Glossary terms starting with D

Terms

DISA STIGCompliance

Defence Information Systems Agency Security Technical Implementation Guides that provide technical security configuration standards for US Department of Defense information systems. STIGs are based on NIST SP 800-53 controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

DMZInformation Security

A demilitarized zone is a network segment that acts as a buffer between an organization's internal network and the external internet, hosting public-facing services.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

DNS FilteringInformation Security

A security technique that blocks access to malicious or unwanted domains by filtering DNS queries based on threat intelligence and policy.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

DNS SecurityInformation Security

Measures to protect the Domain Name System from attacks such as DNS spoofing, cache poisoning, and hijacking that redirect users to malicious sites.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

DNS Security Extensions (DNSSEC)Information Security

A suite of specifications for securing information provided by the Domain Name System. DNSSEC adds cryptographic signatures to DNS records to protect against cache poisoning and spoofing attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

DNS over HTTPSInformation Security

A protocol that encrypts DNS queries within HTTPS connections to prevent eavesdropping and manipulation of DNS traffic.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

DNSSECInformation Security

Domain Name System Security Extensions, a suite of specifications that adds authentication to DNS responses to protect against cache poisoning and spoofing attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

DPO CertificationPrivacy and Data Protection

Data Protection Officer certification validating expertise in data protection laws, privacy management, and regulatory compliance.Used in: GDPR, ISO 27001:2022

Dark PatternCompliance and Regulatory

A deceptive user interface design that tricks users into making unintended choices, increasingly subject to regulatory scrutiny and prohibition.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Dark Web MonitoringInformation Security

The practice of scanning dark web forums, marketplaces, and data dumps for an organization's compromised credentials, data, or mentions to enable early response.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Data AccuracyPrivacy and Data Protection

The principle that personal data must be accurate, kept up to date, and corrected or erased when inaccuracies are identified.Used in: GDPR, ISO 27001:2022

Data AnonymizationPrivacy and Data Protection

Techniques applied to personal data to prevent identification of individuals, including generalization, suppression, noise addition, and data swapping methods.Used in: GDPR, ISO 27001:2022

Data Anonymization TechniquesPrivacy and Data Protection

Specific methods for anonymizing data including k-anonymity, l-diversity, t-closeness, differential privacy, and synthetic data generation.Used in: GDPR, ISO 27001:2022

Data ArchitectureGovernance

The design of an organization's data structures, policies, and standards that govern how data is collected, stored, and used.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data AuditPrivacy and Data Protection

A comprehensive review of an organization's data processing activities to assess compliance with data protection laws and identify privacy risks.Used in: GDPR, ISO 27001:2022

Data BackupInformation Security

The process of creating copies of data that can be used to restore the original in the event of data loss, corruption, or disaster.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Data BreachInformation Security

An incident where confidential, private, or protected data is accessed, disclosed, or stolen by an unauthorised party. May trigger breach notification requirements under GDPR, HIPAA, or other regulations.Used in: GDPR, HIPAA Security Rule

Data Breach LawCompliance and Regulatory

Legislation requiring organizations to notify affected individuals and authorities when personal data is compromised, with varying requirements by jurisdiction.Used in: GDPR, ISO 27001:2022

Data Breach NotificationPrivacy and Data Protection

The legal obligation to inform affected individuals and regulatory authorities when personal data is compromised in a security incident within specified timeframes.Used in: GDPR, ISO 27001:2022

Data Breach Response PlanInformation Security

A documented set of procedures for responding to data breaches, including detection, containment, notification, and recovery steps.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data BrokerPrivacy and Data Protection

An entity that collects personal information from various sources and sells or licenses it to other organizations for marketing, risk assessment, or other purposes.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data CatalogPrivacy and Data Protection

A centralized inventory of an organization's data assets with metadata descriptions, ownership, lineage, and classification information to support governance and privacy.Used in: GDPR, ISO 27001:2022, COBIT 2019

Data Center Physical SecurityInformation Security

Physical protection measures for data center facilities including perimeter security, access control, environmental monitoring, and video surveillance.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Data Center SecurityInformation Security

Physical and environmental security measures protecting data center facilities including access controls, surveillance, fire suppression, and power protection.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data Center TierInformation Security

A classification system that rates data centers on their reliability and availability, from Tier I with basic infrastructure to Tier IV with fault tolerance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data ClassificationInformation Security

The process of categorising data based on its sensitivity and the impact of unauthorised disclosure. Common levels: Public, Internal, Confidential, Restricted.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data Clean RoomPrivacy and Data Protection

A secure environment where multiple parties can collaboratively analyze combined datasets without directly sharing or exposing raw personal data.Used in: GDPR, ISO 27001:2022

Data CompliancePrivacy and Data Protection

Adherence to laws, regulations, and organizational policies governing the collection, storage, processing, and sharing of data.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data ControllerPrivacy

Under GDPR, the entity that determines the purposes and means of processing personal data. The controller bears primary responsibility for compliance.Used in: GDPR, ISO 27001:2022

Data CustodianPrivacy and Data Protection

An individual or team responsible for the technical management and safekeeping of data assets, implementing the data governance policies defined by data owners.Used in: COBIT 2019, ISO 27001:2022

Data DestructionInformation Security

The process of permanently and irreversibly eliminating data stored on electronic media so that it cannot be recovered. Methods include degaussing, physical destruction, and cryptographic erasure.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data DiodeInformation Security

A hardware device that allows data to flow in only one direction, providing physical enforcement of one-way information transfer. Used in high-security environments to protect classified or sensitive networks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data DiscoveryInformation Security

The process of identifying and locating sensitive data across an organization's systems, databases, file shares, and cloud services.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022

Data DisposalPrivacy and Data Protection

The secure destruction or deletion of personal data when it is no longer needed for its original purpose or when retention periods expire.Used in: GDPR, ISO 27001:2022

Data EncryptionInformation Security

The process of converting data into a coded form using cryptographic algorithms to prevent unauthorized access and protect confidentiality.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data Encryption StandardInformation Security

A formerly widely used symmetric encryption algorithm (DES) that has been superseded by AES due to its small key size vulnerability.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Data EnrichmentPrivacy and Data Protection

The practice of combining first-party data with additional information from external sources, raising privacy considerations about consent and purpose limitation.Used in: GDPR, ISO 27001:2022

Data EthicsPrivacy and Data Protection

The branch of ethics that addresses the moral implications of data collection, processing, and use, including fairness, transparency, and accountability in data practices.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data Ethics FrameworkPrivacy and Data Protection

A structured set of principles and guidelines for making ethical decisions about data collection, use, and sharing.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data ExfiltrationInformation Security

The unauthorised transfer of data from within an organisation to an external destination. Data exfiltration can occur through various channels including email, USB drives, cloud uploads, and covert network channels.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022

Data Flow MappingPrivacy and Data Protection

The visual documentation of how personal data moves through an organization's systems, processes, and third parties to identify privacy risks and compliance gaps.Used in: GDPR, ISO 27001:2022

Data GovernanceGovernance

The overall management of the availability, usability, integrity, and security of data employed in an organisation. Data governance includes policies, processes, standards, and metrics that ensure the effective use of information.Used in: COBIT 2019, ISO 27001:2022

Data Governance BoardGovernance

A cross-functional committee responsible for making decisions about data management policies, standards, and dispute resolution.Used in: COBIT 2019, ISO 27001:2022

Data Impact AssessmentPrivacy and Data Protection

A formal evaluation of how a proposed data processing activity might affect the privacy and rights of individuals whose data is involved.Used in: GDPR, ISO 27001:2022

Data IncidentPrivacy and Data Protection

An event involving personal data that could compromise its confidentiality, integrity, or availability, potentially constituting a data breach.Used in: GDPR, ISO 27001:2022

Data IntegrityInformation Security

The assurance that data is accurate, complete, consistent, and unaltered throughout its lifecycle, whether at rest, in transit, or in processing.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data InventoryPrivacy and Data Protection

A comprehensive catalog of all personal data collected, processed, and stored by an organization, including data categories, purposes, retention periods, and sharing practices.Used in: GDPR, ISO 27001:2022

Data Lake GovernancePrivacy and Data Protection

Policies and controls for managing privacy and security of personal data stored in data lakes where large volumes of diverse data are collected.Used in: GDPR, ISO 27001:2022, COBIT 2019

Data Leak PreventionInformation Security

Technologies and processes designed to detect and prevent the unauthorised transmission of sensitive information outside the organisation. DLP solutions monitor data in motion, at rest, and in use.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data LeakageInformation Security

The unauthorized transmission of data from within an organization to an external destination, whether intentional or accidental.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data Lifecycle ManagementPrivacy and Data Protection

Policies and processes for managing data from creation through archival and deletion, ensuring appropriate protection and compliance at each stage.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data LineageAI & Technology

The tracking and documentation of the origin, transformations, and movement of data throughout its lifecycle. Data lineage is essential for AI governance, regulatory compliance, and troubleshooting data quality issues.Used in: EU AI Act, COBIT 2019, ISO 27001:2022

Data LocalizationPrivacy and Data Protection

Legal requirements that mandate personal data of a country's residents to be stored and processed within that country's geographic borders.Used in: GDPR, ISO 27001:2022

Data Loss PreventionInformation Security

Technologies and processes that detect and prevent unauthorized transmission, sharing, or leakage of sensitive information outside the organization.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data MappingPrivacy

The process of documenting how personal data flows through an organisation, including what data is collected, where it is stored, how it is processed, who has access, and to whom it is transferred. Data mapping is a foundation for GDPR compliance.Used in: GDPR, ISO 27001:2022

Data MaskingInformation Security

A technique that replaces sensitive data with realistic but fictitious values to protect confidential information while maintaining data usability for testing or analytics.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data MaturityPrivacy and Data Protection

The level of sophistication of an organization's data management practices, including governance, quality, privacy, and analytics capabilities.Used in: GDPR, ISO 27001:2022, COBIT 2019

Data MeshGovernance

A decentralized data architecture where domain teams own and manage their data as products, requiring governance for consistency and compliance.Used in: COBIT 2019, ISO 27001:2022

Data Migration PrivacyPrivacy and Data Protection

Privacy considerations and controls required when transferring personal data between systems, platforms, or storage locations.Used in: GDPR, ISO 27001:2022

Data MinimisationPrivacy

The principle that organisations should collect and process only the personal data that is strictly necessary for the specified purpose. Data minimisation is a core principle of GDPR (Article 5) and most modern privacy regulations.Used in: GDPR, ISO 27001:2022

Data MinimizationPrivacy and Data Protection

A privacy principle requiring organizations to collect and process only the minimum amount of personal data necessary to fulfill a specific stated purpose.Used in: GDPR, ISO 27001:2022

Data ObservabilityAI and Technology

The ability to understand, diagnose, and manage data health across the data pipeline through monitoring, alerting, and lineage tracking.Used in: HIPAA Security Rule, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data OwnerPrivacy and Data Protection

The individual or role within an organization who has authority and accountability for the management, quality, and appropriate use of specific data assets.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data Pipeline SecurityAI and Technology

Security controls applied to data ingestion, transformation, and loading processes to protect data integrity and prevent unauthorized access or manipulation.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data PortabilityPrivacy

The right of individuals to receive their personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. Established under GDPR Article 20.Used in: GDPR, ISO 27001:2022

Data Privacy FrameworkPrivacy and Data Protection

An international agreement that provides a mechanism for compliant cross-border transfers of personal data, replacing the previous Privacy Shield arrangement.Used in: GDPR, ISO 27001:2022

Data Privacy Impact AssessmentPrivacy

A process designed to identify and minimise the privacy risks of new projects, systems, or processes that involve personal data. DPIAs are mandatory under GDPR Article 35 for high-risk processing activities.Used in: GDPR, ISO 27001:2022

Data Privacy ManagementPrivacy and Data Protection

The comprehensive approach to managing personal data privacy including policies, processes, technology, and training across the organization.Used in: GDPR, ISO 27001:2022

Data Processing AgreementPrivacy and Data Protection

A legally binding contract between a data controller and data processor that specifies the terms and conditions for processing personal data.Used in: GDPR, ISO 27001:2022

Data Processing RegisterPrivacy and Data Protection

A comprehensive record of all data processing activities within an organization, documenting purposes, categories, recipients, and retention periods.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data ProcessorPrivacy

Under GDPR, an entity that processes personal data on behalf of a data controller. Must act only on the controller's instructions and implement appropriate security measures.Used in: GDPR, ISO 27001:2022

Data ProtectionInformation Security

The set of strategies and processes used to secure the privacy, availability, and integrity of data throughout its lifecycle.Used in: GDPR, ISO 27001:2022

Data Protection AuthorityPrivacy and Data Protection

An independent public authority responsible for monitoring and enforcing data protection regulations within its jurisdiction.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data Protection Authority (DPA)Privacy

An independent public authority responsible for monitoring the application of data protection law, handling complaints, and enforcing compliance. Each EU member state has at least one DPA under the GDPR framework.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data Protection CertificationPrivacy and Data Protection

Formal certification that an organization's data protection practices meet the requirements of a recognized standard or regulatory framework.Used in: GDPR, ISO 27001:2022

Data Protection Impact AssessmentPrivacy and Data Protection

A systematic process for evaluating the potential privacy impact of a project or system that involves processing personal data, required under GDPR for high-risk processing.Used in: GDPR, ISO 27001:2022

Data Protection Impact Assessment (DPIA)Privacy

A process required by GDPR Article 35 for assessing the risks of data processing activities that are likely to result in a high risk to individuals' rights and freedoms.Used in: GDPR, ISO 27001:2022

Data Protection OfficerPrivacy and Data Protection

A designated individual responsible for overseeing an organization's data protection strategy and compliance with privacy regulations.Used in: GDPR, ISO 27001:2022

Data Protection Officer (DPO)Privacy

A role required under GDPR Article 37 for organisations that carry out large-scale systematic monitoring or process special categories of data. The DPO acts as the primary contact for data subjects and supervisory authorities.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data Protection by DefaultPrivacy

The principle that the strictest privacy settings should apply automatically without requiring user action. Under GDPR Article 25, only personal data necessary for each specific purpose should be processed by default.Used in: GDPR, ISO 27001:2022

Data Protection by DesignPrivacy

The principle of integrating data protection measures into the design and development of business processes and IT systems from the outset. Required under GDPR Article 25 and considered best practice across all privacy regulations.Used in: GDPR, ISO 27001:2022

Data PseudonymizationPrivacy and Data Protection

A data protection technique that replaces identifying information with artificial identifiers, allowing data to be re-identified when necessary using separately stored keys.Used in: GDPR, ISO 27001:2022

Data QualityAI and Technology

The degree to which data meets the requirements for its intended use in terms of accuracy, completeness, consistency, timeliness, and validity.Used in: EU AI Act

Data Quality ManagementPrivacy and Data Protection

Processes for ensuring that data is accurate, complete, consistent, and fit for its intended purpose throughout its lifecycle.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data RecoveryInformation Security

The process of restoring data that has been lost, corrupted, accidentally deleted, or otherwise made inaccessible from backup copies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data Recovery PlanBusiness Continuity

A documented strategy for restoring lost or corrupted data from backups, defining recovery procedures and priority sequences.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Data RemanenceInformation Security

The residual representation of data that remains on storage media after attempts to erase or delete it, posing a potential security risk.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data ResidencyPrivacy

Legal or regulatory requirements that personal data must be stored and processed within a specific geographic boundary or jurisdiction. Data residency laws exist in countries including Russia, China, India, and several EU member states.Used in: GDPR, ISO 27001:2022

Data RetentionPrivacy

The policies and practices governing how long an organisation keeps personal data. Privacy regulations require that personal data is not kept longer than necessary for the purpose for which it was collected.Used in: GDPR, ISO 27001:2022

Data Retention PolicyPrivacy and Data Protection

A documented policy defining how long different categories of data should be kept, when it should be archived, and when it must be permanently deleted.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data Right of ErasurePrivacy and Data Protection

The right of individuals to request the deletion of their personal data under certain conditions, also known as the right to be forgotten.Used in: GDPR, ISO 27001:2022

Data SanitisationInformation Security

The process of deliberately, permanently, and irreversibly removing or destroying data stored on a memory device. Data sanitisation ensures that residual data cannot be recovered even with advanced forensic tools.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data SanitizationInformation Security

The process of deliberately and permanently destroying data on storage media so it cannot be recovered, using methods such as overwriting, degaussing, or physical destruction.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data ScrapingPrivacy and Data Protection

The automated extraction of data from websites or applications, raising privacy concerns when personal data is collected without consent.Used in: GDPR, ISO 27001:2022

Data ScrubbingInformation Security

The process of cleaning or removing sensitive information from data sets before they are shared, published, or used for non-production purposes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data SecurityInformation Security

The practice of protecting digital information from unauthorized access, corruption, or theft throughout its entire lifecycle.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data SegmentationInformation Security

The practice of separating data into distinct categories or partitions based on sensitivity, purpose, or regulatory requirements for targeted protection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data Sharing AgreementPrivacy and Data Protection

A formal agreement between organizations that defines the terms, conditions, and safeguards for sharing personal or sensitive data.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data ShreddingInformation Security

The irreversible destruction of data by overwriting it multiple times with random patterns, ensuring it cannot be recovered from storage media.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data SovereigntyPrivacy and Data Protection

The concept that data is subject to the laws and governance structures of the country in which it is collected, stored, or processed.Used in: COBIT 2019, ISO 27001:2022

Data Sovereignty ComplianceInformation Security

Adherence to laws requiring that data collected within a jurisdiction's borders is subject to that jurisdiction's laws and remains within its territory.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Data SpillageInformation Security

The accidental exposure of classified or sensitive information in an unauthorized system or location, requiring containment and cleanup procedures.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data StewardGovernance

An individual responsible for managing data assets within a specific domain, ensuring data quality, defining data standards, and implementing data governance policies. Data stewards bridge the gap between business needs and technical data management.Used in: COBIT 2019, ISO 27001:2022

Data StewardshipGovernance

The management and oversight of data assets to ensure they are properly maintained, accurate, and used in compliance with policies.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data SubjectPrivacy

An identified or identifiable natural person whose personal data is being processed. Under GDPR, data subjects have extensive rights including access, rectification, erasure, and portability.Used in: GDPR, ISO 27001:2022

Data Subject Access RequestPrivacy and Data Protection

A formal request from an individual to an organization to obtain a copy of the personal data held about them, required to be fulfilled under privacy laws.Used in: GDPR, ISO 27001:2022

Data Subject Access Request (DSAR)Privacy

A request made by an individual to an organisation to obtain a copy of the personal data held about them. Under GDPR, organisations must respond to DSARs within one month and provide the data free of charge.Used in: GDPR, ISO 27001:2022

Data Subject RightsPrivacy and Data Protection

The legal rights granted to individuals regarding their personal data, including access, rectification, erasure, portability, and objection.Used in: GDPR, ISO 27001:2022

Data TrustPrivacy and Data Protection

A legal structure where an independent trustee manages data on behalf of a group of individuals, providing fiduciary oversight of data use.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Data VaultInformation Security

A secure, isolated storage environment for protecting highly sensitive data with strict access controls, encryption, and comprehensive audit trails.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data at RestInformation Security

Data that is stored in any digital form on persistent storage media such as hard drives, SSDs, databases, or cloud storage. Encryption of data at rest is a common security requirement across compliance frameworks.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5

Data at Rest EncryptionInformation Security

The protection of stored data using encryption algorithms so that the data remains unreadable without the proper decryption key, even if storage media is compromised.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data in MotionInformation Security

Data actively being transferred from one location to another across networks, requiring encryption and other protections during transmission.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data in TransitInformation Security

Data that is actively moving from one location to another, such as across the internet or through a private network. Protecting data in transit typically requires encryption protocols such as TLS/SSL.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Data in Transit EncryptionInformation Security

The protection of data as it moves between systems or across networks using protocols such as TLS, IPsec, or SSH to prevent interception.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

Data in UseInformation Security

Data that is actively being processed, read, or modified in memory by a CPU or application. Protecting data in use is more challenging than data at rest or in transit and may involve techniques such as confidential computing.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Database Activity MonitoringInformation Security

Real-time monitoring and analysis of database activities to detect unauthorized access, policy violations, and anomalous behavior.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Database EncryptionInformation Security

The application of encryption to data stored in databases, protecting the confidentiality of records from unauthorized database access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Database SecurityInformation Security

Measures for protecting database management systems from attacks, unauthorized access, and data breaches including access controls and encryption.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

De-identificationPrivacy

The process of removing or obscuring personal identifiers from data to reduce the risk of identifying individuals. De-identified data may still be re-identifiable under certain conditions, unlike fully anonymised data.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Dead Man SwitchInformation Security

An automated mechanism that triggers a predefined action if a specific condition is not regularly met, used in security for failsafe purposes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Decentralized Finance SecurityInformation Security

Security considerations for decentralized financial systems and applications built on blockchain technology.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Decentralized IdentityInformation Security

An identity model where individuals control their own digital identity information using cryptographic proofs rather than relying on centralized authorities.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Deception TechnologyInformation Security

Security tools that deploy decoys, honeypots, and breadcrumbs throughout an enterprise environment to detect, analyse, and defend against advanced threats by misleading attackers.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Decision RightsGovernance

The defined authority and responsibility for making specific types of decisions within an organization's governance framework.Used in: COBIT 2019, ISO 27001:2022

Decoy SystemInformation Security

A fake system or service deployed to attract attackers, diverting them from real assets while providing intelligence about their techniques and objectives.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

DecryptionInformation Security

The process of converting encrypted data back to its original plaintext form using a cryptographic key or algorithm.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Decryption KeyInformation Security

The cryptographic key used to convert encrypted ciphertext back into readable plaintext, required for authorized access to protected data.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Deep LearningAI & Technology

A subset of machine learning based on artificial neural networks with multiple layers. Deep learning models can learn complex patterns from large datasets and are used in applications such as image recognition, natural language processing, and autonomous systems.Used in: EU AI Act

Deep Packet InspectionInformation Security

A network analysis technique that examines the full content of data packets as they pass through a checkpoint to detect threats, filter content, or enforce policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

DeepfakeAI & Technology

Synthetic media created using AI techniques, particularly deep learning, to produce realistic but fabricated images, videos, or audio. Deepfakes pose security threats including identity fraud, misinformation, and social engineering.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Defence in DepthInformation Security

A security strategy that uses multiple layers of controls to protect assets. If one layer fails, others continue to provide protection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Defence in RegulationCompliance

A regulatory approach that applies multiple overlapping compliance requirements from different laws and standards. Organisations in regulated industries often face concurrent obligations from sector-specific and general compliance frameworks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Defense Industrial Base SecurityInformation Security

Security requirements for organizations in the defense supply chain that handle controlled unclassified information and classified data.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Defense StrategyInformation Security

A comprehensive plan for protecting an organization's assets and infrastructure from threats, incorporating multiple layers of security controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Defense in DepthInformation Security

A layered security strategy that uses multiple security controls at different levels so that if one control fails, others continue to provide protection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

DegaussingInformation Security

The process of eliminating data from magnetic storage media by exposing it to a strong magnetic field, rendering the data unrecoverable.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Delegated AdministrationGovernance

An access model where administrative responsibilities are distributed to specific individuals for managing resources within their scope.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Demilitarised Zone (DMZ)Information Security

A perimeter network segment that sits between an organisation's internal network and the external internet. DMZs host public-facing services while providing an additional layer of security for the internal network.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Denial ListInformation Security

A list of entities such as IP addresses, email addresses, or file hashes that are explicitly blocked from accessing a system or network.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Denial of ServiceInformation Security

An attack that disrupts normal functioning of a targeted server, service, or network by overwhelming it with a flood of traffic or requests.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Denial of Service (DoS)Information Security

An attack that aims to make a computer resource unavailable to its intended users by overwhelming it with traffic or requests. Distributed DoS (DDoS) attacks use multiple compromised systems to amplify the attack.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Denial of Service PreventionInformation Security

Security measures and technologies designed to detect and mitigate denial-of-service attacks to maintain service availability.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Dependency AnalysisBusiness Continuity

The identification and mapping of relationships between business processes, systems, and resources to understand cascade effects during disruptions.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Dependency ScanningInformation Security

Automated analysis of software dependencies and libraries to identify known vulnerabilities that could affect the security of the application.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Desktop SecurityInformation Security

Security measures for protecting desktop computers from malware, unauthorized access, data theft, and other threats.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Destructive AttackInformation Security

A cyberattack intended to permanently destroy data, systems, or infrastructure rather than steal information or extort payment.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Detection EngineeringInformation Security

The practice of designing, building, testing, and maintaining threat detection rules and analytics to identify malicious activity in security monitoring systems.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Detective ControlInformation Security

A security control designed to identify and alert on security events, policy violations, or anomalous activities after they have occurred.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

DevSecOpsInformation Security

The practice of integrating security practices within the DevOps process. DevSecOps ensures that security is a shared responsibility throughout the entire software development and deployment lifecycle.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, NIST Cybersecurity Framework 2.0

Device AuthenticationInformation Security

The process of verifying the identity of a hardware device connecting to a network or system before granting it access to resources.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Device FingerprintingInformation Security

A technique that identifies and tracks devices based on their unique combination of hardware, software, and configuration attributes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Differential PrivacyAI & Technology

A mathematical framework for sharing information about a dataset while protecting the privacy of individual records. Differential privacy adds calibrated noise to data or query results to prevent identification of individuals.Used in: GDPR, ISO 27001:2022

Digital CertificateInformation Security

An electronic document that uses a digital signature to bind a public key with an identity. Digital certificates are issued by Certificate Authorities and used in TLS/SSL, email encryption, and code signing.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Digital ConsentPrivacy and Data Protection

Electronic methods for obtaining and recording user consent for data processing, including click-through agreements and digital signature mechanisms.Used in: GDPR, ISO 27001:2022

Digital EvidenceInformation Security

Information stored or transmitted in digital form that may be used as evidence in legal proceedings or investigations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Digital ForensicsInformation Security

The process of uncovering and interpreting electronic data for use in legal proceedings or incident investigations. Digital forensics follows strict procedures to preserve evidence integrity and chain of custody.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Digital IdentityPrivacy and Data Protection

The collection of electronically captured and stored personal attributes, credentials, and identifiers that uniquely represent an individual in digital systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Digital Markets ActCompliance and Regulatory

EU regulation designed to ensure fair and open digital markets by imposing obligations on large online platforms designated as gatekeepers.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Digital Operational ResilienceBusiness Continuity

An organization's ability to build, assure, and review its technological operational integrity against ICT-related disruptions.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Digital Operational Resilience ActCompliance and Regulatory

An EU regulation (DORA) that establishes requirements for financial entities to strengthen IT security and ensure operational resilience against ICT-related disruptions.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0

Digital Operational Resilience Act (DORA)Compliance

An EU regulation that establishes uniform requirements for the security of network and information systems in the financial sector. DORA requires financial entities to manage ICT risk, test resilience, and oversee third-party providers.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0, ISO 27001:2022

Digital Rights ManagementInformation Security

Technologies that control access to and usage of digital content and devices after sale, protecting intellectual property from unauthorized copying or distribution.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Digital Services ActCompliance and Regulatory

EU regulation establishing a framework for the accountability of online platforms regarding illegal content, advertising transparency, and algorithmic transparency.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Digital SignatureInformation Security

A cryptographic mechanism that provides authentication, integrity, and non-repudiation for digital messages or documents. Digital signatures use public key cryptography to verify the sender's identity and ensure the content has not been altered.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Digital Transformation SecurityInformation Security

Security considerations and controls required when organizations undergo digital transformation initiatives that change technology and business processes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Digital TwinAI and Technology

A virtual replica of a physical system, process, or asset used for simulation, monitoring, and optimization, raising data governance and security considerations.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Direct Marketing ConsentPrivacy and Data Protection

The specific consent required before sending marketing communications to individuals, with varying requirements across different jurisdictions.Used in: GDPR, ISO 27001:2022

Directive ControlGovernance

A security control that establishes expected behavior through policies, standards, guidelines, and procedures.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Directory ServiceInformation Security

A centralized database that stores, organizes, and provides access to information about network resources and users for authentication and authorization.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Directory TraversalInformation Security

A web vulnerability that allows attackers to access files and directories outside of the web root folder by manipulating file path references. Also known as path traversal or dot-dot-slash attacks.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Disaster DeclarationBusiness Continuity

The formal invocation of a disaster recovery plan, triggering predefined response procedures and activating recovery teams and resources.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Disaster RecoveryRisk Management

The process of restoring IT systems and data after a catastrophic event. Typically governed by a Disaster Recovery Plan (DRP) with defined RTOs and RPOs.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Disaster Recovery PlanInformation Security

A documented set of policies and procedures designed to enable the recovery or continuation of vital technology infrastructure and systems following a natural or human-induced disaster.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Disaster Recovery TestingBusiness Continuity

The practice of testing disaster recovery plans and procedures to ensure they function as expected and meet recovery time and point objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Disaster Recovery as a ServiceBusiness Continuity

A cloud-based service that provides disaster recovery capabilities including automated failover, replication, and recovery of IT systems.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Disclosure PolicyInformation Security

A documented policy defining how an organization handles the reporting and disclosure of security vulnerabilities found in its systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

DisinformationInformation Security

False or misleading information deliberately created and spread to deceive, manipulate public opinion, or undermine trust in institutions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Disk EncryptionInformation Security

The encryption of an entire disk or storage volume so that all data stored on it is automatically encrypted and requires authentication to access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

DisruptionBusiness Continuity

An event that interrupts normal business operations, potentially causing financial loss, reputational damage, or regulatory consequences.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Distributed Denial of ServiceInformation Security

An attack that uses multiple compromised systems to simultaneously overwhelm a target with traffic, making services unavailable to legitimate users.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Do Not TrackPrivacy and Data Protection

A web browser signal requesting that websites and advertisers do not track the user's browsing activity for targeted advertising purposes.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Document ControlGovernance

The systematic management of documents throughout their lifecycle including creation, review, approval, distribution, revision, and archival.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Dodd-Frank ActCompliance and Regulatory

US financial reform legislation that increased regulation of the financial industry, established consumer protections, and created new oversight agencies.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Domain ControllerInformation Security

A server that responds to security authentication requests within a Windows domain, managing user accounts and security policies.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Domain-Based Message AuthenticationInformation Security

Email authentication protocols including SPF, DKIM, and DMARC that verify sender identity and prevent email spoofing and phishing attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Domain-Based Message Authentication (DMARC)Information Security

An email authentication protocol that builds on SPF and DKIM to protect against email spoofing. DMARC policies tell receiving mail servers how to handle emails that fail authentication checks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Door Access ControlInformation Security

Electronic systems that control and log physical entry through doors using credentials such as cards, PINs, biometrics, or mobile devices.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

DowntimeBusiness Continuity

A period when a system, service, or network is unavailable or not functioning, potentially impacting business operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Drive-by DownloadInformation Security

A type of cyber attack where malicious code is automatically downloaded to a user's device without their knowledge, typically through exploiting vulnerabilities in browsers, plugins, or operating systems.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Drone SecurityInformation Security

Security measures for protecting unmanned aerial vehicles and their control systems from hijacking, data interception, and physical threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Dual ControlInformation Security

A security procedure requiring two authorized individuals to perform a critical action simultaneously, preventing any single person from acting alone.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Due CareGovernance

The level of care that a reasonable person would exercise in protecting organizational information assets and complying with security requirements.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Due DiligenceAudit

The investigation or audit of a potential investment, partner, or vendor to confirm facts and assess risks. In compliance, often refers to vendor risk assessment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Due Diligence ProcessCompliance and Regulatory

A comprehensive investigation and evaluation conducted before making business decisions such as mergers, acquisitions, or vendor engagements to identify risks.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Dumpster DivingInformation Security

Searching through an organization's trash to find sensitive information such as documents, passwords, or other data useful for attacks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Dwell TimeInformation Security

The duration between when a threat actor gains initial access to a system and when the breach is detected, a key security performance metric.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Dynamic Application Security TestingInformation Security

A security testing approach that evaluates running web applications by simulating external attacks to find vulnerabilities in a deployed environment.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022