Glossary terms starting with F

Terms

FAIR (Factor Analysis of Information Risk)Risk Management

A quantitative risk analysis model that provides a framework for understanding, measuring, and analysing information risk in financial terms. FAIR decomposes risk into measurable factors: loss event frequency and loss magnitude.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

FDA 21 CFR Part 11Compliance and Regulatory

US FDA regulations establishing criteria for accepting electronic records and electronic signatures as equivalent to paper records and handwritten signatures.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0

FERPACompliance and Regulatory

The Family Educational Rights and Privacy Act protects the privacy of student education records and gives parents and eligible students control over their information.Used in: GDPR, NIST SP 800-53 Rev 5, ISO 27001:2022

FFIECCompliance

The Federal Financial Institutions Examination Council that prescribes uniform principles, standards, and report forms for the federal examination of financial institutions. FFIEC guidance covers cybersecurity, IT, and operational risk.Used in: PCI DSS v4.0

FIPSCompliance and Regulatory

Federal Information Processing Standards, US government standards for computer systems used by non-military federal agencies and government contractors.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

FISMACompliance and Regulatory

The Federal Information Security Modernization Act requires federal agencies to implement comprehensive security programs for their information systems.Used in: NIST SP 800-53 Rev 5, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Facility SecurityInformation Security

Comprehensive physical security measures for organizational facilities including access controls, surveillance, environmental protection, and visitor management.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Fail OpenInformation Security

A system behavior where access is permitted when a security control fails, prioritizing availability over security in specific use cases.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Fail SecureInformation Security

A design principle where a system defaults to a secure state when a failure occurs, maintaining protection even during malfunction.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

FailbackBusiness Continuity

The process of restoring operations from a backup or disaster recovery site back to the original primary site after a disruption is resolved.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

FailoverInformation Security

The automatic switching to a redundant or standby system, server, or network when the primary system fails. Failover ensures continuity of operations and is a critical component of high-availability architectures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8

Failure Mode and Effects AnalysisRisk Management

A systematic methodology for evaluating processes to identify potential failure modes, their causes, effects, and priority for corrective action.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Fair Credit Reporting ActCompliance and Regulatory

US federal law (FCRA) that regulates the collection, dissemination, and use of consumer credit information to protect privacy and ensure accuracy.Used in: GDPR, ISO 27001:2022

Fair Information PracticesPrivacy and Data Protection

A set of internationally recognized principles for protecting personal information privacy, forming the foundation of most modern data protection laws.Used in: GDPR, ISO 27001:2022

False NegativeInformation Security

A security detection failure where a genuine threat is not identified, allowing malicious activity to proceed undetected.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

False PositiveInformation Security

An alert or detection that incorrectly indicates malicious activity when the activity is actually legitimate. High false positive rates reduce the effectiveness of security monitoring by causing alert fatigue.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Fault ToleranceBusiness Continuity

The ability of a system to continue operating properly in the event of the failure of some of its components.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

FedRAMPCloud

The Federal Risk and Authorization Management Program, a US government programme that standardises security assessment and authorisation for cloud services used by federal agencies.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5

FedRAMP AuthorizationCloud

The formal process through which a cloud service provider obtains approval to offer its services to US federal agencies. FedRAMP authorization requires implementing NIST SP 800-53 controls and assessment by a Third Party Assessment Organization.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5

Federal ComplianceCompliance and Regulatory

Adherence to regulations and standards mandated by federal government agencies for organizations operating within their jurisdiction.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Federal Information Security Modernization Act (FISMA)Compliance

US legislation that requires federal agencies to develop, document, and implement information security programmes. FISMA mandates the use of NIST standards and the NIST Risk Management Framework.Used in: NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Federated Identity ManagementInformation Security

A system enabling users to access multiple applications across different organizations using the same credentials through trust relationships.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

Federated LearningAI & Technology

A machine learning approach where a model is trained across multiple decentralised devices or servers holding local data samples, without exchanging the raw data. Federated learning helps preserve data privacy while enabling collaborative model training.Used in: GDPR, ISO 27001:2022, EU AI Act

Fiduciary DutyGovernance

The legal obligation to act in the best interest of another party, applicable to board members and officers regarding organizational governance.Used in: COBIT 2019, ISO 27001:2022

Field-Level EncryptionInformation Security

Encryption applied to individual data fields within a database or application, allowing granular control over which specific data elements are protected.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

File Integrity MonitoringInformation Security

A security control that detects changes to critical system files, configurations, and content by comparing current states against known good baselines.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

File Integrity Monitoring (FIM)Information Security

A security control that validates the integrity of operating system and application files by comparing their current state against a known good baseline. FIM is required by PCI DSS and recommended by most security frameworks.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, CIS Controls v8

File Transfer Protocol SecurityInformation Security

Security measures for protecting file transfers including encryption, authentication, and integrity verification when using FTP and its secure variants.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Financial Action Task Force (FATF)Compliance

An intergovernmental organisation that sets international standards for combating money laundering, terrorist financing, and other threats to the integrity of the international financial system.Used in: PCI DSS v4.0

Financial AuditAudit and Assurance

An examination of an organization's financial statements and records to verify accuracy and compliance with accounting standards.Used in: ISO 27001:2022, PCI DSS v4.0

Financial ComplianceCompliance and Regulatory

Adherence to laws and regulations governing financial reporting, transactions, and operations within the financial services industry.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Financial Conduct AuthorityCompliance and Regulatory

The UK regulatory body responsible for overseeing financial markets and firms, ensuring consumer protection, market integrity, and competition.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Financial RiskRisk Management

The possibility of monetary loss arising from financial transactions, market conditions, credit defaults, or other financial factors.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Financial Services ComplianceCompliance and Regulatory

The comprehensive set of regulations governing financial institutions including banking, insurance, securities, and payment processing.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

FindingAudit

A conclusion drawn from audit evidence that identifies a condition, criteria, cause, and effect. Audit findings range from major nonconformities to minor observations and recommendations for improvement.Used in: ISO 27001:2022

Finding ClassificationAudit and Assurance

The categorization of audit findings by severity such as critical, major, minor, or observation to prioritize remediation efforts.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Fire SuppressionInformation Security

Systems designed to detect and extinguish fires in facilities, particularly data centers, using methods that minimize damage to equipment and data.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

FirewallInformation Security

A network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Firewalls establish a barrier between trusted internal networks and untrusted external networks.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Firmware SecurityInformation Security

Practices and technologies for ensuring the integrity and security of firmware code that controls hardware device behavior and boot processes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Flow AnalysisInformation Security

The examination of network flow data including source, destination, volume, and timing to identify anomalous patterns and potential security threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Follow-Up AuditAudit and Assurance

An audit conducted to verify that corrective actions from previous audit findings have been effectively implemented and sustained.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Forensic AnalysisInformation Security

The detailed technical examination of digital evidence to determine the cause, scope, and impact of a security incident.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Forensic ImageInformation Security

A bit-for-bit copy of a storage device or partition created for digital forensic analysis while preserving the integrity of the original evidence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Forensic ReadinessInformation Security

The ability of an organization to efficiently collect, preserve, and analyze digital evidence when needed for incident investigation or legal proceedings.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Forensic ToolkitInformation Security

A collection of hardware and software tools used by digital forensic investigators to collect, preserve, and analyze digital evidence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Format-Preserving EncryptionInformation Security

An encryption technique that produces ciphertext in the same format as the plaintext, useful for encrypting data while maintaining legacy system compatibility.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Forward SecrecyInformation Security

A property of cryptographic protocols ensuring that session keys cannot be compromised even if the server's private key is later compromised.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Foundation ModelAI & Technology

A large-scale AI model trained on broad data that can be adapted to a wide range of downstream tasks. Foundation models (such as large language models) are subject to specific transparency requirements under the EU AI Act.Used in: EU AI Act

Fourth-Party RiskRisk Management

Risks arising from the subcontractors and service providers used by an organization's direct third-party vendors and partners.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

FrameworkCompliance

A structured set of guidelines, practices, and controls that organisations use to manage specific aspects of their operations. Compliance frameworks provide requirements for achieving and demonstrating compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Framework AlignmentCompliance and Regulatory

The process of mapping an organization's existing controls and practices to the requirements of a compliance framework to identify gaps and overlaps.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Framework ComparisonCompliance and Regulatory

The analysis of similarities and differences between compliance frameworks to identify overlapping requirements and optimize multi-framework compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Framework MappingCompliance and Regulatory

The process of creating correspondences between controls in different compliance frameworks to streamline multi-standard compliance efforts.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Franchise RuleCompliance and Regulatory

Federal regulations requiring franchisors to provide prospective franchisees with specific pre-sale disclosures about the franchise system and its performance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Fraud DetectionInformation Security

Technologies and processes for identifying fraudulent activities and transactions through pattern analysis, anomaly detection, and rule-based monitoring.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, CIS Controls v8

Fraud PreventionInformation Security

Controls and measures designed to deter and prevent fraudulent activities including financial fraud, identity fraud, and internal fraud.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, PCI DSS v4.0

Full Disk EncryptionInformation Security

A security measure that encrypts all data on a storage device, including the operating system, so that data is inaccessible without proper authentication.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Full RecoveryBusiness Continuity

The complete restoration of all affected systems, data, and operations to their normal state following a disruption or disaster.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Fuzz TestingInformation Security

A software testing technique that provides invalid, unexpected, or random data as input to programs to discover security vulnerabilities and coding errors.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

FuzzingInformation Security

An automated software testing technique that involves providing invalid, unexpected, or random data as inputs to a computer program. Fuzzing aims to discover coding errors and security vulnerabilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8