Glossary terms starting with G
42 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.
Terms
- GDPRPrivacy and Data Protection
- The General Data Protection Regulation is a comprehensive EU law governing the collection, processing, and protection of personal data of individuals within the European Union.Used in: GDPR, ISO 27001:2022
- GDPR (General Data Protection Regulation)Privacy
- The EU's comprehensive data protection regulation (effective May 2018). Applies to any organisation processing personal data of EU residents, regardless of the organisation's location.Used in: GDPR, ISO 27001:2022
- GLBACompliance and Regulatory
- The Gramm-Leach-Bliley Act requires financial institutions to explain their data sharing practices and protect sensitive consumer financial information.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0
- GLBA (Gramm-Leach-Bliley Act)Compliance
- US federal law that requires financial institutions to explain their information-sharing practices and safeguard sensitive customer data. GLBA includes the Safeguards Rule, which requires comprehensive information security programmes.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0
- GRCGovernance
- Governance, Risk, and Compliance, an integrated approach to aligning IT with business objectives, managing risk, and meeting compliance requirements.Used in: COBIT 2019, ISO 27001:2022
- GRC (Governance, Risk, and Compliance)Governance
- An integrated approach to managing an organisation's governance, enterprise risk management, and regulatory compliance. GRC platforms provide unified visibility across these three disciplines.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
- GRC PlatformGovernance
- An integrated technology solution that supports governance, risk management, and compliance activities in a unified platform.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
- GRC StrategyGovernance
- A comprehensive approach to managing the interrelationship between governance, risk management, and compliance across an organization.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
- Gap AnalysisCompliance
- A comparison between an organisation's current state and the requirements of a target framework or standard. Identifies areas that need improvement to achieve compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
- Gap AssessmentAudit and Assurance
- An evaluation that compares an organization's current state against the requirements of a standard or regulation to identify areas of non-compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
- Gap RemediationInformation Security
- The process of implementing corrective actions to address identified deficiencies between current security practices and required standards or controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- Gap Remediation PlanCompliance and Regulatory
- A documented plan with specific actions, timelines, and responsibilities for addressing gaps identified during compliance assessments.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
- GatewayInformation Security
- A network point that serves as an entrance to another network, often implementing security controls such as firewalls and proxy services.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
- Gateway SecurityInformation Security
- Security controls deployed at network entry and exit points to inspect traffic, enforce policies, and prevent threats from entering or data from leaving.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- General Data Protection Regulation (GDPR)Privacy
- The EU's comprehensive data protection regulation (EU 2016/679) that harmonises data privacy laws across all member states. GDPR applies to any organisation processing personal data of EU residents, with penalties up to 4% of global annual turnover.Used in: GDPR, ISO 27001:2022
- Generative AIAI & Technology
- Artificial intelligence systems capable of generating text, images, code, audio, and other content. Generative AI raises unique governance challenges around intellectual property, misinformation, bias, and data privacy.Used in: GDPR, ISO 27001:2022, EU AI Act
- Generative AI GovernanceAI and Technology
- Policies and controls for managing the risks of generative AI systems including accuracy, bias, intellectual property, data privacy, and misuse.Used in: GDPR, ISO 27001:2022, EU AI Act
- Genetic DataPrivacy
- Personal data relating to the inherited or acquired genetic characteristics of a natural person, which gives unique information about the physiology or health of that person. Classified as special category data under GDPR.Used in: GDPR, ISO 27001:2022, HIPAA Security Rule
- GeofencingInformation Security
- A location-based security control that creates virtual boundaries to trigger actions such as access restrictions or alerts when devices enter or leave defined geographic areas.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- Geographic Access ControlInformation Security
- Security policies that restrict access to systems or data based on the physical location of the user or device making the request.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
- Geolocation DataPrivacy and Data Protection
- Data indicating the real-world geographic location of a device or individual, classified as personal data under most privacy regulations.Used in: GDPR, ISO 27001:2022
- Global Privacy ControlPrivacy and Data Protection
- A browser-level signal that communicates a user's privacy preferences to websites, automating opt-out requests under applicable privacy laws.Used in: GDPR, ISO 27001:2022
- Golden ImageInformation Security
- A pre-configured, security-hardened template for operating systems or applications used to deploy standardized and consistent system configurations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- Good Manufacturing PracticeCompliance and Regulatory
- Regulations ensuring that products are consistently produced and controlled according to quality standards, particularly in pharmaceutical and food industries.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
- GovernanceGovernance
- The system by which an organisation is directed and controlled. IT governance ensures that IT investments support business objectives and manage risks appropriately.Used in: COBIT 2019, ISO 27001:2022
- Governance AuditAudit and Assurance
- An examination of an organization's governance structures, processes, and effectiveness to ensure proper oversight and accountability.Used in: ISO 27001:2022, COBIT 2019
- Governance AutomationGovernance
- The use of technology to automate governance activities including policy management, compliance monitoring, and reporting.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
- Governance BoardGovernance
- A formal body responsible for strategic direction, oversight, and decision-making regarding information security, risk, and compliance programs.Used in: COBIT 2019, ISO 27001:2022
- Governance CommitteeGovernance
- A formal body responsible for setting direction, making decisions, and providing oversight for specific governance areas.Used in: COBIT 2019, ISO 27001:2022
- Governance DashboardGovernance
- A visual display providing real-time status of governance metrics, compliance posture, and risk indicators for leadership oversight.Used in: COBIT 2019, ISO 27001:2022
- Governance FrameworkGovernance
- A structured set of policies, processes, and practices that define how an organisation is directed, managed, and held accountable. Governance frameworks provide the foundation for decision-making, risk management, and performance monitoring.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
- Governance MaturityGovernance
- The level of sophistication and effectiveness of an organization's governance practices, measured against defined capability levels.Used in: COBIT 2019, ISO 27001:2022
- Governance ModelGovernance
- The organizational structure and processes that define how authority is distributed, decisions are made, and accountability is maintained.Used in: COBIT 2019, ISO 27001:2022
- Governance ReportingGovernance
- The process of communicating governance performance, compliance status, and risk information to board members and senior management.Used in: COBIT 2019, ISO 27001:2022
- Governance Risk and ComplianceGovernance
- An integrated approach to managing organizational governance, enterprise risk management, and regulatory compliance to ensure alignment with business objectives.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
- Governance StructureGovernance
- The organizational hierarchy and arrangement of roles, committees, and reporting lines that enable effective governance and oversight.Used in: COBIT 2019, ISO 27001:2022
- Government ComplianceCompliance and Regulatory
- Regulatory requirements specific to government agencies and contractors including security clearances, procurement rules, and transparency mandates.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
- Gray Box TestingInformation Security
- A security testing approach where the tester has partial knowledge of the target system, such as user credentials or basic architecture information.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
- Green IT ComplianceCompliance and Regulatory
- Adherence to environmental regulations and sustainability standards related to IT operations including energy efficiency and electronic waste.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
- Gross RiskRisk Management
- The total level of risk before any controls, mitigation measures, or risk treatment actions are applied, also known as inherent risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
- Group PolicyInformation Security
- A Windows feature for centrally managing and configuring operating systems, applications, and user settings across an Active Directory environment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- Guard ServiceInformation Security
- Professional security personnel deployed to protect facilities, control access, monitor surveillance systems, and respond to security incidents.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5