Glossary terms starting with C

295 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.

CAN-SPAM ActCompliance: US federal law that establishes requirements for commercial email messages, gives recipients the right to opt out of receiving them, and imposes penalties for violations. CAN-SPAM does not require prior consent for commercial emails.Used in: GDPR, ISO 27001:2022
CAPTCHAInformation Security: A challenge-response test used to determine whether a user is human or an automated bot. CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CASB (Cloud Access Security Broker)Information Security: A security policy enforcement point placed between cloud service consumers and providers to combine and interject enterprise security policies as cloud resources are accessed. CASBs provide visibility, compliance, data security, and threat protection.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
CCPACompliance and Regulatory: The California Consumer Privacy Act gives California residents rights over their personal information including the right to know, delete, and opt out of sale.Used in: CCPA/CPRA, GDPR, ISO 27001:2022
CCPA (California Consumer Privacy Act)Privacy: California's consumer privacy law, amended by CPRA in 2023. Gives consumers rights over their personal information including the right to know, delete, opt-out, and non-discrimination.Used in: CCPA/CPRA, GDPR, ISO 27001:2022
CCPA Opt-OutPrivacy: The right of California consumers under the CCPA to direct a business that sells their personal information to stop selling it. Businesses must provide a clear 'Do Not Sell My Personal Information' link on their website.Used in: CCPA/CPRA
CIA TriadInformation Security: The three core principles of information security: Confidentiality, Integrity, and Availability, forming the foundation of security program design.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CIS BenchmarksCompliance and Regulatory: Consensus-based configuration guidelines developed by the Center for Internet Security for securely configuring IT systems and applications.Used in: CIS Controls v8, ISO 27001:2022, NIST Cybersecurity Framework 2.0
CIS ControlsCompliance and Regulatory: A prioritized set of cybersecurity best practices developed by the Center for Internet Security to help organizations defend against common cyber threats.Used in: CIS Controls v8, ISO 27001:2022, NIST Cybersecurity Framework 2.0
CISACompliance and Regulatory: The Cybersecurity and Infrastructure Security Agency, a US government agency responsible for protecting critical infrastructure from cyber and physical threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
CISA CertificationAudit and Assurance: Certified Information Systems Auditor, an ISACA certification for professionals who audit, control, monitor, and assess IT and business systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
CISM CertificationInformation Security: Certified Information Security Manager, an ISACA certification for professionals who manage, design, and oversee enterprise information security.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CISOInformation Security: The Chief Information Security Officer is the senior executive responsible for establishing and maintaining an organization's information security strategy, policies, and operations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CISO (Chief Information Security Officer)Information Security: The senior executive responsible for an organisation's information security strategy, policies, and operations. Reports to the CEO, CIO, or board depending on the organisation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CISSP CertificationInformation Security: Certified Information Systems Security Professional, a widely recognized certification for experienced security practitioners, managers, and executives.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CMMCCompliance and Regulatory: The Cybersecurity Maturity Model Certification is a US Department of Defense framework requiring defense contractors to implement cybersecurity practices at specified maturity levels.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
CMMC (Cybersecurity Maturity Model Certification)Compliance: A US Department of Defense framework requiring defence contractors to demonstrate cybersecurity maturity across five levels. Based on NIST 800-171 controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
COBITGovernance: Control Objectives for Information and Related Technologies, an IT governance framework by ISACA. COBIT 2019 provides 40 governance and management objectives across five domains.Used in: COBIT 2019, ISO 27001:2022
COSO FrameworkGovernance: The internal control framework developed by the Committee of Sponsoring Organizations of the Treadway Commission. COSO defines five components: control environment, risk assessment, control activities, information and communication, and monitoring activities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
CPS 234Compliance: An Australian Prudential Regulation Authority (APRA) standard that requires regulated entities to maintain an information security capability commensurate with information security vulnerabilities and threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
CRISC CertificationRisk Management: Certified in Risk and Information Systems Control, an ISACA certification for professionals who identify and manage IT and enterprise risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
CSA STARCloud Security: The Cloud Security Alliance Security Trust Assurance and Risk program, a framework for assessing the security posture of cloud service providers.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
CVEInformation Security: Common Vulnerabilities and Exposures, a catalog of publicly known cybersecurity vulnerabilities identified by unique CVE ID numbers.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CVSSInformation Security: The Common Vulnerability Scoring System provides a standardized method for rating the severity of security vulnerabilities on a scale of 0 to 10.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Cable SecurityInformation Security: Measures to protect network cabling from physical tampering, interception, and accidental damage that could compromise data confidentiality or availability.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cache PoisoningInformation Security: An attack that corrupts cached data to redirect users to malicious destinations, commonly targeting DNS caches and web application caches.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
California Consumer Privacy Act (CCPA)Privacy: A California state law that gives consumers more control over the personal information that businesses collect about them. CCPA provides rights to know, delete, opt-out of sale, and non-discrimination.Used in: CCPA/CPRA, GDPR, ISO 27001:2022
California Privacy Rights ActPrivacy and Data Protection: A California state law (CPRA) that amends and expands the CCPA, establishing the California Privacy Protection Agency and adding new consumer privacy rights.Used in: CCPA/CPRA, GDPR, ISO 27001:2022
California Privacy Rights Act (CPRA)Privacy: An amendment to the CCPA that expanded consumer privacy rights, created the California Privacy Protection Agency, and introduced new concepts such as sensitive personal information and the right to correction.Used in: CCPA/CPRA, GDPR, ISO 27001:2022
Callback PhishingInformation Security: A social engineering technique where phishing emails instruct victims to call a phone number controlled by the attacker for further manipulation.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Canary TokenInformation Security: A digital tripwire deployed within a network or data set that triggers an alert when accessed, providing early detection of unauthorized activity.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Capability MaturityGovernance: A framework for assessing and improving an organization's processes and capabilities across defined maturity levels from initial to optimized.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Capacity ManagementGovernance: The process of ensuring that IT resources and infrastructure are sufficient to meet current and future business requirements.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Capacity PlanningGovernance: The process of determining the production capacity needed by an organization to meet changing demands for its products and services.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Catastrophic RiskRisk Management: A risk event with the potential for severe, widespread, and potentially irreversible damage to an organization's operations, reputation, or survival.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Certificate AuthorityInformation Security: A trusted entity that issues digital certificates used to verify the identity of individuals, organisations, or devices. Certificate Authorities form the basis of the Public Key Infrastructure (PKI) trust model.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certificate ManagementInformation Security: The processes for managing the lifecycle of digital certificates including issuance, renewal, revocation, and key storage.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certificate PinningInformation Security: A security technique that associates a host with its expected public key or certificate, preventing man-in-the-middle attacks by rejecting certificates that do not match the pinned values.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certificate RevocationInformation Security: The invalidation of a digital certificate before its scheduled expiration date, typically due to key compromise or change of entity information.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certificate Revocation ListInformation Security: A list published by a certificate authority of digital certificates that have been revoked before their expiration date.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certificate of ComplianceCompliance and Regulatory: A formal document certifying that an organization, product, or process meets specified regulatory or standard requirements.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
CertificationCompliance: Formal attestation by an accredited body that an organisation's management system meets the requirements of a specific standard (e.g., ISO 27001, ISO 9001).Used in: ISO 27001:2022, ISO 9001:2015
Certification AuditAudit: A formal assessment conducted by an accredited certification body to determine whether an organisation's management system meets the requirements of a standard such as ISO 27001, ISO 9001, or ISO 22301.Used in: ISO 27001:2022, ISO 9001:2015
Certification BodyAudit and Assurance: An accredited organization authorized to conduct audits and issue certifications confirming that management systems meet international standards.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certification CycleAudit and Assurance: The complete sequence of initial certification audit, surveillance audits, and recertification audit, typically spanning a three-year period.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certification MaintenanceAudit and Assurance: The ongoing activities required to keep a certification valid, including surveillance audits, continuous improvement, and management reviews.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Certification MechanismPrivacy and Data Protection: A voluntary process under GDPR through which organizations demonstrate compliance with data protection requirements through approved certification bodies.Used in: GDPR, ISO 27001:2022
Certification ScopeAudit and Assurance: The defined boundaries of what a certification covers, including the organizational units, processes, locations, and standards included.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Certified Ethical HackerInformation Security: A certification demonstrating competency in ethical hacking techniques, penetration testing, and vulnerability assessment methodologies.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Chain of CustodyInformation Security: The documented process of maintaining and tracking evidence from collection through presentation. In digital forensics, chain of custody ensures that evidence is admissible and has not been tampered with.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Change Advisory BoardGovernance: A group of stakeholders that evaluates and approves or rejects proposed changes to IT systems and infrastructure based on risk assessment.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Change Advisory Board (CAB)Governance: A body that exists to approve changes and assist in the assessment and prioritisation of changes. CABs are a core component of ITIL change management and help balance the need for change with the risk of disruption.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Change ControlGovernance: A formal process for managing changes to systems, processes, and configurations to minimize disruption and maintain system integrity.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Change ManagementGovernance: The processes, tools, and techniques for managing the people side of change to achieve required business outcomes, or the IT process for controlling modifications to hardware, software, and documentation to protect the environment from unintended consequences.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Chief Compliance Officer (CCO)Compliance: The senior executive responsible for overseeing and managing compliance issues within an organisation, ensuring that the company and its employees comply with all regulatory requirements and internal policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Chief Privacy Officer (CPO)Privacy: The senior executive responsible for managing an organisation's privacy programme, ensuring compliance with privacy laws and regulations, and establishing privacy policies and procedures.Used in: GDPR, ISO 27001:2022
Chief Risk Officer (CRO)Risk Management: The senior executive responsible for identifying, analysing, and mitigating internal and external events that could threaten an organisation. The CRO oversees the enterprise risk management function.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Children's Online PrivacyPrivacy and Data Protection: Legal frameworks and practices for protecting the personal information of children collected online, including COPPA requirements for parental consent.Used in: GDPR, ISO 27001:2022
Children's Online Privacy Protection Act (COPPA)Privacy: A US federal law that imposes requirements on operators of websites or online services directed at children under 13 years of age. COPPA requires parental consent before collecting personal information from children.Used in: GDPR, ISO 27001:2022
China Cybersecurity LawCompliance and Regulatory: China's comprehensive cybersecurity legislation that imposes requirements on network operators for data protection, security assessments, and data localization.Used in: GDPR, ISO 27001:2022
CipherInformation Security: An algorithm for performing encryption or decryption of data. Ciphers transform plaintext into ciphertext (encryption) and back again (decryption) using a key.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
CiphertextInformation Security: The result of encryption performed on plaintext using an algorithm (cipher) and a key. Ciphertext is designed to be unintelligible without the corresponding decryption key.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Clean Desk PolicyInformation Security: A policy requiring employees to secure sensitive documents and removable media when leaving their workspace to prevent unauthorized access to information.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
ClickjackingInformation Security: A web-based attack where a malicious site tricks a user into clicking on something different from what the user perceives, potentially revealing confidential information or taking control of their computer.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Closed-Circuit TelevisionInformation Security: Video surveillance systems used for physical security monitoring of facilities, access points, and sensitive areas with recording capabilities.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Cloud Access Security BrokerCloud Security: A security policy enforcement point positioned between cloud service consumers and providers to monitor activity, enforce policies, and protect data.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Access Security Broker (CASB)Cloud: A security policy enforcement point positioned between cloud service consumers and cloud providers. CASBs provide visibility into cloud application usage, data protection, threat detection, and compliance monitoring.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, GDPR
Cloud ActCompliance and Regulatory: US legislation that allows law enforcement to compel US-based cloud providers to provide stored data regardless of where the data is physically located.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud BrokerCloud Security: An entity that manages the use, performance, and delivery of cloud services, negotiating relationships between cloud providers and consumers.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Cloud ComplianceCloud: The process of ensuring that cloud computing environments meet regulatory requirements, industry standards, and internal policies. Cloud compliance involves shared responsibility between the cloud provider and customer.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Configuration ManagementCloud Security: Processes and tools for maintaining secure and compliant configurations of cloud resources, preventing misconfigurations that lead to data exposure.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Data ProtectionCloud Security: Security measures for protecting data stored, processed, and transmitted in cloud environments, including encryption, access controls, and data loss prevention.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Cloud EncryptionCloud Security: The use of cryptographic algorithms to protect data at rest, in transit, and in use within cloud computing environments and services.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Cloud ForensicsCloud Security: Digital forensic investigation techniques adapted for cloud computing environments, addressing unique challenges of multi-tenant and distributed systems.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud GovernanceCloud Security: Policies, processes, and controls for managing cloud adoption, usage, security, and compliance across an organization's cloud environments.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, COBIT 2019
Cloud Identity ManagementCloud Security: The management of user identities, authentication, and authorization across cloud services to ensure secure access to cloud resources.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Cloud Infrastructure SecurityCloud Security: Security practices for protecting the underlying infrastructure of cloud environments including virtual machines, networks, storage, and orchestration platforms.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Key ManagementInformation Security: Services and practices for managing cryptographic keys in cloud environments, including generation, storage, rotation, and access control of encryption keys.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Cloud MigrationCloud Security: The process of moving data, applications, and workloads from on-premises infrastructure to cloud computing environments.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Migration SecurityCloud Security: Security planning and controls for safely transferring applications, data, and workloads from on-premises environments to cloud platforms.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud MonitoringCloud Security: The continuous observation of cloud resources, services, and applications to detect performance issues, security threats, and compliance violations.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Cloud Native SecurityCloud: Security practices and tools designed specifically for cloud-native architectures including containers, microservices, and serverless computing. Cloud native security shifts protection closer to the workload and incorporates security into the CI/CD pipeline.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Cloud Penetration TestingCloud Security: Authorized security testing of cloud environments and applications to identify vulnerabilities, with specific considerations for cloud provider policies.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Cloud SecurityCloud: The set of policies, controls, procedures, and technologies that protect cloud-based systems, data, and infrastructure. Governed by the shared responsibility model between cloud provider and customer.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Security AllianceCloud Security: An industry organization dedicated to defining and raising awareness of best practices for securing cloud computing through research and education.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Security Alliance (CSA)Cloud: A non-profit organisation dedicated to defining and raising awareness of best practices for a secure cloud computing environment. CSA publishes the Cloud Controls Matrix and the STAR certification programme.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Security ArchitectureCloud Security: The design and implementation of security controls, policies, and technologies specifically for protecting cloud computing environments and services.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Security Posture ManagementCloud: A category of security tools that continuously monitor cloud infrastructure for gaps in security policy enforcement. CSPM solutions identify misconfigurations, compliance violations, and security risks across multi-cloud environments.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Security Posture Management (CSPM)Cloud: Tools and practices that continuously monitor cloud environments for security misconfigurations, compliance violations, and risks. CSPM automates the identification and remediation of cloud security issues.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Service Level AgreementCloud Security: A contract defining the performance, availability, security, and support commitments between a cloud service provider and its customer.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Shared Responsibility ModelCloud Security: A framework that delineates security responsibilities between cloud service providers and customers based on the type of cloud service used.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Cloud Workload ProtectionCloud Security: Security solutions that protect workloads running in cloud environments from vulnerabilities, malware, and unauthorized access across their lifecycle.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Cloud Workload Protection Platform (CWPP)Cloud: A security solution that protects server workloads across cloud, hybrid, and on-premises environments. CWPPs provide capabilities including vulnerability management, network segmentation, system integrity monitoring, and application control.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Code ReviewInformation Security: The systematic examination of source code to identify security vulnerabilities, coding errors, and deviations from secure coding standards before deployment.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Code SigningInformation Security: The process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Code of ConductGovernance: A set of rules outlining the norms, responsibilities, and proper practices for an individual or organisation. Codes of conduct set ethical standards and are required by many regulatory frameworks including SOX and industry regulations.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Code of EthicsGovernance: A document establishing ethical principles and expected behaviors for professionals in a field, particularly in cybersecurity and auditing.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Cold SiteInformation Security: A backup facility that has the basic infrastructure (power, networking, cooling) but no pre-installed hardware or data. Cold sites are the least expensive disaster recovery option but have the longest recovery time.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, NIST SP 800-53 Rev 5
Collaborative SecurityInformation Security: An approach where organizations share threat intelligence, best practices, and resources to collectively improve their security posture.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Column-Level EncryptionInformation Security: Database encryption applied to specific columns containing sensitive data, protecting individual data fields while allowing queries on unencrypted columns.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Combined AssuranceAudit and Assurance: An approach that coordinates various assurance providers to optimize risk and control coverage while minimizing duplication of effort.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Command and ControlInformation Security: The infrastructure and communication channels used by attackers to maintain remote control over compromised systems within a target network.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Command and Control (C2)Information Security: The infrastructure and communication channels used by attackers to maintain control over compromised systems. C2 servers issue commands to malware or botnets and receive exfiltrated data.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Committee CharterGovernance: A formal document that defines a committee's purpose, authority, composition, meeting frequency, and responsibilities within the governance structure.Used in: COBIT 2019, ISO 27001:2022
Common CriteriaCompliance: An international standard (ISO/IEC 15408) for computer security certification that provides a framework for evaluating the security properties of IT products. Common Criteria evaluations are mutually recognised by 31 countries.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Communication PlanInformation Security: A documented strategy for communicating with internal and external stakeholders during security incidents, including templates and escalation procedures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Communication RecoveryBusiness Continuity: The restoration of communication systems and channels following a disruption, ensuring stakeholders can be reached and information can flow.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
CompTIA Security PlusInformation Security: An industry certification validating baseline cybersecurity skills including threat assessment, security operations, and incident response.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8
CompartmentalizationInformation Security: The principle of restricting information access so that individuals only know what they need for their specific responsibilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Compensating ControlInformation Security: An alternative security measure employed when a primary control cannot be implemented. Must provide an equivalent level of protection and be documented with justification.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Complaint HandlingPrivacy and Data Protection: Processes for receiving, investigating, and resolving complaints from data subjects about the handling of their personal information.Used in: GDPR, ISO 27001:2022
ComplianceCompliance: The state of conforming to laws, regulations, standards, or internal policies. In information security, compliance is typically demonstrated through audits, certifications, and continuous monitoring.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Compliance ArchitectureCompliance and Regulatory: The structural design of an organization's compliance program, including technology, processes, and roles that support regulatory adherence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance AssessmentCompliance and Regulatory: A formal evaluation of an organization's adherence to specific regulatory requirements, standards, or internal policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance Assessment ReportAudit and Assurance: A formal document presenting the results of a compliance evaluation including findings, evidence, and recommendations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Compliance AuditAudit and Assurance: An examination that evaluates whether an organization adheres to applicable laws, regulations, standards, and internal policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Compliance AutomationCompliance: The use of technology to automate compliance monitoring, evidence collection, control testing, and reporting activities. Compliance automation platforms reduce manual effort and provide continuous compliance visibility.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Compliance AwarenessCompliance and Regulatory: Programs and activities designed to educate employees about compliance obligations, ethical standards, and the consequences of non-compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance BaselineCompliance and Regulatory: The minimum set of compliance requirements that an organization must meet, serving as a starting point for building a comprehensive compliance program.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance BudgetCompliance and Regulatory: The financial resources allocated to compliance activities including assessments, technology, training, and remediation.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Compliance CalendarCompliance and Regulatory: A tool for tracking regulatory deadlines, filing dates, audit schedules, and compliance milestones to ensure timely fulfillment of all obligations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance CertificateCompliance and Regulatory: A formal document issued upon successful completion of a compliance assessment, confirming that an organization meets specific requirements.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Compliance CheckpointCompliance and Regulatory: A defined point in a business process where compliance with relevant regulations and policies is verified before proceeding.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance ControlsCompliance and Regulatory: Specific measures implemented to ensure adherence to regulatory requirements, including technical controls, policies, and procedures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance CoordinatorCompliance and Regulatory: An individual responsible for coordinating compliance activities across departments and ensuring consistent adherence to regulatory requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance CultureCompliance and Regulatory: An organizational environment where employees at all levels understand, value, and actively support compliance with laws, regulations, and ethical standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance DashboardCompliance and Regulatory: A visual display providing real-time status of an organization's compliance posture across multiple regulations, standards, and internal policies.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Compliance DocumentationCompliance and Regulatory: The collection of policies, procedures, records, and evidence maintained to demonstrate adherence to regulatory and standard requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance EvidenceCompliance and Regulatory: Documentation and records that demonstrate an organization's adherence to specific regulatory requirements or standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance FrameworkCompliance: A structured set of guidelines, best practices, and standards that organisations follow to meet regulatory requirements, manage risks, and demonstrate compliance. Examples include ISO 27001, SOC 2, NIST CSF, and GDPR.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, GDPR
Compliance Framework MappingCompliance and Regulatory: The process of identifying correspondences between requirements across different compliance frameworks to enable efficient multi-standard adherence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance GapCompliance and Regulatory: A deficiency identified between an organization's current practices and the requirements of a specific regulation, standard, or framework.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance HotlineCompliance and Regulatory: A confidential reporting channel for employees and stakeholders to report suspected compliance violations, fraud, or ethical concerns.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance InvestigationCompliance and Regulatory: A formal inquiry into suspected violations of laws, regulations, or organizational policies to determine facts and appropriate corrective actions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance LifecycleCompliance and Regulatory: The ongoing cycle of identifying requirements, implementing controls, monitoring compliance, reporting, and continuously improving the compliance program.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Compliance Management SystemCompliance and Regulatory: An integrated set of policies, processes, and tools used to systematically manage an organization's compliance with legal and regulatory requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance MaturityCompliance and Regulatory: The level of sophistication and effectiveness of an organization's compliance program, measured against defined capability levels.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance MeasurementCompliance and Regulatory: The use of metrics and indicators to quantitatively assess an organization's level of compliance with applicable requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance MonitoringCompliance: The ongoing process of verifying that an organisation continues to meet its compliance obligations. Compliance monitoring includes regular assessments, control testing, policy reviews, and metrics tracking.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Compliance ObligationCompliance and Regulatory: A legal or regulatory requirement that an organization must fulfill to avoid penalties, sanctions, or other adverse consequences.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance OfficerCompliance and Regulatory: A designated individual responsible for overseeing and managing an organization's compliance program, ensuring adherence to laws and regulations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance OversightCompliance and Regulatory: The governance function responsible for monitoring, evaluating, and reporting on the effectiveness of an organization's compliance activities.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Compliance PolicyCompliance and Regulatory: A formal document establishing an organization's commitment to compliance and defining the principles, responsibilities, and expectations for regulatory adherence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance ProgramCompliance and Regulatory: A comprehensive system of policies, procedures, training, and oversight designed to ensure an organization meets all applicable legal and regulatory requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance ProgrammeCompliance: A structured set of internal policies, procedures, training, and monitoring activities designed to ensure an organisation adheres to applicable laws, regulations, and industry standards.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Compliance RegisterCompliance and Regulatory: A comprehensive inventory of all applicable laws, regulations, standards, and contractual obligations relevant to an organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance ReportingCompliance and Regulatory: The process of generating and submitting reports to regulatory bodies, management, or stakeholders demonstrating adherence to compliance requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance ReviewCompliance and Regulatory: A systematic examination of an organization's practices, controls, and documentation to verify adherence to applicable compliance requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance RiskCompliance and Regulatory: The potential for legal penalties, financial loss, or reputational damage arising from an organization's failure to comply with laws, regulations, or standards.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Compliance Risk AssessmentRisk Management: An evaluation of the risks associated with failing to comply with applicable laws, regulations, and standards.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Compliance RoadmapCompliance and Regulatory: A strategic plan outlining the steps, timeline, and milestones for achieving and maintaining compliance with specific regulations or standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance ScopeCompliance and Regulatory: The defined boundaries of what a compliance program covers, including applicable regulations, organizational units, and geographic locations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance TestingCompliance and Regulatory: The process of verifying that systems, processes, and controls function as intended and meet the requirements of applicable regulations and standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance TrainingCompliance and Regulatory: Educational programs designed to ensure employees understand their compliance obligations and can fulfill their roles in maintaining regulatory adherence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance VerificationCompliance and Regulatory: The process of confirming through evidence and testing that an organization meets specific compliance requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance WorkflowCompliance and Regulatory: The defined sequence of activities and approvals required to complete a compliance-related task or process.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Compliance as CodeCompliance and Regulatory: The practice of defining compliance policies and controls as machine-readable code that can be automatically tested and enforced.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Computer Emergency Response TeamInformation Security: An organization that handles cybersecurity incidents and coordinates responses, providing technical guidance and threat intelligence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Computer ForensicsInformation Security: The application of investigation and analysis techniques to gather and preserve evidence from a computer system in a way that is suitable for presentation in a court of law.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Computer Security IncidentInformation Security: An event that actually or potentially jeopardizes the confidentiality, integrity, or availability of a computer system or the data it processes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Computer VisionAI & Technology: A field of artificial intelligence that enables machines to interpret and understand visual information from the world. Computer vision applications raise privacy concerns when used for facial recognition and surveillance.Used in: GDPR, ISO 27001:2022, EU AI Act
Computer-Assisted Audit TechniquesAudit and Assurance: The use of software tools and data analytics by auditors to analyze large data sets, test controls, and improve audit efficiency.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Computer-Assisted Audit Techniques (CAATs)Audit: Software tools and techniques used by auditors to automate audit procedures such as data extraction, analysis, sampling, and control testing. CAATs improve audit efficiency and enable analysis of larger data sets.Used in: ISO 27001:2022
Concentration RiskRisk Management: The risk arising from overexposure to a single counterparty, sector, region, or system dependency that could amplify the impact of adverse events.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Confidential ComputingAI & Technology: A security paradigm that protects data in use by performing computation in a hardware-based trusted execution environment. Confidential computing prevents unauthorised access to data even from the infrastructure provider.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
ConfidentialityInformation Security: The principle of ensuring that information is accessible only to authorised individuals, entities, or processes. One of the three pillars of information security (CIA triad).Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Configuration AuditAudit and Assurance: An examination of system configurations to verify they comply with security baselines, standards, and organizational requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Configuration BaselineGovernance: A documented and agreed-upon specification of a system's configuration at a specific point in time, used as a reference for managing changes.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Configuration ComplianceCompliance and Regulatory: The adherence of system configurations to defined security baselines and hardening standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Configuration ItemGovernance: A component of IT infrastructure that needs to be managed to deliver services, tracked and maintained through configuration management.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Configuration ManagementGovernance: A process for systematically managing, organizing, and controlling changes to system configurations to maintain integrity and traceability.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Configuration Management Database (CMDB)Governance: A repository that stores information about the configuration items (CIs) and their relationships within an IT environment. CMDBs support change management, incident management, and compliance reporting.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, NIST SP 800-53 Rev 5
Configuration StandardInformation Security: A documented specification of approved settings and parameters for configuring systems securely and consistently.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
ConsentPrivacy: A lawful basis for processing personal data under GDPR that requires a clear, specific, informed, and unambiguous indication of the data subject's agreement to their data being processed. Consent must be freely given and as easy to withdraw as to give.Used in: GDPR, ISO 27001:2022
Consent DecreeCompliance and Regulatory: A legally binding agreement between a regulatory body and an organization that resolves compliance violations and mandates specific corrective actions.Used in: GDPR, ISO 27001:2022
Consent ManagementPrivacy and Data Protection: Systems and processes for obtaining, recording, and managing user consent for the collection, processing, and sharing of personal data in compliance with privacy laws.Used in: GDPR, ISO 27001:2022
Consent Management PlatformPrivacy and Data Protection: Technology that helps organizations collect, store, and manage user consent preferences for data processing activities and cookie usage on websites and applications.Used in: GDPR, ISO 27001:2022
Consent Management Platform (CMP)Privacy: A technology solution that enables websites and apps to collect, store, and manage user consent for data processing activities. CMPs help organisations comply with privacy regulations such as GDPR and ePrivacy Directive.Used in: GDPR, ISO 27001:2022
Consent OrderCompliance and Regulatory: A regulatory enforcement action requiring an organization to take specific corrective actions to address compliance violations.Used in: GDPR, ISO 27001:2022
Consent ReceiptPrivacy and Data Protection: A record or receipt provided to a data subject confirming the details of the consent they have given for data processing.Used in: GDPR, ISO 27001:2022
Consent WithdrawalPrivacy and Data Protection: The right of individuals to revoke their previously given consent for data processing, requiring organizations to cease processing based on that consent.Used in: GDPR, ISO 27001:2022
Construction ComplianceCompliance and Regulatory: Regulatory requirements governing construction practices including building codes, safety standards, environmental regulations, and labor laws.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Consumer Financial ProtectionCompliance and Regulatory: Regulations and practices designed to protect consumers in financial transactions, ensuring fair lending, transparent disclosure, and responsible practices.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Consumer ProtectionCompliance and Regulatory: Laws and regulations designed to safeguard consumers from unfair business practices, fraud, and harmful products or services.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Container Orchestration SecurityCloud Security: Security practices for protecting container orchestration platforms like Kubernetes, including access control, network policies, and secrets management.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1
Container SecurityCloud: The practice of protecting containerised applications throughout their lifecycle, from image creation to runtime. Container security addresses image scanning, runtime protection, network policies, and orchestration platform security.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, NIST Cybersecurity Framework 2.0
Content FilteringInformation Security: Technology that screens and restricts access to web content, email, or data transfers based on predefined policies to prevent exposure to malicious or inappropriate material.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Content ModerationCompliance and Regulatory: The practice of monitoring and managing user-generated content on platforms to ensure compliance with policies, laws, and community standards.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Contingency PlanBusiness Continuity: A plan for maintaining or restoring business operations when disruptive events occur, covering both prevention and recovery activities.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Continuity of OperationsBusiness Continuity: A federal government initiative ensuring that agencies are able to continue performance of essential functions during emergencies.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Continuous AuditingAudit: An audit approach that uses technology to produce audit results simultaneously with, or shortly after, the occurrence of relevant events. Continuous auditing provides real-time assurance and enables faster identification of control failures.Used in: ISO 27001:2022
Continuous ComplianceCompliance: An approach to compliance that replaces periodic point-in-time assessments with ongoing automated monitoring and evidence collection. Continuous compliance provides real-time visibility into the organisation's compliance posture.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Continuous Deployment SecurityInformation Security: Security controls integrated into continuous deployment pipelines to ensure code is scanned and validated before production release.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Continuous ImprovementGovernance: An ongoing effort to improve products, services, and processes incrementally over time through small, sustainable changes.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Continuous Integration SecurityInformation Security: Security practices integrated into continuous integration pipelines, including automated scanning, testing, and policy enforcement during builds.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Continuous MonitoringCompliance: The ongoing awareness of information security, vulnerabilities, and threats to support organisational risk management decisions. Required by NIST SP 800-137 and recommended by most security frameworks.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Continuous Risk AssessmentRisk Management: An ongoing process of evaluating risks in real time rather than at periodic intervals, enabling more responsive risk management.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Continuous VerificationInformation Security: The ongoing process of validating that security controls, configurations, and compliance status remain effective and current.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Contractual ComplianceCompliance and Regulatory: Adherence to the specific terms, conditions, and obligations set forth in contracts and agreements with customers, vendors, and partners.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
ControlInformation Security: A measure (policy, procedure, technical mechanism, or physical safeguard) that modifies risk. Controls can prevent, detect, or correct security incidents.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Control AssessmentAudit and Assurance: The evaluation of a security or compliance control to determine whether it is properly designed and operating effectively.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control AssuranceRisk Management: The processes for providing confidence that controls are operating effectively and achieving their intended risk mitigation objectives.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control AuditAudit and Assurance: A focused examination of specific controls to evaluate their design adequacy and operating effectiveness in achieving control objectives.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control AutomationInformation Security: The use of technology to automatically implement, monitor, and enforce security and compliance controls without manual intervention.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Control BaselineInformation Security: The minimum set of security controls selected for a system based on its risk level and applicable regulatory requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Control CatalogRisk Management: A comprehensive inventory of available security and compliance controls organized by type, function, and applicable framework requirements.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control DeficiencyAudit and Assurance: A weakness in the design or operation of a control that prevents it from effectively mitigating the intended risk or meeting its objective.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control DesignRisk Management: The process of defining the specifications and implementation approach for security and compliance controls to address identified risks.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control DocumentationAudit and Assurance: Written records describing the design, implementation, operation, and effectiveness of security and compliance controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control EffectivenessRisk Management: The degree to which a security or compliance control achieves its intended purpose in mitigating a specific risk or meeting a requirement.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control EnvironmentGovernance: The set of standards, processes, and structures that provide the foundation for carrying out internal control across an organisation. The control environment is established by leadership and sets the tone for the organisation.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control EvidenceAudit and Assurance: Documentation, records, and artifacts that demonstrate a control exists, is properly designed, and operates effectively.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control FrameworkRisk Management: A structured set of controls organized into domains and objectives that provides a systematic approach to managing specific types of risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control Framework MappingGovernance: The process of identifying relationships between controls across different frameworks to enable efficient multi-standard compliance.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
Control GapCompliance: A deficiency identified when an organisation's existing controls do not fully meet the requirements of a target compliance framework or standard. Control gaps are identified through gap analysis and addressed through remediation plans.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control ImplementationRisk Management: The process of deploying and configuring security and compliance controls according to their design specifications and organizational requirements.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control LibraryGovernance: A comprehensive collection of defined security and compliance controls that an organization can select from based on its requirements.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control MappingInformation Security: The process of identifying relationships between controls in different frameworks. For example, mapping ISO 27001 Annex A controls to NIST 800-53 controls to identify overlap and gaps.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8
Control MonitoringRisk Management: The ongoing assessment of control performance and effectiveness through testing, metrics, and automated monitoring tools.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Control ObjectiveGovernance: A statement of the desired result or purpose to be achieved by implementing a control. Control objectives define what the organisation wants to achieve through its control activities and provide the basis for control design and assessment.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control OwnerRisk Management: The individual responsible for the design, implementation, operation, and effectiveness of a specific security or compliance control.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control RationalizationRisk Management: The process of optimizing the control environment by eliminating redundant controls and ensuring each control serves a distinct purpose.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control Self-AssessmentAudit and Assurance: A process where operational teams evaluate the effectiveness of their own controls and risk management practices using structured methodology.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Control TestingAudit: The process of evaluating whether controls are designed appropriately and operating effectively to achieve their intended objectives. Control testing is a core component of compliance audits and attestation engagements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Control ValidationAudit and Assurance: The process of testing and verifying that implemented controls function as intended and effectively mitigate their associated risks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Conversational AI ComplianceAI and Technology: Regulatory requirements and best practices for deploying chatbots and virtual assistants that handle personal data, make decisions, or interact with consumers.Used in: GDPR, ISO 27001:2022
Cookie ConsentPrivacy: The requirement under privacy regulations to obtain user permission before placing non-essential cookies on their device. Cookie consent mechanisms must provide clear information about cookie purposes and allow granular choices.Used in: GDPR, ISO 27001:2022
Cookie PolicyPrivacy and Data Protection: A document that explains what cookies a website uses, their purposes, and how users can manage their cookie preferences.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Corporate ComplianceCompliance and Regulatory: An organization's adherence to laws, regulations, standards, and internal policies that govern its operations and business practices.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Corporate GovernanceGovernance: The system of rules, practices, and processes by which an organisation is directed and controlled. Corporate governance balances the interests of stakeholders including shareholders, management, customers, suppliers, government, and the community.Used in: COBIT 2019, ISO 27001:2022
Corrective ActionInformation Security: Action taken to eliminate the root cause of a detected nonconformity or other undesirable situation, preventing its recurrence. A key concept in ISO management systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Corrective Action PlanAudit and Assurance: A documented set of steps to address audit findings, control deficiencies, or non-conformities, including timelines and responsible parties.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Corrective ControlRisk Management: A security control designed to restore systems and processes to their expected state after a security incident or policy violation has been detected.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Correlation RuleInformation Security: A predefined logic pattern in SIEM systems that triggers alerts when specific combinations of events or conditions are detected across log sources.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Counterfeit PreventionInformation Security: Measures to prevent the use of counterfeit hardware, software, or components that could introduce vulnerabilities or compromise system integrity.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CountermeasureRisk Management: An action, device, procedure, or technique that reduces a threat, vulnerability, or attack by eliminating or preventing it, minimizing harm, or enabling discovery.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Covered EntityCompliance: Under HIPAA, a health plan, healthcare clearinghouse, or healthcare provider that transmits any health information electronically. Covered entities must comply with all HIPAA Administrative Simplification rules.Used in: HIPAA Security Rule
Covert ChannelInformation Security: A communication path that was not designed for information transfer but can be exploited to secretly transmit data in violation of security policies.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Credential HarvestingInformation Security: Techniques used by attackers to collect login credentials through methods such as phishing sites, keyloggers, or memory scraping tools.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Credential ManagementInformation Security: The processes and tools for securely creating, storing, distributing, rotating, and revoking user credentials throughout their lifecycle.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Credential RotationInformation Security: The practice of regularly changing passwords, keys, certificates, and other credentials to limit the window of exposure from compromised credentials.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Credential StuffingInformation Security: An automated attack that uses stolen username-password pairs from previous data breaches to attempt to log into other services. Exploits the tendency of users to reuse passwords across multiple sites.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Crisis CommunicationBusiness Continuity: The processes and protocols for communicating with internal and external stakeholders during a crisis to manage information flow and maintain trust.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Crisis ManagementBusiness Continuity: The process by which an organization responds to and manages the impact of a major unpredictable event that threatens to harm the organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Crisis Management PlanBusiness Continuity: A documented guide for responding to major disruptions, defining leadership roles, communication protocols, and decision-making processes during a crisis.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Crisis Management TeamBusiness Continuity: A designated group of senior leaders responsible for making strategic decisions and coordinating the organization's response during a crisis.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Critical AssetRisk Management: An information asset, system, or resource whose compromise, loss, or failure would have a severe impact on the organization's operations or objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Critical InfrastructureCompliance: Systems, assets, and networks (whether physical or virtual) so vital to a nation that their incapacitation or destruction would have a debilitating impact on security, economic stability, public health, or safety.Used in: HIPAA Security Rule
Critical Infrastructure ProtectionCompliance and Regulatory: Regulations and security measures to protect essential services and systems such as energy, water, transportation, and healthcare from disruption.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Critical SystemInformation Security: An information system whose failure or compromise would have severe consequences for the organization's operations or mission.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cross-Border ComplianceCompliance and Regulatory: Managing compliance obligations across multiple jurisdictions, addressing conflicting or overlapping regulatory requirements in different countries.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Cross-Border Data TransferPrivacy: The movement of personal data from one jurisdiction to another. Cross-border transfers are regulated under GDPR, LGPD, and other privacy laws and typically require adequate safeguards such as Standard Contractual Clauses or Binding Corporate Rules.Used in: GDPR, ISO 27001:2022
Cross-Device TrackingPrivacy and Data Protection: The practice of monitoring user activity across multiple devices such as phones, tablets, and computers to build comprehensive behavioral profiles.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Cross-Framework MappingCompliance: The discipline of identifying equivalent or related controls across multiple compliance frameworks. Enables unified control sets and reduces duplicate compliance effort.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Cross-Functional TeamGovernance: A team composed of members from different departments or disciplines working together on shared objectives such as security or compliance.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Cross-Site Request ForgeryInformation Security: A web security vulnerability that tricks authenticated users into submitting unintended requests to a web application, potentially performing unauthorized actions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Cross-Site Request Forgery (CSRF)Information Security: A web application vulnerability that tricks an authenticated user into submitting unintended requests to a web application. CSRF attacks exploit the trust that a site has in the user's browser.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Cross-Site ScriptingInformation Security: A web application vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, enabling data theft or session hijacking.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Cross-Site Scripting (XSS)Information Security: A web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. XSS attacks can steal session cookies, redirect users, or deface websites.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
CryptanalysisInformation Security: The study of analysing and breaking cryptographic systems. Cryptanalysis involves finding weaknesses in the mathematical algorithms or implementation of encryption schemes.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Crypto AgilityInformation Security: The ability of a system to quickly transition between different cryptographic algorithms and protocols in response to new threats or requirements.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Cryptocurrency ComplianceCompliance and Regulatory: Regulations governing cryptocurrency transactions including anti-money laundering requirements, tax reporting, and consumer protection.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Cryptographic Hash FunctionInformation Security: A mathematical algorithm that maps data of arbitrary size to a fixed-size bit string (hash value). Hash functions are one-way, deterministic, and designed so that even a small change in input produces a dramatically different output.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Cryptographic KeyInformation Security: A piece of information used by a cryptographic algorithm to transform plaintext into ciphertext or vice versa. Key security is fundamental to the strength of any cryptographic system.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Cryptographic Key ManagementInformation Security: The administration of cryptographic keys throughout their lifecycle including generation, distribution, storage, rotation, revocation, and destruction.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
CryptojackingInformation Security: The unauthorized use of someone else's computing resources to mine cryptocurrency, typically delivered through malicious scripts on websites or compromised systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Cyber AwarenessInformation Security: The knowledge and attitudes that members of an organization possess regarding the protection of information assets and cybersecurity best practices.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber DeceptionInformation Security: Security techniques that use decoys, misdirection, and disinformation to confuse attackers, detect intrusions, and gather intelligence about adversary methods.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
Cyber EspionageInformation Security: State-sponsored or organized cyber operations aimed at stealing sensitive government, military, or corporate information.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber EssentialsCompliance: A UK government-backed certification scheme that helps organisations protect against the most common cyber threats. Cyber Essentials covers five technical controls: firewalls, secure configuration, access control, malware protection, and patch management.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8
Cyber EventInformation Security: An observable occurrence in cyberspace that may or may not have security implications, requiring analysis to determine significance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber HygieneInformation Security: Routine practices and steps that users and organizations take to maintain system health and improve online security, similar to personal health hygiene.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Cyber IncidentInformation Security: An event that actually or imminently jeopardizes the confidentiality, integrity, or availability of information or information systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber InsuranceInformation Security: Insurance coverage designed to protect organisations against financial losses resulting from cyber incidents such as data breaches, ransomware attacks, and business interruption caused by cyber events.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, PCI DSS v4.0
Cyber Insurance PolicyRisk Management: An insurance product designed to protect organizations from the financial impacts of cybersecurity incidents including data breaches and ransomware.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, PCI DSS v4.0
Cyber Insurance UnderwritingInformation Security: The process by which insurers evaluate an organization's cybersecurity posture and risk profile to determine coverage terms and premiums.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber Kill ChainInformation Security: A model developed by Lockheed Martin that describes the stages of a cyber attack: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber LiabilityCompliance and Regulatory: Legal and financial exposure arising from cybersecurity incidents, including costs of breach response, regulatory fines, and third-party claims.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022
Cyber Physical SystemInformation Security: A system integrating computation, networking, and physical processes where embedded computers monitor and control physical operations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber RangeInformation Security: A simulated environment used for cybersecurity training, testing, and exercises that replicates real-world networks and scenarios without impacting production systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber ResilienceInformation Security: An organisation's ability to continuously deliver intended outcomes despite adverse cyber events. Goes beyond cybersecurity to include preparedness, response, and recovery.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8
Cyber Risk AssessmentRisk Management: A systematic evaluation of threats, vulnerabilities, and potential impacts to an organization's digital assets and information systems.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Cyber Risk QuantificationRisk Management: The process of calculating the potential financial impact of cyber risks using statistical models, enabling data-driven security investment decisions.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022
Cyber ThreatInformation Security: A potential cyber attack that could compromise information systems, data, or services through exploitation of vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber Threat HuntingInformation Security: A proactive security practice of searching through networks and datasets to detect advanced threats that evade existing automated security solutions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber Threat IntelligenceInformation Security: Evidence-based knowledge about existing or emerging cyber threats that can be used to inform decisions regarding the organisation's response to those threats. CTI includes indicators of compromise, threat actor profiles, and attack patterns.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Cyber WarfareInformation Security: The use of digital attacks by nation-states to disrupt, damage, or destroy another nation's computer systems and critical infrastructure.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
CybersecurityInformation Security: The practice of protecting systems, networks, and programs from digital attacks that aim to access, change, or destroy sensitive information.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cybersecurity FrameworkInformation Security: A structured set of guidelines and best practices for managing cybersecurity risk, helping organizations assess and improve their security posture.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cybersecurity MaturityInformation Security: The level of sophistication and effectiveness of an organization's cybersecurity practices, measured against a defined scale of capability levels.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cybersecurity MeshInformation Security: An architectural approach that distributes security controls to individual access points rather than a centralized perimeter, enabling more flexible security.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cybersecurity ProgramInformation Security: A comprehensive set of policies, procedures, technologies, and personnel dedicated to protecting an organization's digital assets and managing cyber risk.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cybersecurity RiskRisk Management: The potential for financial loss, operational disruption, or reputational damage resulting from the failure of digital technologies and cyber threats.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022
Cybersecurity StrategyInformation Security: A high-level plan that defines an organization's approach to managing cybersecurity risk and protecting its digital assets over a defined period.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Cybersecurity WorkforceInformation Security: The personnel responsible for protecting an organization's digital assets, including their skills development, certification, and career pathway management.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Terms starting with B All letters Terms starting with D