Glossary terms starting with P

148 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.

PCI DSSCompliance and Regulatory: The Payment Card Industry Data Security Standard is a set of security requirements for organizations that handle credit card information to protect cardholder data.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
PCI DSS Requirement 1Compliance and Regulatory: PCI DSS requirements for installing and maintaining network security controls including firewalls and network segmentation.Used in: PCI DSS v4.0, NIST SP 800-53 Rev 5, CIS Controls v8
PCI DSS Requirement 3Compliance and Regulatory: PCI DSS requirements for protecting stored cardholder data through encryption, truncation, masking, and hashing.Used in: PCI DSS v4.0, ISO 27001:2022, NIST SP 800-53 Rev 5
PCI DSS Requirement 6Compliance and Regulatory: PCI DSS requirements for developing and maintaining secure systems and software, including secure coding practices and vulnerability management.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, CIS Controls v8
PCI QSA CertificationCompliance and Regulatory: A qualification granted by the PCI SSC to individuals who are authorized to assess compliance with PCI DSS requirements.Used in: PCI DSS v4.0, ISO 27001:2022, NIST SP 800-53 Rev 5
PCI SSCCompliance and Regulatory: The Payment Card Industry Security Standards Council, responsible for developing and managing PCI security standards including PCI DSS.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
PCI SSC (PCI Security Standards Council)Compliance: The organisation responsible for developing, managing, and promoting the PCI Data Security Standard and other payment card security standards. The PCI SSC was founded by American Express, Discover, JCB, Mastercard, and Visa.Used in: PCI DSS v4.0
PDCA CycleGovernance: Plan-Do-Check-Act, a four-step iterative management methodology used for continuous improvement of processes and products in management systems.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
PDPAPrivacy and Data Protection: Personal Data Protection Act, data protection legislation enacted by various countries (such as Singapore and Thailand) to regulate the collection and use of personal data.Used in: GDPR, ISO 27001:2022
PHI (Protected Health Information)Privacy: Under HIPAA, any individually identifiable health information held by a covered entity or business associate, including demographic data, medical records, and billing information.Used in: HIPAA Security Rule
PIPLPrivacy and Data Protection: China's Personal Information Protection Law that regulates the processing of personal information of individuals within China by both domestic and foreign entities.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
PKIInformation Security: Public Key Infrastructure, a framework of policies, hardware, software, and procedures for creating, managing, distributing, and revoking digital certificates and encryption keys.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
PaaS SecurityCloud Security: Security considerations specific to Platform as a Service environments where the customer manages applications and data while the provider manages the underlying platform.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Packet CaptureInformation Security: The interception and recording of network packets for analysis, troubleshooting, security monitoring, and forensic investigation.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Packet FilteringInformation Security: A firewall technique that inspects individual network packets and allows or blocks them based on predefined rules such as source and destination addresses and ports.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
Packet SniffingInformation Security: The practice of intercepting and examining data packets as they traverse a network. Packet sniffing can be used legitimately for network troubleshooting or maliciously to capture sensitive information.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Pandemic PlanningBusiness Continuity: Business continuity planning that addresses the unique challenges of a widespread disease outbreak, including workforce impacts and extended disruptions.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
PasskeyInformation Security: A passwordless authentication credential based on the FIDO2 standard that uses public key cryptography and biometrics for secure, phishing-resistant sign-in.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Password ComplexityInformation Security: Requirements for password composition including minimum length, character variety, and prohibition of common or previously used passwords.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Password HashInformation Security: The output of applying a cryptographic hash function to a password, stored instead of the plaintext password for secure authentication.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Password ManagerInformation Security: Software that securely stores and manages login credentials for various accounts and applications. Password managers generate strong, unique passwords and auto-fill them, reducing the risk of password reuse and weak passwords.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Password PolicyInformation Security: A set of rules designed to enhance computer security by encouraging users to create strong passwords and manage them properly. Password policies define minimum length, complexity, rotation frequency, and history requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Password SprayingInformation Security: An attack technique that attempts a small number of commonly used passwords against many accounts simultaneously to avoid triggering account lockout.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Passwordless AuthenticationInformation Security: Authentication methods that verify user identity without traditional passwords, using alternatives such as biometrics, hardware tokens, or magic links.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Passwordless SecurityInformation Security: A security approach that eliminates traditional passwords in favor of more secure authentication methods such as biometrics and hardware keys.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Patch CycleInformation Security: The regular schedule and process for identifying, testing, and deploying software patches across an organization's systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Patch ManagementInformation Security: The process of identifying, acquiring, testing, and installing software updates (patches) to address security vulnerabilities and bugs. Effective patch management is a critical security control required by most compliance frameworks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Patch TestingInformation Security: The evaluation of software patches in a controlled environment before deployment to verify they resolve vulnerabilities without causing system issues.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Patient PrivacyPrivacy and Data Protection: The protection of medical information and healthcare records from unauthorized access and disclosure under healthcare privacy regulations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR
PayloadInformation Security: The component of malware that performs the malicious action, such as encrypting files (ransomware), exfiltrating data, or establishing a backdoor. The payload is delivered through an exploit or social engineering.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Payment Card IndustryCompliance and Regulatory: The collective of organizations including card brands, acquirers, issuers, and merchants involved in payment card transactions and subject to PCI standards.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Payment Services DirectiveCompliance and Regulatory: EU legislation regulating payment services and payment service providers, promoting innovation, competition, and security in electronic payments.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Penalty AssessmentCompliance and Regulatory: The process by which regulatory bodies determine the severity and amount of fines or sanctions for non-compliance with regulations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Penetration Test ReportInformation Security: A detailed document presenting the findings, risk ratings, and remediation recommendations from a penetration testing engagement.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
Penetration TesterInformation Security: A security professional who performs authorized simulated attacks against systems and networks to identify exploitable vulnerabilities.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Penetration TestingInformation Security: An authorised simulated cyberattack against a system to evaluate its security. Identifies vulnerabilities that could be exploited by real attackers.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Penetration Testing MethodologyInformation Security: A structured approach to conducting penetration tests, including planning, reconnaissance, exploitation, post-exploitation, and reporting phases.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Performance AuditAudit and Assurance: An assessment of whether an organization's programs, activities, or operations are achieving their intended objectives efficiently and effectively.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Performance ManagementGovernance: The process of ensuring that organizational activities and outputs align with goals and objectives through monitoring, measurement, and improvement.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Perimeter FenceInformation Security: Physical barriers installed around facilities to define boundaries and prevent unauthorized physical access to the organization's property.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Perimeter SecurityInformation Security: Security measures deployed at the boundary between an organization's internal network and external networks to control access and filter threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Permission ManagementInformation Security: The process of defining, assigning, and enforcing access permissions for users and groups across an organization's systems and applications.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Personal DataPrivacy: Any information relating to an identified or identifiable natural person. Under GDPR, this includes names, identification numbers, location data, online identifiers, and factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of a person.Used in: GDPR, ISO 27001:2022, NIST SP 800-53 Rev 5
Personal Health InformationCompliance and Regulatory: Individually identifiable health information including medical records, treatment history, and insurance data protected under healthcare privacy regulations.Used in: GDPR, ISO 27001:2022, HIPAA Security Rule
Personal Information ProtectionPrivacy and Data Protection: Laws and practices governing the collection, use, disclosure, and safeguarding of personal information, varying by jurisdiction and sector.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Personal Information Protection and Electronic Documents Act (PIPEDA)Privacy: Canada's federal privacy law for private-sector organisations that governs the collection, use, and disclosure of personal information in the course of commercial activities.Used in: GDPR, ISO 27001:2022
Personally Identifiable InformationPrivacy and Data Protection: Any information that can be used to identify, contact, or locate a specific individual, either alone or when combined with other data.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Personnel SecurityInformation Security: Security measures related to the hiring, management, and termination of personnel, including background checks and access management.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Pharmaceutical ComplianceCompliance and Regulatory: Regulatory requirements for pharmaceutical companies including drug safety, clinical trials, manufacturing quality, and marketing practices.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
PhishingInformation Security: A social engineering attack that uses fraudulent emails, text messages, or websites to trick users into revealing sensitive information such as passwords, credit card numbers, or personal data. Phishing remains the most common initial attack vector.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Phishing AwarenessInformation Security: Training programs designed to help employees recognize and report phishing attempts through education and simulated phishing exercises.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Phishing SimulationInformation Security: Controlled tests that send simulated phishing emails to employees to measure susceptibility and reinforce security awareness training.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Photo PrivacyPrivacy and Data Protection: Privacy considerations related to the collection, storage, and use of photographs, particularly facial images that enable biometric identification.Used in: GDPR, ISO 27001:2022
Physical Access ControlInformation Security: Security measures that restrict physical entry to facilities, rooms, or areas to authorized individuals using barriers, locks, and authentication systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Physical Access LogInformation Security: A record of all entries to and exits from physically secured areas, used for security monitoring, investigation, and compliance.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Physical Penetration TestingInformation Security: Authorized testing of physical security controls including locks, access cards, surveillance systems, and employee security awareness.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Physical SecurityInformation Security: Measures to protect an organization's physical assets, facilities, and personnel from unauthorized access, theft, damage, and environmental threats.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Physical Security AssessmentInformation Security: An evaluation of an organization's physical security controls including barriers, access systems, surveillance, and environmental protections.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Physical Security PolicyInformation Security: A documented set of rules and guidelines governing the physical protection of an organization's facilities, equipment, and personnel.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
PlaintextInformation Security: Unencrypted data or information that has not been transformed by a cryptographic algorithm. Plaintext is readable by anyone who has access to it and must be protected through encryption when confidentiality is required.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Plan TestingBusiness Continuity: Exercises conducted to validate the effectiveness and completeness of security, continuity, and recovery plans through simulated scenarios.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Platform SecurityInformation Security: Security measures for protecting computing platforms including operating systems, middleware, and runtime environments from threats and vulnerabilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Point-to-Point EncryptionInformation Security: Encryption of data from the point of interaction to the secure decryption environment, preventing data exposure at any intermediate point.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
PolicyInformation Security: A formal statement of management intent and direction. Security policies establish the rules, expectations, and standards that guide an organisation's approach to information security.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Policy AcknowledgmentGovernance: The documented confirmation by employees that they have read, understood, and agree to comply with organizational policies.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Policy ComplianceGovernance: Adherence to an organization's internal policies, standards, and procedures by employees and other stakeholders.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Policy DevelopmentGovernance: The process of creating new organizational policies including research, drafting, stakeholder consultation, approval, and implementation.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Policy EnforcementGovernance: The mechanisms and processes for ensuring that organizational policies are followed and that violations are identified and addressed.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Policy ExceptionCompliance: A formal approval to deviate from an established policy or standard requirement. Policy exceptions must be documented, time-bound, approved by appropriate authority, and include compensating controls.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Policy FrameworkGovernance: An organized hierarchy of policies, standards, procedures, and guidelines that provide direction and governance for an organization's operations.Used in: COBIT 2019, ISO 27001:2022
Policy LifecycleGovernance: The end-to-end process of creating, reviewing, approving, distributing, implementing, monitoring, and retiring organizational policies.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Policy ManagementGovernance: The process of creating, reviewing, approving, distributing, and enforcing organisational policies. Effective policy management ensures that policies remain current, accessible, and understood by all relevant personnel.Used in: COBIT 2019, ISO 27001:2022
Policy ReviewGovernance: The periodic evaluation of existing policies to ensure they remain current, relevant, effective, and aligned with regulatory requirements.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Policy ViolationGovernance: An instance where an individual or system fails to comply with established organizational policies, requiring investigation and corrective action.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Polymorphic MalwareInformation Security: Malicious software that changes its code each time it replicates, making it difficult for signature-based anti-malware tools to detect. Polymorphic malware uses encryption and code mutation to evade detection.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Port ScanningInformation Security: The process of sending packets to specific ports on a host to determine which services are running. Port scanning is used both by security professionals for vulnerability assessment and by attackers for reconnaissance.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Portfolio Risk ManagementGovernance: The management of risks across a portfolio of projects, programs, or investments to optimize overall risk-return performance.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
Post-Incident ReviewInformation Security: A structured evaluation conducted after a security incident to identify lessons learned and improvement opportunities for future prevention and response.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Post-Quantum CryptographyInformation Security: Cryptographic algorithms designed to remain secure against attacks by quantum computers, which could break current public key encryption methods.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Power ProtectionInformation Security: Systems including UPS, generators, and surge protectors that ensure continuous and clean power supply to critical IT infrastructure.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Pre-AssessmentAudit and Assurance: A preliminary evaluation conducted before a formal audit to identify potential gaps and help an organization prepare for certification.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
PretextingInformation Security: A social engineering technique where an attacker creates a fabricated scenario to engage a victim and trick them into divulging information or taking action.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Preventive ControlInformation Security: A security control designed to stop a security incident or policy violation from occurring in the first place, such as access controls or input validation.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Privacy AssessmentPrivacy and Data Protection: A comprehensive evaluation of an organization's privacy practices, policies, and controls to identify gaps and ensure regulatory compliance.Used in: GDPR, ISO 27001:2022
Privacy AuditPrivacy and Data Protection: A systematic examination of an organization's data handling practices to verify compliance with privacy laws, policies, and best practices.Used in: GDPR, ISO 27001:2022
Privacy ChampionPrivacy and Data Protection: An individual within a business unit who promotes privacy awareness and best practices, serving as a liaison between operations and the privacy team.Used in: GDPR, ISO 27001:2022
Privacy CompliancePrivacy and Data Protection: The adherence to applicable privacy laws, regulations, and organizational policies governing the handling of personal information.Used in: GDPR, ISO 27001:2022
Privacy ControlsPrivacy and Data Protection: Technical and organizational measures implemented to protect personal data and ensure compliance with privacy requirements.Used in: GDPR, ISO 27001:2022
Privacy DashboardPrivacy and Data Protection: A user interface that provides individuals with visibility and control over their personal data held by an organization.Used in: GDPR, ISO 27001:2022
Privacy Design PatternsPrivacy and Data Protection: Reusable solutions to common privacy challenges in system design, implementing privacy by design principles in practical ways.Used in: GDPR, ISO 27001:2022
Privacy EngineeringPrivacy and Data Protection: The discipline of building privacy protections directly into systems and processes through technical design choices, privacy-enhancing technologies, and engineering practices.Used in: GDPR, ISO 27001:2022
Privacy Enhancing Technologies (PETs)Privacy: Technologies that embody fundamental data protection principles by minimising personal data use, maximising data security, and empowering individuals. PETs include differential privacy, homomorphic encryption, and secure multi-party computation.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR
Privacy Enhancing TechnologyPrivacy and Data Protection: Tools and techniques that minimize personal data use, maximize data security, and empower individuals with control over their information.Used in: GDPR, ISO 27001:2022
Privacy FrameworkPrivacy and Data Protection: A structured approach that provides guidance for organizations to manage privacy risks and protect personal information systematically.Used in: GDPR, ISO 27001:2022
Privacy GovernancePrivacy and Data Protection: The organizational structures, roles, and processes established to oversee and manage privacy compliance and risk across the enterprise.Used in: GDPR, ISO 27001:2022, COBIT 2019
Privacy Impact AssessmentPrivacy and Data Protection: A structured analysis to identify and mitigate the privacy risks associated with a project, system, or process that handles personal information.Used in: GDPR, ISO 27001:2022
Privacy Impact Assessment (PIA)Privacy: A systematic assessment of a project or initiative that identifies the impact of the proposed processing on the privacy of individuals. PIAs help organisations identify and mitigate privacy risks before processing begins.Used in: GDPR, ISO 27001:2022
Privacy LawPrivacy and Data Protection: Legislation that regulates the collection, storage, use, and disclosure of personal information by organizations and governments.Used in: GDPR, ISO 27001:2022
Privacy Management PlatformPrivacy and Data Protection: Technology solutions that help organizations automate and manage privacy compliance activities including assessments, consent, and data subject requests.Used in: GDPR, ISO 27001:2022
Privacy Maturity ModelPrivacy and Data Protection: A framework for assessing and improving an organization's privacy program across defined levels of capability and sophistication.Used in: GDPR, ISO 27001:2022
Privacy NoticePrivacy: A document that informs individuals about how their personal data is collected, used, shared, and protected by an organisation. Under GDPR Articles 13 and 14, privacy notices must include specific mandatory information.Used in: GDPR, ISO 27001:2022
Privacy OfficerPrivacy and Data Protection: An individual responsible for developing and implementing privacy policies and ensuring organizational compliance with data protection regulations.Used in: GDPR, ISO 27001:2022
Privacy PolicyPrivacy and Data Protection: A public-facing document that describes an organization's practices regarding the collection, use, disclosure, and management of personal data.Used in: GDPR, ISO 27001:2022
Privacy Preserving ComputationPrivacy and Data Protection: Technologies that enable data analysis and processing while protecting the privacy of underlying personal data, including homomorphic encryption.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR
Privacy PrinciplesPrivacy and Data Protection: Fundamental guidelines that form the basis of data protection laws and best practices, including fairness, purpose limitation, and data minimization.Used in: GDPR, ISO 27001:2022
Privacy ProgramPrivacy and Data Protection: An organized set of activities, policies, and resources dedicated to protecting personal data and ensuring compliance with privacy regulations across an organization.Used in: GDPR, ISO 27001:2022
Privacy RegulationCompliance and Regulatory: Laws and rules governing the collection, processing, storage, and sharing of personal information to protect individual privacy rights.Used in: GDPR, ISO 27001:2022
Privacy RiskPrivacy and Data Protection: The potential for harm to individuals resulting from the collection, processing, or disclosure of their personal information.Used in: GDPR, ISO 27001:2022
Privacy Risk AssessmentPrivacy and Data Protection: An evaluation of the likelihood and impact of privacy-related risks to determine appropriate mitigating controls and safeguards.Used in: GDPR, ISO 27001:2022
Privacy SealPrivacy and Data Protection: A certification mark awarded to organizations that demonstrate compliance with specific privacy standards, building consumer trust.Used in: GDPR, ISO 27001:2022
Privacy ShieldPrivacy: A former framework for regulating transatlantic exchanges of personal data between the EU and the United States. Privacy Shield was invalidated by the Court of Justice of the European Union in 2020 (Schrems II) and replaced by the EU-US Data Privacy Framework.Used in: GDPR, ISO 27001:2022
Privacy StatementPrivacy and Data Protection: A concise summary provided to individuals at the point of data collection explaining how their information will be used.Used in: GDPR, ISO 27001:2022
Privacy Threshold AnalysisPrivacy and Data Protection: An initial evaluation to determine whether a new system or project requires a full privacy impact assessment based on its data processing activities.Used in: GDPR, ISO 27001:2022
Privacy TrainingPrivacy and Data Protection: Educational programs that teach employees about privacy laws, organizational policies, and best practices for handling personal information.Used in: GDPR, ISO 27001:2022
Privacy by DefaultPrivacy and Data Protection: The principle that systems should be designed to automatically apply the strongest privacy settings without requiring user intervention.Used in: GDPR, ISO 27001:2022
Privacy by DesignPrivacy: An approach that embeds privacy protections into the design and architecture of systems and processes from the outset, rather than adding them as an afterthought. A principle of GDPR.Used in: GDPR, ISO 27001:2022
Privacy-Preserving AIAI and Technology: Techniques and approaches for training and deploying AI systems while minimizing the use and exposure of personal data, such as differential privacy.Used in: GDPR, ISO 27001:2022
Privilege EscalationInformation Security: The act of exploiting a vulnerability, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user. Can be vertical (gaining higher privileges) or horizontal (accessing other users' resources).Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Privileged Access ManagementInformation Security: Security solutions and practices for controlling, monitoring, and auditing privileged account access to critical systems and sensitive data.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Privileged Access Management (PAM)Information Security: A set of cybersecurity strategies and technologies for exerting control over elevated access and permissions for users, accounts, processes, and systems across an IT environment. PAM protects against credential theft and insider threats.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Privileged Access WorkstationInformation Security: A hardened and dedicated computing environment used exclusively for performing sensitive administrative tasks, isolated from general-purpose activities and the internet.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Privileged AccountInformation Security: A user account with elevated permissions that provide administrative control over systems, databases, networks, or security configurations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Privileged Identity ManagementInformation Security: Processes and technologies for managing identities that have elevated access to critical systems and sensitive data.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Privileged Session ManagementInformation Security: The monitoring and recording of sessions where privileged accounts are used, providing an audit trail of administrative activities.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Problem ManagementGovernance: The process of identifying the root causes of recurring incidents and implementing solutions to prevent their reoccurrence.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Process DocumentationGovernance: The detailed recording of business processes including steps, roles, inputs, outputs, and decision points for standardization and knowledge transfer.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Process ImprovementGovernance: The systematic approach to identifying, analyzing, and enhancing existing business processes to optimize performance and meet new standards.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Process MaturityGovernance: A measure of how well-defined, managed, measured, and optimized an organization's processes are, typically assessed against a maturity model.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Process MiningGovernance: The analysis of event logs to discover, monitor, and improve business processes, with privacy and security implications for data handling.Used in: GDPR, ISO 27001:2022
ProcessingPrivacy: Any operation or set of operations performed on personal data, whether or not by automated means. Under GDPR, processing includes collection, recording, storage, retrieval, consultation, use, disclosure, erasure, and destruction.Used in: GDPR, ISO 27001:2022
Processing Activity RecordPrivacy and Data Protection: A documented register of all data processing activities maintained by controllers and processors as required by GDPR Article 30.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Processor AgreementPrivacy and Data Protection: A contract between a data controller and processor specifying the scope, duration, and conditions of personal data processing services.Used in: GDPR, ISO 27001:2022
ProfilingPrivacy: Any form of automated processing of personal data that evaluates certain personal aspects relating to a natural person, particularly to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.Used in: GDPR, ISO 27001:2022, HIPAA Security Rule
Profiling TransparencyPrivacy and Data Protection: The requirement to inform individuals about the existence and logic of automated profiling that affects them, including its consequences.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Program GovernanceGovernance: The framework of authority, accountability, and decision-making processes that oversee the management and delivery of a program of related projects.Used in: COBIT 2019, ISO 27001:2022
Project GovernanceGovernance: The framework of authority and accountability that defines the management of a project, including decision rights and escalation procedures.Used in: COBIT 2019, ISO 27001:2022
Prompt InjectionAI & Technology: An attack technique targeting AI language models where malicious instructions are embedded in user inputs to manipulate the model's behaviour. Prompt injection can cause AI systems to ignore safety guidelines or reveal sensitive information.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Proof of ComplianceCompliance and Regulatory: Documentary evidence demonstrating that an organization meets specific regulatory requirements or standard conditions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Proportionality PrinciplePrivacy and Data Protection: A privacy and data protection principle requiring that data processing measures be proportionate to the legitimate purpose pursued and not excessive.Used in: GDPR, ISO 27001:2022
Protected Health Information (PHI)Compliance: Under HIPAA, any individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate. PHI includes medical records, billing information, and any health-related data linked to an individual.Used in: HIPAA Security Rule
Protocol AnalysisInformation Security: The examination of network protocols to verify correct implementation, identify vulnerabilities, and detect malicious protocol-level attacks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Protocol SecurityInformation Security: Security measures and best practices for protecting network communication protocols from exploitation, misuse, and vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Proxy ServerInformation Security: An intermediary server that handles requests between clients and destination servers, providing security, privacy, content filtering, and caching capabilities.Used in: GDPR, ISO 27001:2022
PseudonymisationPrivacy: The processing of personal data in such a manner that it can no longer be attributed to a specific data subject without the use of additional information. Unlike anonymisation, pseudonymised data is still considered personal data under GDPR.Used in: GDPR, ISO 27001:2022
Pseudonymous DataPrivacy and Data Protection: Personal data that cannot be attributed to a specific individual without the use of additional information kept separately and securely.Used in: GDPR, ISO 27001:2022
Public Key Infrastructure (PKI)Information Security: A set of roles, policies, hardware, software, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates. PKI provides the framework for trusted electronic communications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Purple TeamInformation Security: A collaborative security approach where red team (offensive) and blue team (defensive) work together to improve detection capabilities and security posture.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Purpose LimitationPrivacy: The principle that personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. A core principle under GDPR Article 5(1)(b).Used in: GDPR, ISO 27001:2022

Terms starting with O All letters Terms starting with Q