO)The target time within which a disrupted activity or system must be restored after an incident.
- Tabletop ExerciseA discussion-based rehearsal in which a team walks through its response to a simulated scenario to test plans and roles.
Data protection
29
- Adequacy DecisionA formal decision by the European Commission that a non-EU country provides a level of data protection essentially equivalent to the EU, allowing free data transfers there.
- AnonymizationIrreversibly processing data so that individuals can no longer be identified, which takes it outside the scope of the GDPR.
- Automated Decision-MakingDecisions made solely by automated means, without meaningful human involvement, which the GDPR restricts when they have legal or similarly significant effects.
- ConsentA freely given, specific, informed, and unambiguous agreement by a data subject to the processing of their personal data.
- Data ControllerThe party that determines the purposes and means of processing personal data, and bears primary responsibility under the GDPR.
- Data MinimizationThe GDPR principle that personal data collected must be adequate, relevant, and limited to what is necessary for the purpose.
- Data Processing Agreement (DPA)The contract required between a controller and processor that governs how the processor may handle personal data.
- Data ProcessorA party that processes personal data on behalf of a controller, bound by the controller's instructions and a contract.
- Data Protection Impact Assessment (DPIA)An assessment of the privacy risks of a processing activity that is likely to result in a high risk to individuals.
- Data Protection Officer (DPO)An independent expert who advises an organisation on data protection obligations and monitors compliance with the GDPR.
- Data RetentionThe defined periods for which data is kept before it is deleted or anonymized, balancing legal duties against minimization.
- Data SubjectThe identified or identifiable individual to whom personal data relates and who holds rights over that data.
- DSMS (Data Protection Management System)The management system that organizes how an organisation meets data protection obligations such as the GDPR, covering lawful processing, data subject rights, and accountability.
- GDPRThe EU General Data Protection Regulation, the comprehensive law governing how personal data of individuals in the EU may be processed.
- International Data TransferThe transfer of personal data to a country outside the EU or EEA, which the GDPR permits only under specific safeguards.
- ISO/IEC 27701An extension to ISO/IEC 27001 and 27002 that adds requirements for a privacy information management system (PIMS).
- Joint ControllerTwo or more controllers that jointly determine the purposes and means of processing personal data, sharing responsibility under the GDPR.
- Legitimate InterestA legal basis under the GDPR that allows processing of personal data when an organisation's interests are not overridden by the rights of the individual.
- Personal DataAny information relating to an identified or identifiable natural person, the central concept the GDPR protects.
- Personal Data BreachA breach of security leading to the destruction, loss, alteration, or unauthorized disclosure of or access to personal data.
- Privacy by Design and by DefaultThe GDPR requirement to build data protection into systems from the outset and to apply the most protective settings by default.
- PseudonymizationProcessing personal data so it can no longer be attributed to a person without separately kept additional information.
- Records of Processing Activities (RoPA)The documented inventory of an organisation's personal data processing activities, required by the GDPR.
- Right to Data PortabilityThe GDPR right of individuals to receive their personal data in a structured, common format and to transmit it to another provider.
- Right to ErasureThe GDPR right of individuals to have their personal data deleted in certain circumstances, also known as the right to be forgotten.
- Special Category DataSensitive personal data under the GDPR, such as health, biometrics, or beliefs, that receives stronger protection and stricter processing conditions.
- Standard Contractual Clauses (SCCs)Pre-approved contract terms issued by the European Commission that provide a lawful basis for transferring personal data outside the EEA.
- Sub-processorA third party engaged by a processor to carry out specific processing of personal data on behalf of the controller.
- Supervisory AuthorityAn independent public authority established under the GDPR to monitor and enforce its application, handle complaints, and exercise corrective powers.
AI governance
18
- AI BiasSystematic, unfair skew in an AI system's outputs that can disadvantage certain groups or individuals.
- AI LiteracyThe skills and understanding that let people deploy and use AI systems responsibly and recognise their opportunities and risks.
- AI RiskThe risks specific to artificial intelligence systems, including bias, opacity, unsafe outputs, and loss of human control.
- AIMS (AI Management System)The management system that governs the responsible development and use of artificial intelligence, defined by ISO/IEC 42001.
- CE MarkingA mark a manufacturer applies to declare that a product meets EU requirements, extended by the AI Act to certain high-risk AI systems.
- Conformity AssessmentThe process of demonstrating that a product or system, such as a high-risk AI system, meets the legal requirements before it is placed on the market.
- EU AI ActThe EU regulation that governs artificial intelligence using a risk-based approach, with the strictest obligations for high-risk AI systems.
- ExplainabilityThe degree to which the reasoning behind an AI system's outputs can be understood and explained to people.
- General-Purpose AI (GPAI)An AI model that can perform a wide range of tasks and be integrated into many different systems, regulated under specific provisions of the EU AI Act.
- Generative AIAI systems that create new content such as text, images, audio, or code, often built on large foundation models.
- High-Risk AI SystemUnder the EU AI Act, an AI system whose use poses significant risk to health, safety, or fundamental rights, subject to strict requirements.
- Human OversightMeasures that keep people able to monitor, intervene in, and override the operation of an AI system.
- ISO/IEC 42001The first international management system standard for artificial intelligence, specifying requirements for an AI management system (AIMS).
- Model CardA short, structured document that describes an AI model's purpose, performance, limitations, and intended use.
- Notified BodyAn independent organisation designated by an EU country to assess the conformity of certain high-risk products before they reach the market.
- Post-Market MonitoringThe ongoing duty to track how an AI system performs after deployment and to act on problems that emerge in real use.
- Prohibited AI PracticesUses of AI that the EU AI Act bans outright because they pose an unacceptable risk to fundamental rights.
- Training DataThe data used to teach a machine learning model, whose quality and representativeness strongly shape the model's behaviour.
In KaitoSec everyone works with the same terms.
Security, IT and leadership share terms, data and evidence in one system. We show you in thirty minutes.