Glossary terms starting with E

Terms

EDR (Endpoint Detection and Response)Information Security

Security solutions that continuously monitor endpoints to detect, investigate, and respond to cyber threats. EDR provides real-time visibility into endpoint activities with automated response capabilities.Used in: CIS Controls v8, NIST SP 800-53 Rev 5

ENISACompliance and Regulatory

The European Union Agency for Cybersecurity that contributes to EU cyber policy and supports member states in improving cybersecurity capabilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

ERISACompliance and Regulatory

The Employee Retirement Income Security Act sets standards for retirement and health benefit plans in the private sector to protect participants.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0

EU AI ActAI & Technology

The European Union's regulation on artificial intelligence, establishing a risk-based classification system. Bans certain AI practices and imposes strict requirements on high-risk AI systems.Used in: EU AI Act

EU-US Data Privacy FrameworkPrivacy

The data transfer framework between the EU and the United States that replaced the invalidated Privacy Shield. It provides a legal mechanism for transferring personal data from the EU to US companies that have self-certified under the framework.Used in: GDPR, ISO 27001:2022

East-West TrafficInformation Security

Network traffic that flows laterally between servers and workloads within a data center, requiring security monitoring for threat detection.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

EavesdroppingInformation Security

The interception of private communications or data transmissions without the knowledge or consent of the parties involved, a form of passive attack.Used in: GDPR, ISO 27001:2022

Edge Computing SecurityAI and Technology

Security measures for protecting computing resources, data, and applications deployed at the network edge, closer to data sources and end users.Used in: EU AI Act

Education ComplianceCompliance and Regulatory

Regulatory requirements for educational institutions including student privacy, accessibility, financial aid regulations, and accreditation standards.Used in: GDPR, ISO 27001:2022, PCI DSS v4.0

Egress FilteringInformation Security

The practice of monitoring and controlling outbound network traffic to prevent unauthorised data transfers and communication with known malicious destinations. A key defence against data exfiltration and malware beaconing.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Electromagnetic InterferenceInformation Security

Electrical disturbances that can disrupt, degrade, or damage electronic equipment and data transmission, requiring shielding measures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Electronic Communications PrivacyCompliance and Regulatory

Laws governing the interception, access, and disclosure of electronic communications including email, phone calls, and stored electronic data.Used in: GDPR, ISO 27001:2022

Electronic Protected Health Information (ePHI)Compliance

Protected health information that is created, stored, transmitted, or received in any electronic format. ePHI is specifically protected under the HIPAA Security Rule, which requires administrative, physical, and technical safeguards.Used in: HIPAA Security Rule

Electronic SignaturesCompliance and Regulatory

Digital methods of indicating agreement or approval on electronic documents, with legal validity defined by regulations such as eIDAS and ESIGN.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Elliptic Curve CryptographyInformation Security

A public-key cryptographic approach based on the algebraic structure of elliptic curves over finite fields. ECC provides equivalent security to RSA with smaller key sizes, making it more efficient for mobile and IoT devices.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Email AuthenticationInformation Security

Protocols and technologies such as SPF, DKIM, and DMARC that verify the legitimacy of email senders and protect against email spoofing.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Email Security GatewayInformation Security

A solution that monitors and filters incoming and outgoing email to protect against threats such as phishing, malware, spam, and data loss. Email gateways use multiple detection engines including sandboxing and machine learning.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, EU AI Act

Embedded SecurityInformation Security

Security measures designed specifically for embedded systems and IoT devices, addressing unique constraints such as limited processing power and memory.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Embedded SystemInformation Security

A computer system with a dedicated function within a larger system, often with limited security capabilities requiring specialized protection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Emergency AccessInformation Security

Procedures for granting immediate temporary access to critical systems during emergencies when normal access control procedures cannot be followed.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Emergency CommunicationBusiness Continuity

Systems and procedures for rapidly communicating with employees, stakeholders, and the public during emergency situations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Emergency PlanningBusiness Continuity

The process of preparing for potential emergencies through risk assessment, plan development, training, and exercises.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Emergency ResponseBusiness Continuity

The immediate actions taken to protect life, property, and the environment when a crisis or disaster occurs, before recovery operations begin.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Emergency Response PlanBusiness Continuity

A documented set of procedures for responding to emergencies including evacuation, communication, medical response, and initial containment actions.Used in: HIPAA Security Rule, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Emerging RiskRisk Management

A new or evolving risk that may not be fully understood but has the potential to significantly impact an organization's objectives in the future.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Emission SecurityInformation Security

Measures taken to prevent the interception of electromagnetic emissions from electronic equipment that could reveal classified or sensitive information.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Employee PrivacyPrivacy and Data Protection

The protection of employee personal data in the workplace, including monitoring limitations, consent requirements, and data minimization obligations.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

EnclaveInformation Security

A network segment with specific security requirements that is separated from other segments through access controls and monitoring.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

EncryptionInformation Security

The process of converting data into a coded format to prevent unauthorised access. Includes encryption at rest (stored data) and encryption in transit (data being transmitted).Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Encryption AlgorithmInformation Security

A mathematical procedure used to encrypt and decrypt data, providing the computational basis for protecting information confidentiality.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Encryption KeyInformation Security

A string of bits used by a cryptographic algorithm to transform plaintext into ciphertext (encryption) or ciphertext back into plaintext (decryption).Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Encryption PolicyInformation Security

A documented policy defining requirements for encrypting data at rest, in transit, and in use across the organization.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Encryption at RestPrivacy and Data Protection

The encryption of data while it is stored on disk, database, or other storage media to protect it from unauthorized access if the storage is compromised.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

End-to-End EncryptionInformation Security

Encryption of data throughout its entire journey from sender to recipient, preventing any intermediary from accessing the content.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Endpoint Detection and ResponseInformation Security

Security solutions that continuously monitor endpoint devices to detect, investigate, and respond to cyber threats using behavioral analysis and automated response.Used in: CIS Controls v8, NIST SP 800-53 Rev 5

Endpoint ManagementInformation Security

The administration and security of all endpoint devices connecting to an organization's network, including configuration, patching, and monitoring.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, NIST SP 800-53 Rev 5

Endpoint ProtectionInformation Security

Security software and policies deployed on endpoint devices such as laptops, desktops, and mobile devices to protect against malware, exploits, and unauthorized access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Endpoint Protection PlatformInformation Security

A comprehensive security solution deployed on endpoint devices (laptops, desktops, mobile devices) to prevent, detect, and respond to threats. EPP typically combines anti-malware, personal firewall, and intrusion prevention capabilities.Used in: NIST SP 800-53 Rev 5, CIS Controls v8, NIST Cybersecurity Framework 2.0

Energy Sector ComplianceCompliance and Regulatory

Regulations specific to the energy industry including cybersecurity standards, environmental requirements, and grid reliability mandates.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Enforcement ActionCompliance and Regulatory

Regulatory measures taken against organizations that violate compliance requirements, including fines, sanctions, cease-and-desist orders, and consent agreements.Used in: GDPR, ISO 27001:2022

EnrollmentInformation Security

The process of registering a user's identity credentials such as biometric data, certificates, or tokens in an authentication system.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Enterprise ArchitectureGovernance

A conceptual framework that defines the structure and operation of an organization's IT landscape in alignment with business strategy.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Enterprise Risk ManagementRisk Management

A holistic approach to managing all types of organizational risk including strategic, operational, financial, and compliance risks in an integrated framework.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0

Enterprise Risk Management (ERM)Risk Management

A holistic approach to identifying, assessing, and managing risks across an entire organisation. Frameworks include COSO ERM and ISO 31000.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Enterprise SecurityInformation Security

The comprehensive approach to protecting all aspects of an organization's information assets across the entire enterprise.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Entitlement ManagementInformation Security

The process of managing fine-grained access rights and permissions assigned to users, defining specifically what actions they can perform on which resources.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Environmental ComplianceCompliance and Regulatory

Adherence to environmental laws and regulations governing pollution control, waste management, emissions, and natural resource protection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Environmental ControlInformation Security

Systems that maintain optimal environmental conditions in facilities housing IT equipment, including temperature, humidity, and air quality management.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Environmental MonitoringInformation Security

Continuous surveillance of environmental conditions such as temperature, humidity, water presence, and air quality in data centers and server rooms.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Environmental Social GovernanceCompliance and Regulatory

A framework evaluating an organization's practices related to environmental sustainability, social responsibility, and corporate governance standards.Used in: COBIT 2019, ISO 27001:2022

Equipment DisposalInformation Security

Secure processes for decommissioning and disposing of IT equipment to prevent data recovery and ensure compliance with environmental regulations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Equipment MaintenanceInformation Security

Regular servicing and upkeep of IT equipment and security systems to ensure continued proper operation and security compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Erasure RequestPrivacy and Data Protection

A formal request from a data subject asking an organization to delete their personal data, triggering an obligation to comply unless exemptions apply.Used in: GDPR, ISO 27001:2022

Escalation ProcedureGovernance

A defined process for elevating issues, incidents, or decisions to higher levels of authority when they exceed current handling capability.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Escrow AgreementGovernance

A contractual arrangement where critical assets such as source code or encryption keys are held by a neutral third party for release under specified conditions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Essential EightCompliance

Eight mitigation strategies recommended by the Australian Signals Directorate to protect organisations against cyber threats. The Essential Eight covers application control, patching, macro settings, user application hardening, admin privileges, MFA, backups, and patching operating systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Essential ServicesBusiness Continuity

Critical business functions and operations that must be maintained during disruptions to ensure organizational survival and stakeholder obligations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Ethernet SecurityInformation Security

Security measures applied at the data link layer to protect wired network connections from unauthorized access and eavesdropping.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Ethical AIAI and Technology

The development and deployment of AI systems that adhere to ethical principles including fairness, transparency, privacy, and non-maleficence.Used in: GDPR, ISO 27001:2022

Ethical DisclosureInformation Security

The practice of responsibly reporting discovered security vulnerabilities to affected vendors, giving them time to create patches before public disclosure.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Ethical HackingInformation Security

Authorized security testing performed by skilled professionals who use the same techniques as malicious hackers to identify vulnerabilities before they can be exploited.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Ethics CommitteeGovernance

A body within an organisation responsible for reviewing ethical issues, establishing ethical guidelines, and ensuring that business practices align with the organisation's values and ethical standards.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Event AnalysisInformation Security

The examination of security events to determine their significance, potential impact, and whether they constitute incidents requiring response.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Event LoggingInformation Security

The systematic recording of security-relevant events and activities across systems and applications for monitoring, analysis, and compliance purposes.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Event ProbabilityRisk Management

The likelihood that a specific risk event will occur within a defined time period, typically expressed as a percentage or qualitative rating.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Evidence CollectionAudit

The process of gathering documentation, records, screenshots, logs, and other artefacts that demonstrate the design and operating effectiveness of controls. Evidence collection is fundamental to compliance audits and attestation engagements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Evidence ManagementAudit and Assurance

The systematic collection, organization, storage, and retrieval of audit evidence to support compliance demonstrations and audits.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Evidence PreservationInformation Security

The process of securing and maintaining the integrity of digital evidence during and after a security incident for potential legal proceedings.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Evidence RepositoryAudit and Assurance

A centralized storage system for organizing and maintaining compliance evidence, audit artifacts, and supporting documentation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Exception ManagementCompliance

The formal process of documenting, approving, and tracking instances where an organisation cannot comply with a specific policy or control requirement. Exceptions require documented business justification, compensating controls, and periodic review.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Executive Risk ReportRisk Management

A summary report prepared for senior leadership that communicates key risks, their status, and the effectiveness of risk management activities.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Executive SponsorshipGovernance

Active support and advocacy from a senior executive for a program, project, or initiative, providing visibility, resources, and organizational authority.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Exercise ProgramBusiness Continuity

A scheduled series of drills, tabletop exercises, and simulations designed to test and improve emergency response and business continuity plans.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Exfiltration PreventionInformation Security

Controls and technologies designed to prevent the unauthorized extraction of data from an organization's network, including DLP and egress filtering.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

ExplainabilityAI & Technology

The degree to which the internal mechanics of an AI or machine learning system can be explained in human terms. Explainability is a key requirement of the EU AI Act for high-risk AI systems.Used in: EU AI Act

Explainable AIAI and Technology

AI systems and techniques designed to produce explanations of their decision-making processes that are understandable to humans, supporting trust and compliance.Used in: EU AI Act

ExploitInformation Security

A piece of software, data, or sequence of commands that takes advantage of a vulnerability in a computer system, application, or network to cause unintended behaviour such as unauthorised access or code execution.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Exploit ChainInformation Security

A sequence of multiple exploits used together to achieve a goal that no single exploit could accomplish alone, such as gaining root access.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Exploit DevelopmentInformation Security

The process of creating code or techniques that leverage security vulnerabilities, conducted by security researchers to understand and mitigate threats.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Exploit KitInformation Security

A toolkit used by attackers to automatically exploit vulnerabilities in client-side software. Exploit kits are typically hosted on compromised websites and target browser and plugin vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Export ControlCompliance and Regulatory

Regulations governing the export of sensitive goods, software, and technology to foreign countries, requiring licenses and compliance with embargo restrictions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Exposure AssessmentInformation Security

An evaluation of an organization's vulnerable attack surface including internet-facing assets, misconfigurations, and unpatched systems that could be exploited.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Extended Detection and ResponseInformation Security

An integrated security platform that correlates data across multiple security layers including endpoints, network, cloud, and email for comprehensive threat detection.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, CIS Controls v8

Extended Detection and Response (XDR)Information Security

A unified security incident detection and response platform that automatically collects and correlates data from multiple security layers including email, endpoint, server, cloud workloads, and network.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, CIS Controls v8

Extended Reality SecurityInformation Security

Security measures for protecting virtual reality, augmented reality, and mixed reality systems and the data they collect and process.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

External AuditAudit

An independent examination of an organisation's controls, processes, or financial statements conducted by a party outside the organisation. External audits provide objective assurance to stakeholders and regulators.Used in: ISO 27001:2022, PCI DSS v4.0

External AuditorAudit

An independent professional or firm engaged to examine an organisation's financial statements, controls, or compliance with standards. External auditors provide objective assurance to stakeholders, regulators, and the public.Used in: ISO 27001:2022, PCI DSS v4.0

External Penetration TestingInformation Security

Authorized security testing conducted from outside the organization's network perimeter to identify vulnerabilities accessible from the internet.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Extraterritorial ApplicationPrivacy and Data Protection

The application of privacy laws beyond a country's borders to foreign organizations that process the personal data of that country's residents.Used in: GDPR, ISO 27001:2022

eDiscoveryCompliance

The process of identifying, collecting, and producing electronically stored information for use in legal proceedings or regulatory investigations. eDiscovery requires organisations to preserve and produce relevant electronic data.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

ePrivacy DirectivePrivacy

EU Directive 2002/58/EC that regulates the processing of personal data and protection of privacy in the electronic communications sector. The ePrivacy Directive covers cookies, electronic marketing, and confidentiality of communications.Used in: GDPR, ISO 27001:2022

ePrivacy RegulationPrivacy and Data Protection

A proposed EU regulation that will replace the ePrivacy Directive, governing electronic communications privacy including cookies, direct marketing, and metadata processing.Used in: GDPR, ISO 27001:2022