Glossary terms starting with L
35 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.
Terms
- LGPDPrivacy and Data Protection
- Brazil's General Data Protection Law (Lei Geral de Protecao de Dados) that regulates the processing of personal data of individuals in Brazil.Used in: GDPR, ISO 27001:2022
- Labor ComplianceCompliance and Regulatory
- Adherence to employment laws and regulations covering wages, working hours, safety, discrimination, harassment, and employee rights.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
- Large Language Model (LLM)AI & Technology
- An AI model trained on large quantities of text data that can generate, summarise, translate, and reason about natural language. LLMs are a type of foundation model that powers conversational AI and text generation applications.Used in: EU AI Act
- Lateral MovementInformation Security
- Techniques used by attackers after gaining initial access to move through a network to find and access higher-value targets. Lateral movement involves using compromised credentials and exploiting trust relationships between systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
- Lawful BasisPrivacy
- The legal ground for processing personal data under GDPR Article 6. The six lawful bases are: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests.Used in: GDPR, ISO 27001:2022
- Lawful Basis for ProcessingPrivacy and Data Protection
- The legal grounds under data protection law that justify the processing of personal data, including consent, contract performance, legitimate interest, and legal obligation.Used in: GDPR, ISO 27001:2022
- Layer 7 FirewallInformation Security
- A firewall that operates at the application layer of the OSI model, inspecting and filtering traffic based on application-specific content and behavior.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
- Least PrivilegeInformation Security
- The security principle of granting users only the minimum access rights needed to perform their job functions. Reduces the attack surface and limits damage from compromised accounts.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
- Least Privilege PrincipleInformation Security
- A security concept requiring that users and systems are granted only the minimum level of access necessary to perform their authorized functions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
- Legal ComplianceCompliance and Regulatory
- Adherence to all applicable laws and statutes that govern an organization's operations, including civil, criminal, and administrative law.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
- Legal HoldCompliance and Regulatory
- A directive to preserve all relevant documents, data, and records when litigation is anticipated, overriding normal retention and deletion schedules.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
- Legal Industry ComplianceCompliance and Regulatory
- Regulatory and ethical requirements for legal professionals and law firms including client confidentiality, conflicts of interest, and data protection.Used in: GDPR, ISO 27001:2022
- Legal PrivilegeCompliance and Regulatory
- The protection of communications between an attorney and client from disclosure, relevant to incident investigations and compliance matters.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
- Legal RiskRisk Management
- The potential for financial loss or business disruption arising from legal actions, regulatory enforcement, or failure to comply with legal obligations.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022
- Legitimate InterestPrivacy
- One of six lawful bases for processing personal data under GDPR. Processing is lawful when necessary for the legitimate interests of the controller or a third party, provided those interests are not overridden by the rights of the data subject.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
- Legitimate Interest AssessmentPrivacy and Data Protection
- A structured evaluation to determine whether a data controller's legitimate interests override the privacy rights of the individuals affected.Used in: GDPR, ISO 27001:2022
- Lei Geral de Protecao de Dados (LGPD)Privacy
- Brazil's comprehensive data protection law modelled after the GDPR. LGPD establishes rules for the collection, processing, storage, and sharing of personal data and applies to any organisation processing data of individuals in Brazil.Used in: GDPR, ISO 27001:2022
- Lessons LearnedGovernance
- The documented knowledge gained from experiences, both positive and negative, used to improve future performance and prevent recurring issues.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
- Lessons Learned ReportInformation Security
- A document capturing insights from a security incident or exercise, including what worked well and what needs improvement.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- License ManagementGovernance
- The process of tracking, controlling, and optimizing the use of software licenses to ensure compliance with vendor terms.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
- Licensing ComplianceCompliance and Regulatory
- Ensuring proper acquisition, tracking, and adherence to the terms and conditions of software licenses and intellectual property agreements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
- Likelihood AssessmentRisk Management
- The evaluation of the probability that a specific threat will exploit a vulnerability, resulting in an adverse event.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
- Link EncryptionInformation Security
- Encryption of data at the data link layer that protects all traffic on a communication link, including headers and routing information.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
- Load Balancer SecurityInformation Security
- Security considerations for load balancing infrastructure including SSL/TLS termination, traffic inspection, and protection against application-layer attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
- Loading Dock SecurityInformation Security
- Security measures for shipping and receiving areas to prevent unauthorized access, theft, and introduction of malicious items into facilities.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
- Location PrivacyPrivacy and Data Protection
- The protection of information about an individual's physical movements and geographic position from unauthorized collection and use.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR
- Lock SecurityInformation Security
- Physical locking mechanisms used to secure doors, cabinets, and equipment, including mechanical locks, electronic locks, and combination locks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- Log AggregationInformation Security
- The collection and centralization of log data from multiple sources into a single repository for unified analysis and monitoring.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
- Log AnalysisInformation Security
- The examination of system and application logs to identify security events, troubleshoot issues, and support compliance monitoring.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
- Log CorrelationInformation Security
- The process of analyzing log data from multiple sources to identify related events and detect patterns that may indicate security threats.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
- Log ManagementInformation Security
- The process of collecting, aggregating, storing, and analysing log data from various sources across an IT environment. Log management supports security monitoring, compliance reporting, and incident investigation.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
- Log RetentionInformation Security
- Policies defining how long log data must be stored based on compliance requirements, security needs, and organizational policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- Log SourceInformation Security
- A system, device, or application that generates log data used for security monitoring, compliance verification, and forensic analysis.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
- Logic BombInformation Security
- Malicious code that is deliberately inserted into a system and designed to execute when specific conditions are met, such as a particular date or the deletion of a user account.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
- Loss EventRisk Management
- An occurrence that results in actual financial loss, operational disruption, or other negative impact to an organization.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022