Glossary terms starting with M

Terms

MAC Address FilteringInformation Security

A network access control method that allows or denies network access based on the hardware (MAC) address of the connecting device. MAC filtering provides a basic layer of access control for wireless networks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

MAS TRMCompliance and Regulatory

The Monetary Authority of Singapore's Technology Risk Management guidelines for financial institutions to manage technology and cyber risks.Used in: NIST Cybersecurity Framework 2.0, PCI DSS v4.0

MFA (Multi-Factor Authentication)Information Security

An authentication method requiring two or more verification factors: something you know (password), something you have (token), or something you are (biometric).Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

MITREInformation Security

A non-profit organization that operates federally funded research centers and maintains cybersecurity resources including the ATT&CK framework and CVE program.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

MITRE ATT&CKInformation Security

A globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and security assessment.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Machine LearningAI & Technology

A branch of artificial intelligence that enables systems to learn and improve from experience without being explicitly programmed. Machine learning algorithms build models from training data to make predictions or decisions.Used in: EU AI Act

Machine Learning OperationsAI and Technology

Practices for deploying, monitoring, and maintaining machine learning models in production, including security, versioning, and performance monitoring.Used in: EU AI Act, NIST Cybersecurity Framework 2.0, CIS Controls v8

Mail SecurityInformation Security

Procedures for screening incoming mail and packages for potential threats such as suspicious substances, devices, or social engineering materials.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Maintenance WindowGovernance

A scheduled period during which systems may be taken offline for maintenance, updates, and patches with minimal business impact.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

MalwareInformation Security

Any software intentionally designed to cause damage to a computer, server, client, or computer network. Malware types include viruses, worms, trojans, ransomware, spyware, adware, and rootkits.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Malware AnalysisInformation Security

The process of examining malicious software to understand its behavior, origin, purpose, and potential impact, supporting incident response and threat intelligence.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8

Malware SandboxInformation Security

An isolated testing environment used to safely execute and analyze suspicious files or programs to observe their behavior without risking production systems.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Man-in-the-Browser AttackInformation Security

An attack that uses a trojan to intercept and manipulate web browser sessions, modifying web pages and transactions in real time.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, PCI DSS v4.0

Man-in-the-Middle AttackInformation Security

An attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. MITM attacks can intercept sensitive data such as login credentials and financial information.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, PCI DSS v4.0

Managed Detection and ResponseInformation Security

A security service that combines technology and human expertise to monitor, detect, investigate, and respond to threats on behalf of an organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Managed Detection and Response (MDR)Information Security

A cybersecurity service that combines technology and human expertise to perform threat hunting, monitoring, and response. MDR providers deliver 24/7 security operations capabilities to organisations that lack in-house resources.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Managed FirewallInformation Security

A firewall service where a third-party provider manages the deployment, configuration, monitoring, and maintenance of firewall infrastructure.Used in: NIST SP 800-53 Rev 5, CIS Controls v8, NIST Cybersecurity Framework 2.0

Managed Security Service ProviderInformation Security

A third-party organization that provides outsourced monitoring and management of security devices and systems, delivering 24/7 security operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8

Managed Service ProviderInformation Security

A third-party organization that remotely manages IT infrastructure, systems, and services on behalf of client organizations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Management ReviewCompliance

A periodic evaluation by top management of the suitability, adequacy, effectiveness, and alignment of the management system with strategic direction. Management reviews are required by all ISO management system standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Management SystemGovernance

An integrated set of policies, processes, and procedures that an organization uses to achieve its objectives in a systematic and structured manner.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Management System AuditAudit and Assurance

An examination of an organization's management system to verify it conforms to the requirements of an applicable standard.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Mandatory Access Control (MAC)Information Security

An access control model in which the operating system constrains the ability of a subject to access or perform operations on an object. Access decisions are based on security labels assigned to both subjects and objects.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Mandatory ReportingCompliance and Regulatory

Legal obligations requiring organizations or individuals to report specific events such as data breaches, suspicious activities, or safety incidents to authorities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

MantrapInformation Security

A physical access control mechanism consisting of two interlocking doors where only one can open at a time, preventing tailgating into secure areas.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Manufacturing ComplianceCompliance and Regulatory

Regulatory requirements for manufacturing operations including quality standards, safety regulations, environmental compliance, and product liability.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Maritime CybersecurityInformation Security

Security measures for protecting maritime vessel systems, port infrastructure, and shipping operations from cyber threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Material RiskRisk Management

A risk of sufficient magnitude that its occurrence could significantly affect the organization's financial condition, operations, or reputation.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Material WeaknessAudit and Assurance

A significant deficiency in internal controls that creates a reasonable possibility of a material misstatement not being prevented or detected.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Maturity AssessmentGovernance

An evaluation of an organization's processes, capabilities, or programs against a defined maturity model to identify strengths and improvement areas.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Maturity ModelInformation Security

A framework that describes levels of organisational capability or process maturity, typically from initial/ad hoc to optimised. Used to benchmark progress and set improvement targets.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Maximum Acceptable OutageBusiness Continuity

The longest period of time that a business function or process can be disrupted before causing unacceptable damage to the organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Maximum Tolerable DowntimeBusiness Continuity

The maximum time a business process can be unavailable before the resulting harm becomes unacceptable to the organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Mean Time to ContainInformation Security

A metric measuring the average time from when a security incident is detected to when it is fully contained.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Mean Time to DetectInformation Security

A metric measuring the average time between the occurrence of a security incident and its detection by the organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Mean Time to Detect (MTTD)Information Security

The average time it takes for an organisation to discover a security incident or threat. Reducing MTTD is a key objective of security operations, as faster detection limits the damage an attacker can cause.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Mean Time to RecoverInformation Security

A metric measuring the average time required to restore normal operations after a security incident or system failure.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Mean Time to RespondInformation Security

A metric measuring the average time from detection of a security incident to the initiation of response actions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Mean Time to Respond (MTTR)Information Security

The average time it takes for an organisation to contain and remediate a security incident after detection. MTTR measures the efficiency of incident response processes and is a key security operations metric.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8

Media ComplianceCompliance and Regulatory

Regulatory requirements for media organizations including content regulations, advertising standards, data protection, and intellectual property laws.Used in: GDPR, ISO 27001:2022

Media ProtectionInformation Security

Security controls for protecting storage media including hard drives, USB devices, tapes, and optical media from unauthorized access and damage.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Media SanitizationInformation Security

The process of rendering data on electronic media unrecoverable through methods such as clearing, purging, or destroying the storage media.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Memory ForensicsInformation Security

The analysis of volatile memory dumps to identify malicious activity, extract artifacts, and investigate security incidents that leave traces in system RAM.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Metadata PrivacyPrivacy and Data Protection

Privacy considerations related to metadata such as communication timestamps, device identifiers, and browsing patterns that can reveal personal information.Used in: GDPR, ISO 27001:2022

Metaverse ComplianceCompliance and Regulatory

Emerging regulatory considerations for virtual world platforms including user privacy, content moderation, digital commerce, and identity management.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR

Metrics and MeasurementGovernance

The definition, collection, and analysis of quantitative data to evaluate performance, effectiveness, and compliance of programs and controls.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Metrics and ReportingGovernance

The systematic collection, analysis, and presentation of data that measures the performance and effectiveness of security controls, compliance programmes, and risk management activities. Metrics enable data-driven decision-making.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022

Micro-SegmentationInformation Security

A security technique that divides a network into small, isolated segments with individual security policies to limit lateral movement and contain breaches.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

MicrosegmentationInformation Security

A network security technique that enables fine-grained security policies to be assigned to individual workloads or applications, limiting lateral movement within a data centre or cloud environment.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5

Minimal Data CollectionPrivacy and Data Protection

The practice of collecting only the personal data that is strictly necessary for a specific stated purpose, avoiding excessive data gathering.Used in: GDPR, ISO 27001:2022

Minimum Business Continuity ObjectiveBusiness Continuity

The minimum level of services or products that must be maintained during a disruption to be considered acceptable to the organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Minimum Security RequirementsInformation Security

The baseline set of security controls that must be implemented for all systems within an organization, regardless of risk level.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Mining ComplianceCompliance and Regulatory

Regulations governing mining operations including safety standards, environmental protection, land use, and worker health requirements.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Mobile Application ManagementInformation Security

Policies and tools for controlling and securing enterprise applications on mobile devices, including app distribution, configuration, and data protection.Used in: GDPR, ISO 27001:2022, CIS Controls v8

Mobile CodeInformation Security

Software transferred across a network and executed on a local system, such as Java applets and scripts, requiring security controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Mobile Device ManagementInformation Security

A solution that allows organizations to manage, monitor, and secure employees' mobile devices that access enterprise data and applications.Used in: CIS Controls v8, NIST SP 800-53 Rev 5

Mobile Device Management (MDM)Information Security

Software that allows IT departments to control, secure, and enforce policies on smartphones, tablets, and other endpoint devices. MDM enables remote wiping, app management, and configuration enforcement.Used in: CIS Controls v8, NIST SP 800-53 Rev 5

Mobile Penetration TestingInformation Security

Authorized security testing of mobile applications and their backend services to identify platform-specific vulnerabilities and data leakage risks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Mobile Threat DefenseInformation Security

Security solutions that protect mobile devices from device-level, network-level, and application-level threats through continuous monitoring and automated response.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, NIST SP 800-53 Rev 5

Model CardAI & Technology

A documentation framework for machine learning models that provides details about a model's intended use, performance metrics, training data, limitations, and ethical considerations. Model cards promote transparency and responsible AI use.Used in: EU AI Act

Model Contract ClausesPrivacy and Data Protection

Standardized contractual provisions approved by data protection authorities for international transfers of personal data to countries without adequate protection levels.Used in: GDPR, ISO 27001:2022

Model GovernanceAI and Technology

The framework for overseeing the development, validation, deployment, and ongoing monitoring of analytical and AI models used in decision-making.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Model ValidationAI and Technology

The process of evaluating an AI or analytical model to verify it performs as intended, produces accurate results, and complies with regulatory requirements.Used in: EU AI Act

Money Laundering ReportingCompliance and Regulatory

Obligations for regulated entities to report suspicious transactions and activities that may indicate money laundering to financial intelligence units.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Monitoring PolicyGovernance

A documented policy defining what activities and systems are monitored, how monitoring data is used, and retention requirements.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Monte Carlo SimulationRisk Management

A mathematical technique that uses random sampling to model the probability of different outcomes in risk scenarios that involve uncertainty.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Multi-CloudCloud

A strategy that uses cloud services from two or more cloud providers simultaneously. Multi-cloud approaches increase flexibility and reduce vendor lock-in but introduce complexity in security, compliance, and governance.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, COBIT 2019

Multi-Cloud SecurityInformation Security

Security strategies and tools designed to protect data, applications, and infrastructure across multiple cloud service providers with consistent policies.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022

Multi-Factor AuthenticationInformation Security

An authentication method requiring users to present two or more distinct types of evidence to verify their identity before gaining access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Multi-Factor Authentication (MFA)Information Security

An authentication method that requires users to provide two or more verification factors to gain access to a resource. MFA combines something you know (password), something you have (token), and something you are (biometric).Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Multi-Framework ComplianceCompliance and Regulatory

The practice of simultaneously meeting the requirements of multiple compliance frameworks and standards through integrated control implementation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Multi-Tenant SecurityCloud Security

Security measures that ensure isolation and protection of data and resources between different customers sharing the same cloud infrastructure.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022

Mutual Aid AgreementBusiness Continuity

A formal arrangement between organizations to share resources and provide assistance to each other during emergencies or disasters.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Mutual AuthenticationInformation Security

A security process in which both parties in a communication verify each other's identity before exchanging data, preventing impersonation attacks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5