Glossary terms starting with K

Terms

KYC (Know Your Customer)Compliance

The process of verifying the identity and assessing the suitability of customers. A key component of anti-money laundering compliance.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

KerberosInformation Security

A network authentication protocol that uses secret-key cryptography to authenticate client-server applications. Kerberos provides mutual authentication where both the user and server verify each other's identity.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Key ControlRisk Management

A critical control that directly addresses a significant risk and whose failure would materially increase the likelihood or impact of that risk.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Key EscrowInformation Security

An arrangement in which cryptographic keys are held by a trusted third party (escrow agent) for later retrieval under defined conditions. Key escrow enables lawful access to encrypted data when the original key holder is unavailable.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Key ManagementInformation Security

The administration of cryptographic keys in a cryptosystem, including generation, exchange, storage, use, destruction, and replacement of keys. Proper key management is essential for maintaining the security of encrypted data.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Key Management PhysicalInformation Security

The secure management of physical keys and locks used for facility access, including key distribution, tracking, and periodic rekeying.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Key Performance IndicatorRisk Management

A measurable value that demonstrates how effectively an organization is achieving key business and security objectives.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Key Performance Indicator (KPI)Governance

A measurable value that demonstrates how effectively an organisation is achieving key objectives. In compliance, KPIs track metrics such as control effectiveness, audit findings closure rate, and policy compliance percentages.Used in: ISO 27001:2022, COBIT 2019, NIST Cybersecurity Framework 2.0

Key Risk IndicatorRisk Management

A metric that provides early warning signals about increasing risk levels, enabling proactive risk management and timely intervention.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Key Risk Indicator (KRI)Risk Management

A metric used to signal increasing risk exposures in various areas of an enterprise. KRIs provide early warning signs that enable proactive risk management.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Key RotationInformation Security

The practice of periodically replacing cryptographic keys with new ones to limit the amount of data encrypted with any single key.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

KeyloggerInformation Security

Malicious software or hardware that records keystrokes made by a user. Keyloggers are used to capture passwords, credit card numbers, and other sensitive information without the user's knowledge.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Kill SwitchInformation Security

A mechanism built into software or hardware that allows it to be shut down or disabled remotely. In security, kill switches can be used to disable compromised devices or halt the spread of malware.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Know Your CustomerCompliance and Regulatory

Regulatory requirements for financial institutions to verify the identity of clients and assess their risk profile before establishing a business relationship.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, PCI DSS v4.0

Knowledge ManagementGovernance

The process of creating, sharing, using, and managing an organization's knowledge and information to achieve organizational objectives.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Kubernetes SecurityCloud Security

Security practices for protecting Kubernetes clusters and containerized applications, including pod security, network policies, RBAC, and secrets management.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1