Glossary terms starting with O

37 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.

OAuthInformation Security: An open standard authorisation protocol that enables applications to obtain limited access to user accounts on third-party services. OAuth 2.0 is widely used for delegated authorisation in web and mobile applications.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
OCSP StaplingInformation Security: A method for checking the revocation status of digital certificates that improves performance by having the server include the certificate status in the TLS handshake.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
OCTAVERisk Management: Operationally Critical Threat, Asset, and Vulnerability Evaluation, a risk assessment methodology developed by Carnegie Mellon University. OCTAVE focuses on organisational risk and strategic practice rather than technology risk alone.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
OSCP CertificationInformation Security: Offensive Security Certified Professional, a hands-on penetration testing certification requiring demonstration of practical exploitation skills.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
OWASPInformation Security: The Open Worldwide Application Security Project, a non-profit foundation that produces resources and tools for improving software security.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
OWASP Top 10Information Security: A regularly updated report from the Open Web Application Security Project that lists the ten most critical web application security risks. The OWASP Top 10 is widely adopted as a baseline for web application security testing.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
OWASP Top TenInformation Security: A regularly updated list of the ten most critical web application security risks published by the Open Web Application Security Project.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
ObfuscationInformation Security: Techniques used to make code, data, or communications deliberately difficult to understand, used both defensively and by attackers to evade detection.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Object Storage SecurityInformation Security: Security measures for protecting data stored in object storage systems including access policies, encryption, versioning, and immutability settings.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
ObservationAudit: A finding noted during an audit that does not constitute a nonconformity but represents an area where improvement is recommended. Observations may indicate emerging risks or opportunities to strengthen the management system.Used in: ISO 27001:2022
Observation ReportAudit and Assurance: A document identifying an area where improvement is possible but that does not constitute a formal nonconformity.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Occupational Health and SafetyCompliance and Regulatory: Standards and regulations requiring employers to provide safe working conditions and protect workers from health hazards in the workplace.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Occupational Safety ComplianceCompliance and Regulatory: Adherence to workplace health and safety regulations designed to prevent injuries, illnesses, and fatalities in the workplace.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Off-BoardingInformation Security: The process of securely revoking all access, retrieving assets, and completing security procedures when an employee or contractor leaves the organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Offensive SecurityInformation Security: A proactive approach to security that involves simulating attacks against systems and networks to identify vulnerabilities before malicious actors exploit them.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Offsite BackupInformation Security: Backup copies of data stored at a geographically separate location from the primary data center to protect against site-wide disasters.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Oil and Gas ComplianceCompliance and Regulatory: Regulations specific to the oil and gas industry including environmental protection, worker safety, pipeline security, and operational standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
On-Boarding SecurityInformation Security: Security procedures performed when new employees or contractors join an organization, including background checks, access provisioning, and training.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
One-Time PasswordInformation Security: A password that is valid for only a single login session or transaction, generated dynamically to provide an additional layer of authentication security.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, PCI DSS v4.0
Online TrackingPrivacy and Data Protection: Technologies and practices used to monitor and record user behavior across websites and applications, including cookies, pixels, and fingerprinting.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Open Banking SecurityInformation Security: Security requirements for open banking implementations that share financial data through APIs between banks and authorized third-party providers.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, PCI DSS v4.0
Open Source IntelligenceInformation Security: The collection and analysis of publicly available information from open sources to support security investigations and threat intelligence activities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Operating ModelGovernance: A description of how an organization delivers value through the arrangement of its people, processes, technology, and governance structures.Used in: COBIT 2019, ISO 27001:2022
Operational AuditAudit and Assurance: An examination of an organization's operations and processes to evaluate efficiency, effectiveness, and compliance with policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Operational ContinuityBusiness Continuity: The ability to maintain critical business operations during and after disruptive events through preparedness and response planning.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Operational ExcellenceGovernance: The execution of business operations in a manner that achieves consistent, reliable, and superior results through continuous improvement.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Operational ImpactRisk Management: The effect that a security incident, system failure, or risk event has on an organization's day-to-day business operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Operational ResilienceGovernance: The ability of an organisation to continue to deliver critical operations through disruption. Operational resilience goes beyond business continuity to encompass prevention, adaptation, response, recovery, and learning.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
Operational RiskRisk Management: The risk of loss resulting from inadequate or failed internal processes, people, systems, or external events in day-to-day business operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Operational Technology SecurityAI and Technology: Security measures for protecting industrial systems and networks that monitor and control physical processes, devices, and infrastructure.Used in: EU AI Act
Operations SecurityInformation Security: The process of protecting unclassified information that could be used by adversaries to piece together sensitive operational activities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Opt-In ConsentPrivacy and Data Protection: A consent model requiring individuals to take an affirmative action to agree to data collection or processing before it occurs.Used in: GDPR, ISO 27001:2022
Opt-Out RightPrivacy and Data Protection: The right of individuals to decline or withdraw consent for certain data processing activities, such as the sale of personal information.Used in: GDPR, ISO 27001:2022
Organizational CultureGovernance: The shared values, beliefs, norms, and behaviors within an organization that influence how people interact and make decisions.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Organizational ResilienceGovernance: An organization's ability to anticipate, prepare for, respond to, and adapt to incremental change and sudden disruptions to survive and prosper.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
Outsourcing RiskRisk Management: Risks associated with using external providers for business functions, including loss of control, service quality issues, and data security concerns.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Outsourcing SecurityInformation Security: Security requirements and controls applied to outsourced functions and services to protect organizational data and systems managed by third parties.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Terms starting with N All letters Terms starting with P