Glossary terms starting with B

71 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.

BGP HijackingInformation Security: An attack that maliciously reroutes internet traffic by corrupting Border Gateway Protocol routing tables to redirect traffic through attacker-controlled networks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
BIA (Business Impact Analysis)Risk Management: A process that identifies critical business functions and determines the impact of disruption. Used to set recovery time objectives (RTO) and recovery point objectives (RPO).Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
BYOD SecurityInformation Security: Security policies and controls for managing risks associated with employees using personal devices to access corporate networks, data, and applications.Used in: CIS Controls v8, NIST SP 800-53 Rev 5
BackdoorInformation Security: A hidden method for bypassing normal authentication or encryption in a computer system, often installed by attackers or built into software for maintenance.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Backup EncryptionInformation Security: The application of encryption to backup data to protect it from unauthorized access even if backup media is lost, stolen, or compromised.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Backup PolicyInformation Security: A documented policy defining requirements for data backup including frequency, scope, retention, encryption, and testing procedures.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Backup StrategyInformation Security: A documented plan defining what data is backed up, how frequently, where backups are stored, and how they are tested and restored.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Backup VerificationInformation Security: The process of testing backup data to confirm it is complete, intact, and can be successfully restored when needed.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Backup and RecoveryInformation Security: The processes and technologies for creating copies of data and systems so they can be restored after data loss, corruption, or disaster. Backup frequency and retention policies are defined by business requirements and regulatory obligations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
BaitingInformation Security: A social engineering attack that lures victims with something enticing, such as a USB drive left in a public area loaded with malware.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Bandwidth ManagementInformation Security: The allocation and control of network bandwidth to ensure optimal performance and prevent network abuse or congestion.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Bandwidth ThrottlingInformation Security: A network management technique that limits the data transfer rate to prevent network congestion or mitigate denial-of-service attack impacts.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Banking RegulationCompliance and Regulatory: The framework of laws and rules governing banking operations including capital requirements, lending practices, consumer protection, and risk management.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0
Banner GrabbingInformation Security: A technique used to gather information about a computer system on a network by reading the banner messages displayed by services running on the target. Often used in vulnerability scanning and reconnaissance.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Basel IIICompliance: An international regulatory framework developed by the Basel Committee on Banking Supervision that sets minimum capital requirements, leverage ratios, and liquidity requirements for banks to strengthen regulation, supervision, and risk management.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0
BaselineInformation Security: A minimum set of security controls or configurations established as a starting point. Baselines can be tailored based on an organisation's risk profile and operating environment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Bastion HostInformation Security: A specially hardened computer on a network designed to withstand attacks and serve as a single point of entry to internal resources. Bastion hosts are typically placed in a DMZ and run minimal services.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
Behavioral AnalyticsInformation Security: The use of machine learning and statistical analysis to identify unusual patterns in user or entity behavior that may indicate security threats.Used in: EU AI Act, ISO 27001:2022, NIST Cybersecurity Framework 2.0
BenchmarkingGovernance: The process of comparing an organization's practices, processes, and performance metrics to industry best practices or peer organizations.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Bias DetectionAI & Technology: The process of identifying and measuring systematic biases in AI models and their outputs. Bias detection involves statistical testing across protected characteristics such as race, gender, age, and disability.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Binary AnalysisInformation Security: The examination of compiled executable files to understand their functionality, identify vulnerabilities, and detect malicious code without source code.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Binding Corporate RulesPrivacy and Data Protection: Internal policies adopted by multinational corporations for transferring personal data within the group across international borders in compliance with data protection laws.Used in: GDPR, ISO 27001:2022
Binding Corporate Rules (BCRs)Privacy: Internal rules adopted by a multinational group of companies that define their global policy regarding international transfers of personal data within the group. BCRs must be approved by the relevant data protection authority.Used in: GDPR, ISO 27001:2022
Biometric Access ControlInformation Security: Physical access control systems that use biological characteristics such as fingerprints, iris scans, or facial recognition to verify identity.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Biometric AuthenticationInformation Security: The use of unique biological characteristics such as fingerprints, facial recognition, iris scans, or voice patterns to verify the identity of a user. Considered a strong form of authentication.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Biometric DataPrivacy: Personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, such as facial images or fingerprint data. Classified as special category data under GDPR.Used in: GDPR, ISO 27001:2022
BitlockerInformation Security: A full disk encryption feature included with Microsoft Windows that protects data by encrypting the entire operating system drive.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Black Box TestingInformation Security: A security testing approach where the tester has no prior knowledge of the target system's internal workings, simulating an external attacker.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
BlacklistingInformation Security: A security approach that blocks known malicious entities such as IP addresses, domains, or file hashes while allowing everything else by default.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Block CipherInformation Security: A symmetric encryption algorithm that operates on fixed-size blocks of data. Common block ciphers include AES (Advanced Encryption Standard) and 3DES.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
BlockchainAI and Technology: A distributed, immutable ledger technology that records transactions across multiple computers, providing transparency, security, and verification without central authority.Used in: PCI DSS v4.0, EU AI Act
Blockchain SecurityAI and Technology: Security measures for protecting blockchain networks, smart contracts, wallets, and decentralized applications from attacks and vulnerabilities.Used in: EU AI Act
BlowfishInformation Security: A symmetric block cipher algorithm designed as a fast, free alternative to existing encryption methods. While once popular, it has largely been superseded by AES for most applications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Blue TeamInformation Security: The defensive security team responsible for maintaining and improving an organization's security posture by detecting, responding to, and mitigating threats.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Bluetooth SecurityInformation Security: Security protocols and practices for protecting wireless communications over Bluetooth connections from eavesdropping, unauthorized pairing, and data theft.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Board OversightGovernance: The responsibility of a board of directors to supervise management activities, ensure accountability, and provide strategic direction. Board oversight of cybersecurity and compliance has become a regulatory expectation under NIST CSF 2.0, SEC rules, and corporate governance codes.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
Board Risk CommitteeGovernance: A committee of the board of directors specifically responsible for overseeing the organization's risk management framework and risk appetite.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
Boot IntegrityInformation Security: Security mechanisms that verify the integrity of the boot process, ensuring that only authenticated and unmodified code executes during system startup.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Boot Sector VirusInformation Security: Malware that infects the boot sector of a storage device, activating during the system startup process before the operating system loads.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
BotnetInformation Security: A network of compromised computers (bots) controlled remotely by a threat actor to perform coordinated malicious activities such as distributed denial-of-service attacks, spam distribution, or cryptocurrency mining.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Boundary DefenseInformation Security: Security controls deployed at network boundaries to monitor, filter, and protect traffic entering and leaving the organization's network.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Boundary ProtectionInformation Security: Security measures implemented at the boundaries between network zones to monitor and control communications, preventing unauthorized access between segments.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Bow-Tie AnalysisRisk Management: A risk analysis method that visually maps the pathways from causes to consequences of a risk event, showing preventive and mitigating controls.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Breach AssessmentInformation Security: The evaluation of a security incident to determine the scope, severity, and impact of a data breach on affected individuals and the organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Breach ContainmentInformation Security: Immediate actions taken to limit the spread and impact of a data breach, including isolating affected systems and blocking malicious access.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Breach NotificationInformation Security: The legal requirement to inform affected individuals, regulators, or other parties when personal data has been compromised. GDPR requires notification within 72 hours.Used in: GDPR, ISO 27001:2022
Breach PenaltyCompliance and Regulatory: Financial sanctions imposed by regulators on organizations that fail to comply with data breach notification requirements or other regulatory obligations.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Breach RegisterPrivacy and Data Protection: A documented log of all personal data breaches including their nature, affected individuals, consequences, and remedial actions taken.Used in: GDPR, ISO 27001:2022
Breach ResponseInformation Security: The coordinated set of actions taken by an organization following the discovery of a data breach, including investigation, notification, and remediation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Breach and Attack SimulationInformation Security: Automated platforms that continuously simulate attacks across the kill chain to validate the effectiveness of security controls and detection capabilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Break Glass AccountInformation Security: An emergency access account that bypasses normal access controls during critical situations, with strict monitoring and post-use review procedures.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Browser SecurityInformation Security: Security measures and configurations for web browsers to protect against web-based threats including malicious websites, extensions, and exploits.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Brute Force AttackInformation Security: An attack method that systematically tries every possible combination of passwords or encryption keys until the correct one is found. Mitigated by account lockout policies, rate limiting, and strong password requirements.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Buffer OverflowInformation Security: A software vulnerability that occurs when a program writes more data to a buffer than it can hold, potentially allowing an attacker to execute arbitrary code. Buffer overflows are among the most common and dangerous security flaws.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Bug Bounty ProgramInformation Security: A crowdsourced security initiative that rewards external researchers for discovering and responsibly disclosing software vulnerabilities to the organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Bug TrackingInformation Security: The process of logging, categorizing, prioritizing, and managing software bugs and security vulnerabilities from discovery through resolution.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Building SecurityInformation Security: Physical security measures protecting an organization's buildings and facilities from unauthorized access, theft, vandalism, and environmental threats.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Business ArchitectureGovernance: The description of an organization's structure, capabilities, and value streams that aligns business strategy with tactical execution.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Business AssociateCompliance: Under HIPAA, a person or entity that performs certain functions or activities involving the use or disclosure of Protected Health Information on behalf of a covered entity. Business associates must comply with HIPAA Security and Breach Notification Rules.Used in: HIPAA Security Rule
Business Associate AgreementCompliance and Regulatory: A HIPAA-required contract between a covered entity and a business associate that establishes permissible uses and disclosures of PHI.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Business Associate Agreement (BAA)Compliance: A legally binding contract between a HIPAA covered entity and a business associate that establishes the permitted and required uses and disclosures of Protected Health Information. BAAs are mandatory under HIPAA.Used in: HIPAA Security Rule
Business ContinuityRisk Management: The capability of an organisation to continue delivering products or services at acceptable levels following a disruptive incident. Governed by frameworks like ISO 22301.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Business Continuity ManagementBusiness Continuity: A holistic management process that identifies potential threats and their impacts, providing a framework for building organizational resilience.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Business Continuity PlanBusiness Continuity: A documented strategy defining how an organization will continue to operate during and after a significant disruption to its normal business operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Business Continuity PolicyBusiness Continuity: A high-level statement of an organization's commitment to maintaining operational continuity and defining the scope and objectives of its BCM program.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Business Continuity TestingBusiness Continuity: Exercises and tests conducted to validate that business continuity plans are effective, current, and capable of achieving recovery objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Business Email CompromiseInformation Security: A sophisticated scam targeting organisations that conduct wire transfers or handle sensitive financial data. Attackers impersonate executives or trusted partners to trick employees into transferring funds or disclosing confidential information.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Business Impact AnalysisRisk Management: A systematic process for identifying and evaluating the potential effects of disruptions to critical business operations and processes.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Business Process ManagementGovernance: The discipline of managing and optimizing an organization's business processes to improve efficiency, effectiveness, and adaptability.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Business ResumptionBusiness Continuity: The process of returning to normal business operations after a disruption, including verification that all critical functions are restored.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Business RiskRisk Management: The potential for events or conditions to adversely affect an organization's ability to achieve its business objectives and maintain operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Terms starting with A All letters Terms starting with C