Glossary terms starting with A

Terms

AI AccountabilityAI and Technology

The principle that organizations and individuals should be answerable for the outcomes and impacts of AI systems they develop or deploy.Used in: EU AI Act

AI AlignmentAI and Technology

The challenge of ensuring that AI systems pursue goals and behaviors that are aligned with human values, intentions, and ethical principles.Used in: EU AI Act

AI AssuranceAI and Technology

Processes and methods for providing confidence that AI systems operate as intended, producing reliable, fair, and safe outcomes.Used in: ISO 27001:2022, EU AI Act

AI AuditAI and Technology

A systematic examination of AI systems to evaluate their fairness, transparency, safety, security, and compliance with applicable regulations.Used in: ISO 27001:2022, EU AI Act

AI BiasAI & Technology

Systematic errors in AI system outputs that result from biased assumptions in the machine learning process or biased training data. AI bias can lead to unfair or discriminatory outcomes and is a key concern of AI governance frameworks.Used in: EU AI Act, COBIT 2019, ISO 27001:2022

AI ClassificationAI and Technology

The categorization of AI systems based on their risk level, capability, or application domain, as defined by regulations like the EU AI Act.Used in: EU AI Act

AI ComplianceCompliance and Regulatory

Adherence to emerging regulations governing the development, deployment, and use of artificial intelligence systems, including the EU AI Act.Used in: EU AI Act, ISO 27001:2022, NIST Cybersecurity Framework 2.0

AI Compliance FrameworkAI and Technology

A structured set of requirements and guidelines for ensuring AI systems are developed and deployed in compliance with applicable regulations.Used in: EU AI Act

AI Data GovernanceAI and Technology

Policies and processes for managing the data used to train and operate AI systems, ensuring quality, privacy, and regulatory compliance.Used in: GDPR, ISO 27001:2022, COBIT 2019

AI DocumentationAI and Technology

Records describing AI system design, training data, performance metrics, limitations, and intended use, supporting transparency and accountability.Used in: EU AI Act

AI EthicsAI & Technology

The branch of ethics that examines the moral implications of artificial intelligence systems, including issues of fairness, transparency, accountability, privacy, and the societal impact of AI decision-making.Used in: GDPR, ISO 27001:2022, EU AI Act

AI ExplainabilityAI and Technology

The ability to understand and describe how an AI model reaches its decisions or predictions, supporting transparency, trust, and regulatory compliance.Used in: EU AI Act

AI FairnessAI and Technology

The principle and practice of ensuring AI systems do not produce discriminatory outcomes or perpetuate biases against any group of individuals.Used in: EU AI Act

AI GovernanceAI & Technology

The framework of policies, processes, and organisational structures that ensure AI systems are developed and deployed responsibly, ethically, and in compliance with applicable laws and regulations.Used in: EU AI Act, COBIT 2019, ISO 27001:2022

AI Impact AssessmentAI & Technology

A systematic evaluation of the potential effects of an AI system on individuals, groups, and society. AI impact assessments examine risks related to fairness, privacy, safety, transparency, and human rights.Used in: GDPR, ISO 27001:2022, EU AI Act

AI IncidentAI and Technology

An event involving an AI system that causes or could cause harm to individuals, organizations, or society, requiring investigation and response.Used in: EU AI Act

AI Lifecycle ManagementAI and Technology

The governance of AI systems throughout their entire lifecycle from conception and development through deployment, monitoring, and retirement.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

AI Model GovernanceAI & Technology

The processes and controls for managing AI models throughout their lifecycle, including development, validation, deployment, monitoring, and retirement. Model governance ensures accuracy, fairness, and compliance.Used in: EU AI Act, COBIT 2019, ISO 27001:2022

AI Model RiskAI and Technology

The potential for adverse consequences arising from decisions based on AI models that are incorrect, misused, or produce unintended outcomes.Used in: EU AI Act

AI MonitoringAI and Technology

The continuous observation and evaluation of AI system performance, behavior, and outputs to detect drift, bias, errors, or security issues.Used in: EU AI Act, NIST Cybersecurity Framework 2.0, CIS Controls v8

AI PolicyAI and Technology

Organizational or governmental policies that define principles, requirements, and guidelines for the development, deployment, and use of AI systems.Used in: EU AI Act

AI Red TeamingAI and Technology

Structured testing of AI systems by dedicated teams to identify safety risks, vulnerabilities, biases, and unintended behaviors before deployment.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

AI RegulationAI and Technology

Laws and regulatory frameworks governing the development, deployment, and use of artificial intelligence systems to ensure safety and protect rights.Used in: EU AI Act

AI Risk AssessmentAI and Technology

A systematic evaluation of the potential harms and risks associated with an AI system, including bias, safety, security, and societal impacts.Used in: EU AI Act

AI Risk ManagementAI & Technology

The process of identifying, assessing, and mitigating risks associated with AI systems. The NIST AI Risk Management Framework provides a structured approach organised around four functions: Govern, Map, Measure, and Manage.Used in: NIST Cybersecurity Framework 2.0, EU AI Act

AI Risk Management FrameworkAI and Technology

A structured approach for identifying, assessing, and mitigating risks associated with AI systems throughout their lifecycle.Used in: NIST Cybersecurity Framework 2.0, EU AI Act

AI SafetyAI and Technology

Research and practices aimed at ensuring AI systems operate safely, reliably, and without causing unintended harm to individuals or society.Used in: EU AI Act

AI SecurityAI and Technology

Measures to protect AI systems from adversarial attacks, data poisoning, model theft, and other threats specific to machine learning systems.Used in: EU AI Act

AI Supply Chain RiskAI and Technology

Risks arising from dependencies on third-party AI models, training data, cloud services, and components used in AI system development.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, EU AI Act

AI TestingAI and Technology

Methods for evaluating AI systems including functional testing, bias testing, adversarial testing, and performance benchmarking.Used in: EU AI Act

AI TransparencyAI & Technology

The principle that AI system operations and decisions should be understandable and open to examination. Transparency includes documenting data sources, model architecture, training processes, and decision-making logic.Used in: EU AI Act

AI WatermarkingAI and Technology

Techniques for embedding identifiable markers in AI-generated content to enable detection and attribution of synthetically produced media.Used in: EU AI Act

AICPAAudit and Assurance

The American Institute of Certified Public Accountants, which develops auditing standards and the SOC reporting framework for service organizations.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

AML (Anti-Money Laundering)Compliance

Laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

API SecurityCloud Security

Practices and technologies for protecting application programming interfaces from attacks, abuse, and unauthorized access while ensuring proper authentication and data protection.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR

APRA CPS 234Compliance and Regulatory

The Australian Prudential Regulation Authority's standard requiring regulated financial entities to maintain information security capabilities.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

ARP SpoofingInformation Security

An attack where a malicious actor sends falsified ARP messages to link their MAC address with a legitimate IP address on a local network.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Abuse CaseInformation Security

A security testing technique that identifies ways a system could be misused by threat actors, complementing traditional use case analysis.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Acceptable RiskRisk Management

A risk that has been evaluated and determined to be within the organization's risk tolerance, requiring no additional mitigation.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Acceptable Risk LevelRisk Management

The amount of risk that an organization is prepared to accept, tolerate, or be exposed to at any point in time.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Acceptable UseGovernance

The agreed-upon rules governing how users may utilize an organization's IT resources, including internet, email, and software.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Acceptable Use PolicyInformation Security

A document that outlines the rules and guidelines for using an organization's IT resources, defining permitted and prohibited activities for users.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Acceptance CriteriaRisk Management

Predefined conditions that a risk, control, or deliverable must meet to be formally accepted, serving as a benchmark for risk-based decision-making.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Access BadgeInformation Security

A physical credential such as a smart card or proximity badge used to control entry to secure areas and track personnel movements.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Access BrokerInformation Security

A threat actor who specializes in gaining initial access to organizations and selling that access to other cybercriminals for further exploitation.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Access CertificationInformation Security

The periodic review and validation of user access rights to ensure that permissions remain appropriate for each user's current role and responsibilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Access ControlInformation Security

Security measures that regulate who can view or use resources in a computing environment. Access controls include authentication, authorisation, and audit mechanisms.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Access Control ListInformation Security

A list of rules that specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Access Control MatrixInformation Security

A table that defines the access permissions of subjects to objects in a system, mapping users and roles to specific resource permissions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Access GovernanceGovernance

Policies and processes for ensuring that user access rights are appropriately granted, reviewed, and revoked based on organizational requirements.Used in: COBIT 2019, ISO 27001:2022

Access LogInformation Security

A record of all access attempts to a system or resource, including successful and failed attempts, used for security monitoring and audit purposes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Access ManagementInformation Security

The set of processes and technologies used to manage and control user access to systems, applications, and data based on defined policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Access PointInformation Security

A physical location or network device where users connect to an organization's network, requiring security controls to prevent unauthorized access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Access PolicyInformation Security

A documented set of rules defining who is authorized to access specific resources, under what conditions, and with what level of permission.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Access ProvisioningInformation Security

The process of granting users the appropriate access rights and permissions to systems and resources based on their role and business need.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Access RecertificationInformation Security

A periodic review process where managers verify that existing user access rights remain appropriate and revoke any unnecessary permissions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Access RequestPrivacy and Data Protection

A formal request by a data subject to obtain information about what personal data an organization holds about them and how it is processed.Used in: GDPR, ISO 27001:2022

Access ReviewInformation Security

A periodic evaluation of user access rights and permissions to verify they remain appropriate, required by most compliance frameworks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Access TokenInformation Security

A digital credential that represents the authorization granted to a user or application to access specific resources or perform specific operations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Accessibility ComplianceCompliance and Regulatory

Adherence to laws and standards requiring digital content and services to be accessible to people with disabilities, such as WCAG and ADA requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Account LockoutInformation Security

A security feature that temporarily disables a user account after a specified number of failed authentication attempts to prevent brute force attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Account ManagementInformation Security

The processes for creating, modifying, monitoring, and removing user accounts throughout their lifecycle.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

AccountabilityGovernance

The obligation of an individual or organization to account for their activities, accept responsibility for outcomes, and disclose results transparently.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

AccreditationCompliance

Formal recognition by an authoritative body that an organisation is competent to carry out specific tasks, such as certification audits or testing.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Accreditation BodyCompliance and Regulatory

An organization that evaluates and confirms the competence of certification bodies, laboratories, and inspection bodies to perform specific conformity assessments.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Accredited Certification BodyCompliance

An organisation that has been formally recognised by an accreditation body (such as UKAS or ANAB) as competent to conduct certification audits against specific standards such as ISO 27001 or ISO 9001.Used in: ISO 27001:2022, ISO 9001:2015

Active DefenseInformation Security

Security strategies that proactively seek to detect, respond to, and counter adversary actions rather than relying solely on passive preventive measures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Active Directory SecurityInformation Security

Security measures and configurations applied to Microsoft Active Directory to protect identity management, authentication, and authorization services from unauthorized access and attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Ad Tech PrivacyPrivacy and Data Protection

Privacy concerns and regulations related to advertising technology including behavioral tracking, targeted advertising, and real-time bidding of user data.Used in: GDPR, ISO 27001:2022

Adaptive AuthenticationInformation Security

An authentication approach that dynamically adjusts security requirements based on contextual risk factors such as location, device, and user behavior.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Address Space Layout RandomizationInformation Security

A memory protection technique that randomizes the positions of key data areas in a process address space to prevent exploitation of memory corruption vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Adequacy DecisionPrivacy

A determination by the European Commission that a non-EU country provides an adequate level of data protection. Adequacy decisions enable the free flow of personal data to the third country without additional safeguards.Used in: GDPR, ISO 27001:2022

Administrative AccessInformation Security

Elevated system privileges that allow users to perform configuration changes, install software, and manage other user accounts on a system.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Advanced Encryption StandardInformation Security

A symmetric block cipher algorithm (AES) adopted as an encryption standard, using key sizes of 128, 192, or 256 bits to protect classified and sensitive data.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Advanced Persistent ThreatInformation Security

A prolonged and targeted cyber attack in which an intruder gains access to a network and remains undetected for an extended period. APTs typically target high-value organisations such as governments and large enterprises.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Adversary SimulationInformation Security

Security testing that emulates the tactics, techniques, and procedures of real-world threat actors to evaluate an organization's detection and response capabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Advertising ComplianceCompliance and Regulatory

Adherence to laws and regulations governing advertising practices, including truth in advertising, disclosure requirements, and sector-specific restrictions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

AdwareInformation Security

Software that automatically displays or downloads advertising material when a user is online, often bundled with free programs and potentially compromising privacy.Used in: GDPR, ISO 27001:2022

Aerospace ComplianceCompliance and Regulatory

Regulatory requirements specific to the aerospace industry including safety standards, export controls, and quality management systems like AS9100.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Age VerificationPrivacy and Data Protection

Mechanisms used to verify the age of users accessing online services, particularly relevant for protecting children's privacy and complying with age-based regulations.Used in: GDPR, ISO 27001:2022

Aggregation AttackInformation Security

A technique where individually non-sensitive pieces of information are combined to derive sensitive data, bypassing classification controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Agricultural ComplianceCompliance and Regulatory

Regulations governing agricultural practices including food safety, pesticide use, environmental protection, and animal welfare standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Air GapInformation Security

A security measure that physically isolates a computer or network from unsecured networks, including the internet. Air-gapped systems are used in high-security environments to prevent remote cyber attacks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Air-Gapped NetworkInformation Security

A network physically isolated from other networks and the internet, providing maximum security for highly sensitive systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Alarm SystemInformation Security

A security system designed to detect and alert on unauthorized entry, environmental hazards, or other security-relevant events at physical locations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Alert CorrelationInformation Security

The process of linking related security alerts from multiple sources to identify patterns that indicate a coordinated attack or significant incident.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Alert FatigueInformation Security

A condition where security analysts become desensitized to alerts due to high volumes of false positives, potentially causing real threats to be overlooked.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Alert TriageInformation Security

The process of evaluating and prioritizing security alerts to determine which require immediate investigation and response.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Algorithm AuditingAI and Technology

The examination and evaluation of algorithms and automated decision-making systems for bias, fairness, accuracy, and compliance with regulations.Used in: EU AI Act

Algorithmic AccountabilityAI & Technology

The principle that organisations developing or deploying algorithms are responsible for the outcomes those algorithms produce. Algorithmic accountability requires monitoring for bias, errors, and unintended consequences.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Algorithmic Impact AssessmentPrivacy and Data Protection

An evaluation of the potential effects of an automated decision-making system on individuals and groups, particularly regarding fairness and discrimination.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Algorithmic TransparencyAI and Technology

The practice of making the logic, data, and decision processes of algorithms understandable and accessible to affected parties.Used in: EU AI Act

Allow ListInformation Security

A cybersecurity approach that permits only pre-approved applications, IP addresses, or entities to access a system while blocking all others by default.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Alternate Processing SiteBusiness Continuity

A facility separate from the primary location where an organization can continue critical operations during a disruption to the main site.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Annex AInformation Security

The section of ISO 27001 that contains the reference set of information security controls. The 2022 revision organises 93 controls into four themes: Organisational, People, Physical, and Technological.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Annual Compliance ReviewCompliance and Regulatory

A comprehensive yearly evaluation of an organization's compliance program effectiveness, regulatory changes, and areas requiring improvement.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Anomaly DetectionInformation Security

The identification of patterns in data that deviate from expected behavior, used in security to detect intrusions, fraud, and other threats.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

AnonymisationPrivacy

The irreversible process of altering personal data so that the individual can no longer be identified, directly or indirectly. Properly anonymised data falls outside the scope of data protection regulations such as GDPR.Used in: GDPR, ISO 27001:2022

AnonymityPrivacy and Data Protection

The state of being unidentifiable within a group of subjects, where personal data cannot be linked to a specific individual by any means.Used in: GDPR, ISO 27001:2022

AnonymizationPrivacy and Data Protection

The irreversible process of altering personal data so that individuals can no longer be identified directly or indirectly, removing it from data protection regulations.Used in: GDPR, ISO 27001:2022

Anti-Bribery and CorruptionCompliance and Regulatory

Laws, regulations, and organizational policies designed to prevent bribery, corruption, and unethical business practices in domestic and international operations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Anti-MalwareInformation Security

Software designed to detect, prevent, and remove malicious software such as viruses, worms, trojans, and ransomware from computer systems and networks.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Anti-Money LaunderingCompliance and Regulatory

Regulations, policies, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income through the financial system.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Anti-PhishingInformation Security

Technologies, policies, and training programs designed to detect and prevent phishing attacks that attempt to steal credentials or deliver malware through deceptive communications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Anti-TamperingInformation Security

Security measures designed to prevent or detect unauthorized modification of hardware, software, or data to maintain system integrity.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Appliance SecurityInformation Security

Security measures for protecting dedicated hardware devices used for specific functions such as firewalls, load balancers, and storage systems.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Application AllowlistingInformation Security

A security practice that permits only pre-approved applications to execute on a system while blocking all other software from running.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Application ControlInformation Security

Security measures that restrict which applications can execute on systems, preventing unauthorized or malicious software from running.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Application Penetration TestingInformation Security

Authorized security testing focused specifically on web, mobile, or desktop applications to identify vulnerabilities in application logic and security controls.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Application SecurityInformation Security

The practice of finding, fixing, and preventing security vulnerabilities in software applications throughout the development lifecycle. Includes code review, penetration testing, and security architecture design.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022

Application Security TestingInformation Security

The process of evaluating software applications for security vulnerabilities using techniques such as static analysis, dynamic analysis, and interactive testing.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022

Asset ClassificationInformation Security

The process of categorising information assets based on their sensitivity, criticality, and value to the organisation. Classification levels typically include public, internal, confidential, and restricted.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Asset DiscoveryInformation Security

The process of identifying and cataloging all hardware, software, and data assets within an organization's IT environment to maintain an accurate inventory.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Asset InventoryInformation Security

A comprehensive and up-to-date register of all hardware, software, data, and network resources owned or managed by an organisation. Required by most security frameworks including CIS Controls and ISO 27001.Used in: ISO 27001:2022, CIS Controls v8

Asset ManagementInformation Security

The systematic process of identifying, classifying, tracking, and managing an organization's information assets throughout their lifecycle to ensure proper protection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Asset Risk AssessmentRisk Management

An evaluation of the risks associated with specific information assets, considering their value, threats, vulnerabilities, and existing controls.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Assurance EngagementAudit and Assurance

An engagement in which an auditor expresses a conclusion about the reliability of a subject matter against defined criteria to enhance stakeholder confidence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Assurance ReportAudit and Assurance

A formal document presenting the auditor's findings, conclusions, and opinion on the subject matter examined during an assurance engagement.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Asymmetric EncryptionInformation Security

A cryptographic method using a pair of mathematically related keys where one key encrypts data and the other decrypts it, enabling secure key exchange.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Attack SimulationInformation Security

Automated security testing that replicates real-world attack scenarios against an organization's defenses to validate security control effectiveness.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Attack SurfaceInformation Security

The total number of possible entry points for unauthorised access to a system. Reducing the attack surface through hardening, patching, and removing unnecessary services is a core security practice.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Attack Surface ManagementInformation Security

The continuous discovery, classification, prioritization, and monitoring of an organization's external-facing digital assets to reduce exposure to threats.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Attack VectorInformation Security

The method or pathway used by a threat actor to gain unauthorised access to a target system. Common attack vectors include phishing emails, unpatched software vulnerabilities, and compromised credentials.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

AttestationCompliance

A formal declaration by an independent party (such as a CPA firm) that an organisation's controls or processes meet specified criteria. SOC reports are a form of attestation, distinct from certification.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Attestation of ComplianceCompliance and Regulatory

A formal declaration by a qualified security assessor or the organization itself confirming compliance with a specific standard such as PCI DSS.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Attribute-Based Access ControlInformation Security

An access control paradigm that grants or denies access based on policies evaluating attributes of users, resources, actions, and the environment.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

AuditAudit

A systematic, independent examination of an organisation's activities, processes, or financial records to verify compliance with standards, regulations, or internal policies.Used in: PCI DSS v4.0

Audit CharterAudit and Assurance

A formal document that defines the audit function's purpose, authority, responsibility, and position within an organization's governance structure.Used in: ISO 27001:2022, COBIT 2019

Audit CommitteeAudit

A committee of the board of directors responsible for overseeing financial reporting, internal controls, and audit activities. Audit committees are required for publicly listed companies and play a key role in corporate governance.Used in: ISO 27001:2022, PCI DSS v4.0, COBIT 2019

Audit EvidenceAudit

Records, statements of fact, or other information that is relevant and verifiable, used by an auditor to determine whether audit criteria are being fulfilled. Audit evidence can be qualitative or quantitative.Used in: ISO 27001:2022

Audit FindingAudit

The results of evaluating collected audit evidence against audit criteria. Findings can indicate conformity or nonconformity with the criteria and may include observations or opportunities for improvement.Used in: ISO 27001:2022

Audit FrequencyAudit and Assurance

The defined schedule for conducting internal and external audits based on risk levels, regulatory requirements, and organizational needs.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit IndependenceAudit and Assurance

The requirement that auditors maintain objectivity and freedom from conflicts of interest that could influence their professional judgment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit LogAudit

A chronological record of system activities that provides documentary evidence of the sequence of activities affecting a specific operation, procedure, or event. Audit logs are essential for security monitoring, incident investigation, and compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Audit ManagementAudit and Assurance

The administration and coordination of audit activities including planning, scheduling, resource allocation, and tracking of findings and remediation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit MethodologyAudit and Assurance

The systematic approach and procedures used by auditors to plan, execute, and report on audits, ensuring consistency and thoroughness.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit NotificationAudit and Assurance

The formal communication to an auditee informing them of an upcoming audit, including scope, timing, and information requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit ObjectiveAudit and Assurance

The specific goals and scope of an audit engagement, defining what the audit seeks to evaluate, verify, or assess.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit OpinionAudit and Assurance

The auditor's formal conclusion about whether the subject matter conforms to applicable criteria, expressed as unqualified, qualified, adverse, or disclaimer.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit PlanAudit

A document that describes the activities and arrangements for an audit, including scope, objectives, timing, and resource requirements. Audit plans ensure systematic and efficient audit execution.Used in: ISO 27001:2022

Audit PreparationAudit and Assurance

The activities undertaken by an organization to ready itself for an upcoming audit, including evidence gathering and documentation review.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit ProgramAudit and Assurance

A scheduled series of audits planned for a specific period, prioritized based on risk assessment and covering key areas of the organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit ProgrammeAudit

A set of one or more audits planned for a specific time frame and directed towards a specific purpose. Audit programmes define the overall approach, scheduling, and resourcing for audit activities over a defined period.Used in: ISO 27001:2022

Audit ReadinessAudit and Assurance

The state of preparedness an organization achieves through proactive measures to ensure successful outcomes when formal audits are conducted.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit ReportAudit

The formal documentation of audit findings, conclusions, and recommendations presented at the end of an audit engagement. Audit reports communicate the results to stakeholders and management.Used in: ISO 27001:2022

Audit ReportingAudit and Assurance

The formal communication of audit results including findings, conclusions, and recommendations to management and relevant stakeholders.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit ResponseAudit and Assurance

The formal reply from audited parties addressing audit findings, including planned corrective actions, responsible parties, and implementation timelines.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit RiskAudit

The risk that an auditor expresses an inappropriate opinion when the subject matter is materially misstated. Audit risk comprises inherent risk, control risk, and detection risk.Used in: ISO 27001:2022

Audit SamplingAudit and Assurance

The application of audit procedures to less than 100% of items within a population to draw conclusions about the entire population.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit ScheduleAudit and Assurance

A planned timetable of audit activities across an organization for a defined period, typically one year, based on risk priorities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit ScopeAudit

The extent and boundaries of an audit, including the locations, organisational units, activities, and processes to be audited, as well as the time period covered by the audit.Used in: ISO 27001:2022

Audit StandardAudit and Assurance

Published guidelines and requirements that define how audits should be conducted to ensure quality, consistency, and professional practice.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit TrailAudit

A chronological record of system activities that enables the reconstruction and examination of events. Essential for forensic analysis and regulatory compliance.Used in: ISO 27001:2022

Audit UniverseAudit and Assurance

The comprehensive list of all auditable entities, processes, systems, and locations within an organization that the audit function may review.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Audit Working PapersAudit and Assurance

The documentation of audit procedures performed, evidence obtained, and conclusions reached that support the auditor's report and findings.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

AuthenticationInformation Security

The process of verifying the identity of a user, device, or system. Common methods include passwords, biometrics, tokens, and multi-factor authentication (MFA).Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Authentication FactorInformation Security

A category of credential used to verify identity, including knowledge factors, possession factors, and inherence factors like biometrics.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Authentication ProtocolInformation Security

A set of rules governing the exchange of information for verifying the identity of a user, device, or system in a communication.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

AuthorisationInformation Security

The process of determining what actions an authenticated user or system is permitted to perform. Typically enforced through access control lists or role-based access control.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Authority to Operate (ATO)Compliance

A formal authorisation granted by a senior official to operate a federal information system at an acceptable level of risk. ATO is required under FISMA and FedRAMP and is based on the assessment of security controls.Used in: NIST SP 800-53 Rev 5

AuthorizationInformation Security

The process of determining whether a user, program, or device is permitted to access a resource, perform an operation, or execute a command.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Automated Decision-MakingAI & Technology

Decisions made by algorithms or AI systems without significant human involvement. Under GDPR Article 22, individuals have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.Used in: GDPR

Automated Patch ManagementInformation Security

Systems that automatically detect, download, test, and deploy software patches across an organization's IT environment to reduce vulnerability exposure.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Automated ResponseInformation Security

Pre-configured actions that are automatically triggered when specific security events or conditions are detected, reducing response time.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Automotive CybersecurityInformation Security

Security standards and practices for protecting connected vehicles, automotive systems, and vehicle-to-everything communications from cyber threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Autonomous SystemsAI and Technology

Systems that can perform tasks and make decisions without human intervention, raising governance questions about accountability, safety, and oversight.Used in: COBIT 2019, ISO 27001:2022

AvailabilityInformation Security

The property of being accessible and usable upon demand by authorized users, one of the three pillars of information security along with confidentiality and integrity.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Aviation SecurityCompliance and Regulatory

Regulatory requirements and security measures for protecting civil aviation systems, infrastructure, and operations from threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Awareness CampaignInformation Security

An organized effort to educate employees about specific security threats and best practices through multiple communication channels.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8