Glossary terms starting with S

230 compliance, governance, risk and security terms, each with a short definition. Open a term for its full definition and the requirement text of the standards that name it.

S/MIMEInformation Security: Secure/Multipurpose Internet Mail Extensions, a standard for public key encryption and signing of email messages to ensure confidentiality, integrity, and authentication.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SAMLInformation Security: Security Assertion Markup Language, an XML-based standard for exchanging authentication and authorization data between identity providers and service providers.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SAML (Security Assertion Markup Language)Information Security: An open standard for exchanging authentication and authorisation data between parties, specifically between an identity provider and a service provider. SAML enables Single Sign-On across web applications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SANS InstituteInformation Security: A leading organization for cybersecurity training, certification, and research that provides security education to practitioners worldwide.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
SCAPInformation Security: Security Content Automation Protocol, a suite of specifications for standardizing the format and nomenclature of security configuration and vulnerability information.Used in: NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0, CIS Controls v8
SCAP (Security Content Automation Protocol)Information Security: A suite of specifications standardised by NIST that enables automated vulnerability management, measurement, and policy compliance evaluation. SCAP provides a common language for expressing security-related information.Used in: NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0, CIS Controls v8
SD-WAN SecurityInformation Security: Security features and controls integrated into Software-Defined Wide Area Networks including encryption, segmentation, and threat detection.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SEC Cybersecurity DisclosureCompliance and Regulatory: US Securities and Exchange Commission rules requiring public companies to disclose material cybersecurity incidents and describe their risk management programs.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, NIST SP 800-53 Rev 5
SIEM (Security Information and Event Management)Information Security: A technology platform that aggregates and analyses log data from across an organisation's IT infrastructure to detect security threats and support incident response.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8
SLA (Service Level Agreement)Cloud: A commitment between a service provider and customer that defines the expected level of service. Cloud SLAs specify metrics such as uptime percentage, response times, data durability, and remedies for non-compliance.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
SNMP SecurityInformation Security: Security measures for the Simple Network Management Protocol including SNMPv3 authentication, encryption, and access control configuration.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SOARInformation Security: Security Orchestration, Automation and Response platforms that combine security tool integration, workflow automation, and case management for efficient incident handling.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
SOC 1Audit: An AICPA audit report on controls at a service organisation relevant to user entities' financial reporting. Available as Type I (design only) or Type II (design and operating effectiveness).Used in: ISO 27001:2022, PCI DSS v4.0, NIST Cybersecurity Framework 2.0
SOC 1 ReportAudit and Assurance: A System and Organization Controls report that addresses internal controls relevant to a service organization's clients' financial reporting.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, CIS Controls v8
SOC 2Audit: An AICPA audit report based on the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. The most common assurance report for technology service providers.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
SOC 2 ReportAudit and Assurance: A System and Organization Controls report that evaluates a service organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0
SOC 2 Type II for CloudCloud: A SOC 2 Type II report that specifically evaluates the security, availability, processing integrity, confidentiality, and privacy controls of a cloud service provider over a period of time. Cloud customers increasingly require SOC 2 Type II from their providers.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, GDPR
SOC 3Audit: A publicly available summary report based on the same Trust Services Criteria as SOC 2. SOC 3 reports provide a general overview of the service organisation's controls without the detailed testing results included in SOC 2 reports.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
SOC 3 ReportAudit and Assurance: A general-use report that provides a summary of a service organization's SOC 2 examination results for public distribution without detailed control descriptions.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
SOC AnalystInformation Security: A security operations center professional who monitors security tools, triages alerts, and performs initial investigation of potential security incidents.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
SOC MaturityInformation Security: The level of capability and effectiveness of a Security Operations Center, assessed across people, processes, and technology dimensions.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
SOC for CybersecurityAudit: An AICPA framework that enables organisations to communicate useful information about the effectiveness of their cybersecurity risk management programmes. SOC for Cybersecurity reports are designed for a broad audience including boards and investors.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
SOX (Sarbanes-Oxley Act)Compliance: A US federal law (2002) requiring public companies to establish and maintain internal controls over financial reporting. SOX Section 404 requires management assessment of internal controls.Used in: PCI DSS v4.0
SOX ComplianceCompliance and Regulatory: Adherence to the requirements of the Sarbanes-Oxley Act, particularly regarding financial reporting accuracy, internal controls, and auditor independence.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
SOX Section 302Compliance: A provision of the Sarbanes-Oxley Act that requires the CEO and CFO to personally certify the accuracy of financial reports and the effectiveness of internal controls. Certification carries personal criminal liability for knowing violations.Used in: PCI DSS v4.0
SOX Section 404Compliance: A provision of the Sarbanes-Oxley Act that requires management and external auditors to assess and report on the adequacy of internal controls over financial reporting. Section 404 compliance is one of the most costly aspects of SOX.Used in: PCI DSS v4.0
SQL InjectionInformation Security: A web security vulnerability that allows an attacker to interfere with the queries an application makes to its database. SQL injection can be used to view, modify, or delete data and in some cases gain complete control of the database server.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
SSHInformation Security: Secure Shell, a cryptographic network protocol for secure remote login, command execution, and file transfer between computers over unsecured networks.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SSL CertificateInformation Security: A digital certificate that authenticates a website's identity and enables encrypted connections using TLS, displayed as the padlock icon in web browsers.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SSL InspectionInformation Security: The process of intercepting and decrypting SSL/TLS encrypted traffic for security analysis before re-encrypting and forwarding it to its destination.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SSL/TLS CertificateInformation Security: A digital certificate that authenticates a website's identity and enables an encrypted connection. TLS (Transport Layer Security) is the successor to SSL (Secure Sockets Layer) and is essential for protecting data in transit.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
SaaS SecurityCloud Security: Security measures for protecting data and access in Software as a Service applications, including identity management, data encryption, and activity monitoring.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Safe HarborCompliance and Regulatory: Legal provisions that protect organizations from liability or penalties when they have acted in good faith compliance with specified requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
SamplingAudit: The process of selecting a subset of items from a population for testing or examination. In auditing, sampling methods include statistical sampling, judgmental sampling, and attribute sampling.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Sanctions ComplianceCompliance and Regulatory: Programs and controls ensuring adherence to government-imposed trade and financial restrictions against specific countries, entities, and individuals.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
SandboxInformation Security: An isolated testing environment that enables users to run programs or execute code without affecting the rest of the system. In security, sandboxes are used to safely analyse suspicious files and malware.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
SandboxingInformation Security: A security technique that isolates running programs or processes in a restricted environment to prevent them from affecting other parts of the system.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Sarbanes-Oxley ActCompliance and Regulatory: US federal law establishing auditing and financial regulation requirements for public companies to protect shareholders from fraudulent financial reporting.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Sarbanes-Oxley Act (SOX)Compliance: US federal law enacted in 2002 that mandates strict financial reporting and internal control requirements for publicly traded companies. SOX Section 404 requires management assessment of internal controls over financial reporting.Used in: PCI DSS v4.0
Satellite SecurityInformation Security: Security measures for protecting satellite communications, ground systems, and space-based assets from interference, jamming, and cyber attacks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Scan PolicyInformation Security: Configuration settings that define the scope, depth, and checks performed during automated vulnerability scanning.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Scenario AnalysisRisk Management: A process of analyzing possible future events by considering alternative plausible risk scenarios and their potential impacts on the organization.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Schrems IIPrivacy: The 2020 ruling by the Court of Justice of the European Union that invalidated the EU-US Privacy Shield and imposed additional obligations on organisations using Standard Contractual Clauses for international data transfers.Used in: GDPR, ISO 27001:2022
Scope StatementCompliance: A document that defines the boundaries and applicability of a management system, audit, or compliance programme. The scope statement specifies which organisational units, processes, locations, and information assets are included.Used in: ISO 27001:2022
Second-Party AuditAudit and Assurance: An audit conducted by an organization on its suppliers, vendors, or partners to verify compliance with contractual requirements and standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Secrets ManagementCloud Security: Tools and practices for securely storing, distributing, and rotating sensitive credentials such as API keys, passwords, and certificates in cloud environments.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Sector-Specific RegulationCompliance and Regulatory: Regulatory requirements that apply specifically to organizations within a particular industry sector such as healthcare, finance, or energy.Used in: HIPAA Security Rule, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Sectoral RegulationCompliance and Regulatory: Regulations that apply specifically to particular industries or sectors, imposing specialized compliance requirements beyond general laws.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Secure Access Service EdgeCloud Security: A cloud-delivered architecture that combines network security functions with WAN capabilities to support dynamic secure access for distributed organizations.Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022, NIST SP 800-53 Rev 5
Secure AreaInformation Security: A physically protected space with access controls and monitoring designed to safeguard sensitive information, equipment, or operations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Secure BootInformation Security: A security standard that ensures a device boots using only software trusted by the manufacturer, preventing rootkits and boot-level malware from loading.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Secure CodingInformation Security: The practice of writing software code that is resistant to security vulnerabilities. Secure coding practices include input validation, output encoding, proper error handling, and following guidelines such as the OWASP Secure Coding Practices.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
Secure ConfigurationInformation Security: The process of implementing security settings and hardening measures on systems and devices according to established security baselines and benchmarks.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Secure DeleteInformation Security: The thorough removal of data from storage so it cannot be recovered using standard data recovery techniques.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Secure DestructionInformation Security: The complete and irreversible elimination of data and storage media through approved methods such as shredding, incineration, or degaussing.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Secure Development LifecycleInformation Security: A process that integrates security practices and testing throughout every phase of software development, from design through deployment and maintenance.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Secure DisposalInformation Security: The process of safely destroying or sanitizing assets and media containing sensitive information when they are no longer needed.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Secure File TransferInformation Security: Protocols and methods for transmitting files between systems with encryption and authentication, such as SFTP, FTPS, and SCP.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Secure Multiparty ComputationInformation Security: A cryptographic technique allowing multiple parties to jointly compute a function over their inputs while keeping those inputs private.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Secure Socket LayerInformation Security: A deprecated cryptographic protocol (succeeded by TLS) that provided encrypted communication between web browsers and servers to protect data in transit.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Secure Software Development Lifecycle (SSDLC)Information Security: An approach to software development that integrates security considerations at every phase of the development lifecycle, from requirements gathering through design, implementation, testing, deployment, and maintenance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Secure by DesignInformation Security: An approach to product development that integrates security considerations from the earliest design phases rather than adding them after development.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Securities RegulationCompliance and Regulatory: Laws governing the issuance and trading of securities, requiring disclosure, fair dealing, and protection of investors.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Security AlertInformation Security: A notification generated by security tools or systems indicating a potential security threat, policy violation, or anomalous activity.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security AnalystInformation Security: A cybersecurity professional who monitors, analyzes, and investigates security events and incidents to protect organizational assets.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security ArchitectureInformation Security: The design artefacts that describe how security controls are positioned and relate to the overall IT architecture. Security architecture provides a structured approach to designing, implementing, and maintaining security across an organisation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Architecture FrameworkInformation Security: A comprehensive model for designing and implementing security controls across an organization's technology environment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Architecture ReviewInformation Security: An assessment of an organization's security architecture to identify design weaknesses and verify alignment with security requirements and best practices.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security AssertionInformation Security: A statement or claim made by an identity provider about a user's authentication status, attributes, or authorization, used in federated identity systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Security AssessmentInformation Security: A comprehensive evaluation of an organization's security posture including vulnerability assessment, penetration testing, and policy review.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Security AutomationInformation Security: The use of technology to perform security tasks with minimal human intervention, including automated scanning, patching, incident response, and compliance monitoring.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8
Security AwarenessInformation Security: The knowledge and understanding that employees have about cybersecurity threats and their role in protecting organizational information assets.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Awareness ProgramInformation Security: A structured initiative to build and maintain employee knowledge about cybersecurity risks, policies, and best practices through ongoing education.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Awareness TrainingInformation Security: Educational programmes designed to teach employees about security risks and best practices. Training covers topics such as phishing recognition, password hygiene, data handling, and incident reporting. Required by ISO 27001, HIPAA, PCI DSS, and NIST CSF.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, HIPAA Security Rule
Security BaselineInformation Security: A set of minimum security standards and configurations that all systems within an organisation must meet. Security baselines provide a consistent foundation for security across the environment and are often based on CIS Benchmarks or vendor hardening guides.Used in: CIS Controls v8, NIST Cybersecurity Framework 2.0, ISO 27001:2022
Security Baseline AssessmentInformation Security: An evaluation comparing an organization's current security posture against established baseline security requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security BehaviorInformation Security: The actions and habits of individuals related to information security, influenced by awareness, training, culture, and organizational policies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security BenchmarkInformation Security: A documented standard of security configuration best practices for specific technologies, used to assess and harden system configurations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security CertificationInformation Security: A formal credential awarded to individuals or organizations demonstrating competency in specific areas of information security.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Security ChampionInformation Security: An employee in a non-security role who advocates for security practices within their team, serving as a bridge between security and business functions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security ClearanceCompliance: An authorisation granted to individuals allowing them access to classified information after completing a background investigation. Security clearance levels typically include Confidential, Secret, and Top Secret.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Security CommitteeGovernance: A governance body composed of representatives from various departments responsible for overseeing the organization's security strategy and policies.Used in: COBIT 2019, ISO 27001:2022
Security ComplianceCompliance and Regulatory: The adherence to security-related laws, regulations, standards, and organizational policies governing the protection of information assets.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Security ConfigurationInformation Security: The specific settings and parameters applied to systems and applications to implement security controls and reduce vulnerabilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Control AssessmentInformation Security: The evaluation of security controls to determine their effectiveness in protecting information systems and meeting security requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Control FrameworkInformation Security: An organized collection of security controls structured to help organizations manage cybersecurity risk systematically.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security ControlsInformation Security: Safeguards or countermeasures designed to protect the confidentiality, integrity, and availability of information systems and data. Controls can be technical (encryption, firewalls), administrative (policies, training), or physical (locks, cameras).Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8
Security CultureInformation Security: The collective attitudes, beliefs, and behaviors within an organization regarding the importance and practice of information security.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Culture AssessmentInformation Security: An evaluation of the collective security attitudes, beliefs, and behaviors within an organization to identify strengths and areas for improvement.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security DashboardInformation Security: A visual display providing real-time visibility into an organization's security posture, including alerts, metrics, and threat intelligence.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security DebtInformation Security: The accumulation of security issues, deferred patches, and technical shortcuts that increase an organization's risk exposure over time.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security EngineeringInformation Security: The discipline of designing and building systems that remain dependable in the face of malicious actions, errors, and accidents.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security EventInformation Security: An observable occurrence in a system or network that may have security implications, such as a failed login attempt or configuration change.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Exception ProcessGovernance: A formal procedure for requesting, reviewing, approving, and tracking deviations from security policy requirements.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Security FrameworkInformation Security: A structured approach to managing cybersecurity risk through organized policies, procedures, and controls based on industry best practices.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security GapInformation Security: A deficiency in an organization's security posture where expected or required security controls are absent or insufficient.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security GovernanceGovernance: The set of responsibilities and practices exercised by the board and executive management to provide strategic direction and oversight for information security.Used in: COBIT 2019, ISO 27001:2022
Security Governance FrameworkGovernance: A comprehensive structure for directing and controlling an organization's security activities, ensuring alignment with business objectives and risk appetite.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022
Security HeaderInformation Security: HTTP response headers that instruct browsers to enforce security policies, including Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security IncidentInformation Security: An event that actually or potentially compromises the confidentiality, integrity, or availability of information or information systems.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Incident ManagementInformation Security: The systematic approach to identifying, managing, recording, and analyzing security threats and incidents in an organized manner.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Security Incident ReportInformation Security: A formal document that describes a security incident including its discovery, impact, response actions, and recommendations for prevention.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Information and Event ManagementInformation Security: A platform that aggregates and analyzes security log data from across an organization's infrastructure to provide real-time threat detection and compliance reporting.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Information and Event Management (SIEM)Information Security: A technology platform that aggregates and analyses log data from across an organisation's IT infrastructure to detect security threats, support compliance reporting, and facilitate incident investigation in real time.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Security InvestmentRisk Management: Financial resources allocated to cybersecurity including technology, personnel, training, and compliance activities.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022
Security LogInformation Security: A record of security-relevant events generated by operating systems, applications, and network devices for monitoring and audit purposes.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security ManagementInformation Security: The systematic planning, organizing, and controlling of activities to maintain the security of an organization's information assets.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Maturity ModelInformation Security: A framework for assessing and improving an organization's security capabilities across defined maturity levels from initial to optimized.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security MetricsInformation Security: Quantifiable measurements used to assess the effectiveness of security controls, the maturity of security programs, and organizational risk levels.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security MonitoringInformation Security: The continuous observation and analysis of an organization's IT environment to detect security events, threats, and anomalies in real time.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Security OfficerInformation Security: An individual responsible for implementing and maintaining the security policies and controls within an organization or business unit.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security OperationsInformation Security: The day-to-day activities of monitoring, detecting, investigating, and responding to cybersecurity threats and incidents.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Operations CenterInformation Security: A centralized facility where security professionals monitor, detect, analyze, and respond to cybersecurity incidents using technology and defined processes.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Security Operations Centre (SOC)Information Security: A centralised facility and team responsible for monitoring, detecting, analysing, and responding to cybersecurity incidents on a 24/7 basis. SOC teams use SIEM, EDR, and other tools to maintain security visibility across the organisation.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Security Operations ManagementInformation Security: The administration of day-to-day security activities including monitoring, incident response, vulnerability management, and threat intelligence.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8
Security Orchestration and ResponseInformation Security: Technology that integrates security tools and automates incident response workflows to improve the speed and consistency of threat response.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Security Orchestration, Automation, and Response (SOAR)Information Security: Technologies that enable organisations to collect security threat data, automate incident response workflows, and coordinate security operations. SOAR platforms reduce response times and standardise incident handling procedures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8
Security PerimeterInformation Security: The boundary of the area where security controls are applied to protect internal resources from external threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security PlanInformation Security: A formal document that provides an overview of the security requirements for an information system and describes the controls in place.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security PlaybookInformation Security: A collection of pre-defined response procedures for specific security scenarios that guide analysts through investigation and response steps.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Policy ComplianceInformation Security: The degree to which an organization's systems, processes, and personnel adhere to established security policies and standards.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Policy FrameworkInformation Security: An organized hierarchy of security policies, standards, guidelines, and procedures that govern an organization's information security program.Used in: COBIT 2019, ISO 27001:2022
Security PostureInformation Security: The overall cybersecurity strength and readiness of an organization, encompassing its security controls, policies, awareness, and ability to detect and respond to threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security ProcedureInformation Security: A detailed, step-by-step instruction for performing a specific security task or responding to a particular security event.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Program AssessmentInformation Security: A comprehensive evaluation of an organization's overall security program including governance, operations, and technical controls.Used in: COBIT 2019, ISO 27001:2022
Security Program ManagementInformation Security: The coordinated management of all security initiatives, projects, and operations to achieve organizational security objectives.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security RatingInformation Security: A data-driven measurement of an organization's cybersecurity performance and risk, often provided by third-party rating services.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Security RequirementInformation Security: A condition or capability that a system must possess to satisfy a security policy, standard, or contractual obligation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security ReviewInformation Security: An examination of systems, applications, or processes to identify security weaknesses and verify compliance with security requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security Risk AssessmentRisk Management: An evaluation that identifies threats to information assets, analyzes vulnerabilities, and determines the level of risk to guide security investment decisions.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Security Risk ManagementRisk Management: The ongoing process of identifying, analyzing, evaluating, and treating risks to an organization's information security.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Security ScanInformation Security: An automated assessment of systems, networks, or applications to identify known vulnerabilities, misconfigurations, and security weaknesses.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security StandardInformation Security: A documented set of specific, mandatory requirements for implementing security controls within an organization's environment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security TelemetryInformation Security: Data collected from security tools, systems, and sensors that provides visibility into the security state of an organization's IT environment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security TestingInformation Security: The process of evaluating the security of systems, applications, and networks through various testing methodologies to identify vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Security TokenInformation Security: A physical or digital device used to authenticate a user's identity. Security tokens generate one-time passwords or cryptographic keys and are used as the 'something you have' factor in multi-factor authentication.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Security TrainingInformation Security: Formal education programs that develop employee knowledge and skills in cybersecurity topics relevant to their roles and responsibilities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Security ValidationInformation Security: The process of confirming that security controls meet specified security requirements and are effective in their intended environment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Segregation of DutiesGovernance: A governance control that requires more than one person to complete different parts of a task, preventing fraud and errors through shared responsibilities.Used in: COBIT 2019, ISO 27001:2022
Segregation of Duties (SoD)Governance: A key internal control that distributes critical tasks among multiple people to prevent any single individual from having the ability to commit fraud or errors without detection. SoD is a core requirement in SOX, COBIT, and financial services regulations.Used in: COBIT 2019, PCI DSS v4.0
Self-Assessment QuestionnaireCompliance and Regulatory: A validation tool used by organizations to self-evaluate their compliance with specific standards such as PCI DSS for merchants and service providers.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Self-Assessment Questionnaire (SAQ)Compliance: A validation tool used by merchants and service providers to report the results of their PCI DSS self-assessment. There are multiple SAQ types depending on the organisation's cardholder data environment and processing methods.Used in: PCI DSS v4.0
Self-Service Password ResetInformation Security: A capability allowing users to securely reset their own passwords through automated verification without requiring help desk assistance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Sensitive Data HandlingPrivacy and Data Protection: Specialized procedures and enhanced security measures required for processing sensitive categories of personal data such as health, biometric, or genetic information.Used in: GDPR, ISO 27001:2022, HIPAA Security Rule
Sensitive InformationInformation Security: Information that, if disclosed improperly, could cause harm to individuals or the organization, requiring enhanced protection measures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Sensitive Personal DataPrivacy: Categories of personal data that require enhanced protection due to their sensitive nature. Under GDPR, this includes racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, and data concerning sex life or sexual orientation.Used in: GDPR, ISO 27001:2022, HIPAA Security Rule
Sensitivity AnalysisRisk Management: An analytical technique that determines how variations in input variables affect outcomes, helping identify which risk factors have the greatest impact.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Separation of DutiesInformation Security: A security principle that divides critical tasks among multiple individuals to prevent fraud, error, and misuse by ensuring no single person controls all aspects of a process.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Server Room SecurityInformation Security: Physical and environmental security measures specifically designed to protect server rooms and network closets from unauthorized access and environmental threats.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Serverless SecurityCloud: The security practices and considerations specific to serverless computing architectures (Functions as a Service). Serverless security focuses on function permissions, input validation, dependency management, and event injection prevention.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Service AccountInformation Security: A non-human account used by applications, services, and automated processes to authenticate and interact with other systems and services.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Service Account ManagementInformation Security: The governance and security of non-human accounts including lifecycle management, credential rotation, and privilege minimization.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, COBIT 2019
Service CatalogGovernance: A organized collection of IT services offered by an organization, including descriptions, service levels, and ownership information.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Service Continuity PlanBusiness Continuity: A plan for ensuring the continuity of critical services during disruptions, including alternate delivery methods and recovery procedures.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Service Level AgreementGovernance: A contract between a service provider and customer that defines the expected level of service, performance metrics, and remedies for non-compliance.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Service Level Agreement (SLA)Governance: A contract between a service provider and customer that defines the expected level of service, including availability, response times, and responsibilities. SLAs establish measurable performance targets and consequences for non-compliance.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Service Level ManagementGovernance: The ITIL practice of setting clear business-based targets for service levels and ensuring that delivery of services is properly assessed, monitored, and managed against these targets.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Service Mesh SecurityInformation Security: Security capabilities built into service mesh architectures for microservices, including mutual TLS, policy enforcement, and observability.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Service Organisation Control (SOC)Audit: A suite of audit reports developed by the AICPA that address controls at a service organisation. SOC 1 covers financial reporting controls; SOC 2 covers security, availability, processing integrity, confidentiality, and privacy; SOC 3 is a public version of SOC 2.Used in: GDPR, ISO 27001:2022, PCI DSS v4.0
Service Provider AssessmentRisk Management: An evaluation of a service provider's security controls, compliance status, and risk profile before engaging them for services.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Session HijackingInformation Security: An attack in which an attacker takes over a valid user's web session by stealing or predicting the session token. Session hijacking gives the attacker the same privileges as the legitimate user.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Session ManagementInformation Security: The process of handling user sessions securely, including session creation, token generation, timeout enforcement, and proper session termination.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Session TokenInformation Security: A unique identifier issued to a user after successful authentication, used to maintain their authenticated state across subsequent requests.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Shadow AIAI & Technology: The use of AI tools, models, or services by employees without the knowledge or approval of the IT or governance team. Shadow AI creates risks around data privacy, security, intellectual property, and regulatory compliance.Used in: GDPR, ISO 27001:2022, COBIT 2019
Shadow ITGovernance: Information technology systems and solutions used within an organisation without explicit approval from the IT department. Shadow IT creates security risks because these systems may not comply with security policies or be visible to security monitoring.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Shared Responsibility ModelCloud: A cloud security framework that delineates security obligations between the cloud service provider and the customer. The provider secures the infrastructure ('security of the cloud'), while the customer secures their data and configurations ('security in the cloud').Used in: Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1, ISO 27001:2022
Shipping ComplianceCompliance and Regulatory: Regulations governing shipping and logistics operations including customs requirements, hazardous materials handling, and trade compliance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Shoulder SurfingInformation Security: The practice of observing someone entering sensitive information such as passwords or PINs by looking over their shoulder or using visual aids.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
Significant DeficiencyAudit and Assurance: A control weakness that is less severe than a material weakness but important enough to merit attention from those responsible for oversight.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Simulated AttackInformation Security: A controlled security exercise that mimics real attack techniques to test employee awareness and organizational response procedures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Single Sign-OnInformation Security: An authentication scheme that allows users to access multiple applications and services with one set of login credentials, improving user experience and security.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Single Sign-On (SSO)Information Security: An authentication scheme that allows a user to log in with a single set of credentials to access multiple, independent software systems. SSO improves user experience while centralising authentication control.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Site RecoveryBusiness Continuity: The process of restoring operations at a primary or alternate site following a disaster or major disruption.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Smart ContractAI and Technology: Self-executing code stored on a blockchain that automatically enforces the terms of an agreement when predefined conditions are met.Used in: EU AI Act
SmishingInformation Security: A form of phishing that uses SMS text messages to trick recipients into clicking malicious links or providing sensitive information. Smishing exploits the trust users place in text messages.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Social EngineeringInformation Security: The psychological manipulation of people into performing actions or divulging confidential information. Social engineering attacks exploit human trust rather than technical vulnerabilities and include phishing, pretexting, and baiting.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Social Engineering DefenseInformation Security: Security controls and training designed to protect against manipulation techniques that exploit human psychology to gain unauthorized access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0
Social Engineering TestInformation Security: A controlled security assessment that evaluates an organization's human vulnerabilities through simulated phishing, pretexting, and other manipulation techniques.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Software AssuranceInformation Security: The level of confidence that software functions as intended, is free of vulnerabilities, and provides a required level of security.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Software Bill of MaterialsInformation Security: A comprehensive inventory of all components, libraries, and dependencies used in a software application, supporting vulnerability management and supply chain security.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
Software Bill of Materials (SBOM)Information Security: A comprehensive inventory of all components, libraries, and dependencies used in a software application. SBOMs enable organisations to identify and manage vulnerabilities in third-party and open-source software components.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Software Composition AnalysisInformation Security: Tools and processes that identify open-source components in software and detect known vulnerabilities, licensing issues, and outdated dependencies.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Software Supply Chain SecurityInformation Security: Practices for protecting the integrity and security of software throughout its supply chain, from development through distribution and deployment.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Software VulnerabilityInformation Security: A weakness in software code that can be exploited by attackers to compromise the confidentiality, integrity, or availability of a system.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Source Code AnalysisInformation Security: The automated or manual review of application source code to identify security vulnerabilities, coding errors, and compliance violations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Space Systems SecurityInformation Security: Security measures for protecting satellite systems, ground control stations, and space-based infrastructure from cyber and physical threats.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Spear PhishingInformation Security: A targeted phishing attack directed at a specific individual or organisation. Spear phishing emails are personalised using information gathered about the target to increase credibility and success rates.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8
Special Category DataPrivacy and Data Protection: Personal data types that require additional protections under GDPR, including racial or ethnic origin, political opinions, religious beliefs, and health data.Used in: GDPR, ISO 27001:2022, HIPAA Security Rule
Split TunnelingInformation Security: A VPN configuration where only certain traffic is routed through the VPN tunnel while other traffic accesses the internet directly.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
SpoofingInformation Security: A technique where an attacker disguises their identity or the source of communication by falsifying data such as IP addresses, email headers, or caller IDs.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8
Stage 1 AuditAudit and Assurance: The initial phase of a certification audit that reviews documentation and readiness before proceeding to the full implementation assessment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Stage 2 AuditAudit and Assurance: The second phase of a certification audit that evaluates the actual implementation and effectiveness of the management system.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Stakeholder ManagementGovernance: The process of identifying, analysing, and planning actions to engage with individuals or groups who have an interest in or influence over an organisation's projects, programmes, or compliance initiatives.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Standard Contractual ClausesPrivacy and Data Protection: Pre-approved contractual terms adopted by the European Commission for international transfers of personal data to ensure adequate protection.Used in: GDPR, ISO 27001:2022
Standard Contractual Clauses (SCCs)Privacy: Pre-approved contractual terms issued by the European Commission that provide appropriate safeguards for the transfer of personal data from the EU to countries without an adequacy decision. SCCs were updated in June 2021.Used in: GDPR, ISO 27001:2022
Standard Operating ProcedureGovernance: A documented set of step-by-step instructions for completing routine operations consistently, efficiently, and in compliance with standards.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Standards BodyCompliance and Regulatory: An organization responsible for developing, publishing, and maintaining technical standards that define best practices for industries and professions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
State Privacy LawsCompliance and Regulatory: Data protection regulations enacted by individual US states to protect residents' personal information, each with varying requirements and rights.Used in: GDPR, ISO 27001:2022
Statement of Applicability (SoA)Information Security: A required ISO 27001 document listing all Annex A controls, indicating which are applicable, which are implemented, and justification for any exclusions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Static Application Security TestingInformation Security: A security testing methodology that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the application.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
Statutory ComplianceCompliance and Regulatory: Adherence to requirements imposed by legislation enacted by a governing body, carrying the force of law.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5
Steering CommitteeGovernance: A governance body of senior stakeholders that provides strategic direction, oversight, and decision-making for major programs and initiatives.Used in: COBIT 2019, ISO 27001:2022
SteganographyInformation Security: The practice of concealing information within other non-secret data, such as hiding a message within an image file. Unlike encryption, steganography aims to hide the existence of the communication rather than its content.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Step-Up AuthenticationInformation Security: An authentication approach that requires additional verification when a user attempts to access higher-risk resources or perform sensitive operations.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Storage LimitationPrivacy: The principle under GDPR Article 5(1)(e) that personal data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.Used in: GDPR, ISO 27001:2022
Storage SecurityInformation Security: Security measures for protecting data storage systems and media including access controls, encryption, integrity verification, and secure disposal.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Strategic PlanningGovernance: The process of defining an organization's direction and making decisions on allocating resources to pursue strategies aligned with its mission.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Strategic RiskRisk Management: Risks that affect or are created by an organization's business strategy and strategic objectives, including market changes and competitive threats.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Stress TestingRisk Management: The simulation of extreme but plausible scenarios to evaluate an organization's ability to withstand significant adverse events and maintain operations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Sub-processorPrivacy and Data Protection: A third party engaged by a data processor to carry out specific processing activities on behalf of the data controller.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Succession PlanningGovernance: The process of identifying and developing future leaders and key personnel to ensure continuity of critical roles and organizational knowledge.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Supervisory AuthorityPrivacy: An independent public authority established by an EU member state responsible for monitoring the application of GDPR within its territory. Supervisory authorities have investigative, corrective, and advisory powers.Used in: GDPR, NIST Cybersecurity Framework 2.0, CIS Controls v8
Supplier ManagementGovernance: The processes for managing supplier relationships, performance, contracts, and risks throughout the lifecycle of supplier engagements.Used in: NIST SP 800-53 Rev 5, CIS Controls v8
Supply Chain AttackInformation Security: A cyber attack that targets less secure elements in the supply chain to compromise a primary target. Supply chain attacks can involve inserting malicious code into legitimate software updates, compromising hardware during manufacturing, or exploiting third-party service providers.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022
Supply Chain ComplianceCompliance and Regulatory: Requirements for ensuring that suppliers and partners throughout the supply chain adhere to applicable laws, standards, and contractual obligations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Supply Chain ContinuityBusiness Continuity: Planning and measures to maintain supply chain operations during disruptions, including alternative suppliers and logistics arrangements.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Supply Chain RiskRisk Management: Risks arising from dependencies on suppliers and partners in the supply chain, including disruptions, quality issues, and security vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Supply Chain Risk ManagementRisk Management: The process of identifying, assessing, and mitigating risks arising from the extended network of suppliers, vendors, and service providers. Supply chain risk management is addressed by NIST CSF 2.0, ISO 27001 A.5.21, and NIST SP 800-161.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0
Supply Chain SecurityInformation Security: Measures to protect the integrity of products and information throughout the supply chain from manufacturing through delivery to end users.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Surveillance AuditAudit: A periodic audit conducted between certification and recertification to verify that a certified management system continues to meet the standard's requirements.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Surveillance Impact AssessmentPrivacy and Data Protection: An evaluation of the privacy implications of surveillance technologies and monitoring practices on individuals and communities.Used in: GDPR, ISO 27001:2022, NIST SP 800-53 Rev 5
Surveillance SystemInformation Security: An integrated system of cameras, monitors, recording devices, and analytics used to monitor and record activities in and around facilities.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Suspicious Activity ReportCompliance and Regulatory: A filing required by financial institutions when they detect known or suspected criminal activity or suspicious transactions that may indicate money laundering.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0
Suspicious Activity ReportingInformation Security: The process by which employees report unusual or potentially malicious activities they observe to the security team for investigation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Switch SecurityInformation Security: Security features and configurations applied to network switches including port security, VLAN segmentation, and storm control.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
Symmetric EncryptionInformation Security: An encryption method that uses the same key for both encrypting and decrypting data. Symmetric algorithms such as AES are fast and efficient but require secure key exchange between communicating parties.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5
Synthetic DataAI & Technology: Artificially generated data that mimics the statistical properties of real-world data without containing actual personal information. Synthetic data can be used for AI training and testing while preserving privacy.Used in: GDPR, ISO 27001:2022
System HardeningInformation Security: The process of securing a system by reducing its attack surface through removing unnecessary software, closing unused ports, and applying security configurations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8
System RecoveryBusiness Continuity: The process of restoring an information system to operational status after a disruption, failure, or security incident.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022
Systemic RiskRisk Management: The risk of widespread failure in a system, market, or industry that could trigger cascading effects across interconnected organizations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Terms starting with R All letters Terms starting with T