Glossary terms starting with T

Terms

TLSInformation Security

Transport Layer Security, a cryptographic protocol that provides end-to-end encryption for data transmitted over networks, succeeding SSL.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

TLS (Transport Layer Security)Information Security

A cryptographic protocol designed to provide communications security over a computer network. TLS encrypts data in transit between clients and servers and is used for securing web browsing, email, messaging, and VoIP.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

TLS InspectionInformation Security

The decryption and inspection of TLS-encrypted traffic at a security gateway to detect threats hidden within encrypted communications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Tabletop ExerciseInformation Security

A discussion-based exercise where team members walk through simulated scenarios in a classroom setting. Tabletop exercises test incident response plans, business continuity procedures, and decision-making processes without activating real systems.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

TailgatingInformation Security

A physical security breach where an unauthorized person follows an authorized person through a secured entrance without presenting their own credentials.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Tailgating PreventionInformation Security

Physical security measures and awareness training designed to prevent unauthorized individuals from following authorized personnel into secured areas.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Tamper DetectionInformation Security

Mechanisms that detect and alert on physical tampering with devices, enclosures, or seals protecting sensitive equipment or data.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Tape EncryptionInformation Security

The encryption of data written to backup tapes to protect the confidentiality of stored data if physical tapes are lost or stolen.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Tax ComplianceCompliance and Regulatory

Adherence to tax laws and regulations governing the calculation, reporting, and payment of taxes to relevant authorities.Used in: PCI DSS v4.0, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Technical ControlInformation Security

A security control implemented through technology such as firewalls, encryption, access controls, and intrusion detection systems.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

Technology GovernanceGovernance

Policies and processes for managing technology investments, architecture decisions, and IT operations in alignment with business strategy and risk appetite.Used in: NIST Cybersecurity Framework 2.0, COBIT 2019, ISO 27001:2022

Technology RecoveryBusiness Continuity

The processes and procedures for restoring technology systems and infrastructure following a disruption or disaster.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Technology RiskAI and Technology

The potential for technology failures, obsolescence, security breaches, or misuse to adversely impact an organization's operations and objectives.Used in: EU AI Act

Technology RoadmapGovernance

A strategic plan that outlines the technology initiatives, milestones, and investments needed to support business objectives over a defined period.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Telecommunications ComplianceCompliance and Regulatory

Regulatory requirements specific to telecommunications providers covering consumer protection, data retention, lawful interception, and network security.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Telecommunications SecurityInformation Security

Security measures for protecting telecommunications infrastructure, networks, and services from cyber threats and unauthorized interception.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Temporary AccessInformation Security

Time-limited access permissions granted to users for specific tasks or projects, automatically expiring after a defined period.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Third-Party AssessmentRisk Management

An evaluation of a vendor or partner's security posture, compliance status, and risk profile conducted as part of vendor management.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Third-Party AssuranceAudit

Independent verification by an external party that an organisation's controls, processes, or systems meet specified criteria. SOC reports, ISO certifications, and penetration test reports are common forms of third-party assurance.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022

Third-Party AttestationAudit and Assurance

Independent verification by a qualified external party that an organization's controls or practices meet specified requirements.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Third-Party AuditAudit and Assurance

An independent audit conducted by an external organization to verify compliance with standards, regulations, or contractual requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Third-Party ComplianceCompliance and Regulatory

The requirement for vendors and partners to adhere to regulatory requirements and contractual security obligations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Third-Party CookiesPrivacy and Data Protection

Cookies set by domains other than the one a user is visiting, commonly used for cross-site tracking and advertising purposes.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Third-Party Data SharingPrivacy and Data Protection

The practice of providing personal data to external organizations, subject to contractual agreements, consent requirements, and regulatory restrictions.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Third-Party RiskPrivacy

The potential threat to an organisation's data security and privacy posed by the actions or security posture of its vendors, partners, and service providers. Managing third-party risk is essential for GDPR compliance, particularly regarding data processors.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Third-Party Risk ManagementRisk Management

The process of identifying, assessing, and managing risks associated with outsourcing to or partnering with external organisations. Includes vendor due diligence and ongoing monitoring.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8

Third-Party Risk Management (TPRM)Risk Management

The process of identifying, assessing, and controlling risks presented throughout the lifecycle of relationships with third parties. TPRM programmes evaluate vendors' security posture, compliance status, and financial stability.Used in: NIST SP 800-53 Rev 5, CIS Controls v8, NIST Cybersecurity Framework 2.0

Threat ActorInformation Security

An individual or group that conducts cyber attacks or exploits vulnerabilities. Threat actors include nation-states, organised crime groups, hacktivists, insider threats, and opportunistic attackers.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat AnalysisRisk Management

The process of examining threat sources, their capabilities, motivations, and historical patterns to understand the threat environment.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Threat AssessmentInformation Security

The process of evaluating potential threats to an organization by analyzing threat actors, their capabilities, intentions, and the likelihood of attack.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat CatalogRisk Management

A documented inventory of relevant threats organized by category, including descriptions, associated vulnerabilities, and potential impacts.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Threat DetectionInformation Security

The process and technology used to identify malicious activity, policy violations, and other security threats within an organization's environment.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat Detection RuleInformation Security

A defined pattern or condition in security monitoring systems that triggers an alert when matching events are observed.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat EmulationInformation Security

The simulation of specific threat actor techniques and procedures to test whether security controls can detect and prevent known attack methods.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat FeedInformation Security

A continuous stream of data providing information about current threats, indicators of compromise, and adversary tactics from external intelligence sources.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat HuntingInformation Security

The proactive process of searching through networks and datasets to detect and isolate advanced threats that evade existing security solutions. Threat hunting combines human analyst expertise with automated detection tools.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat Hunting MethodologyInformation Security

Structured approaches for proactively searching for hidden threats in an environment, including hypothesis-driven, intelligence-driven, and analytics-driven methods.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat IdentificationRisk Management

The process of recognizing and documenting potential threats that could exploit vulnerabilities and adversely affect organizational assets.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat Informed DefenseInformation Security

A security strategy that uses understanding of adversary behavior and threat intelligence to prioritize defensive measures and resource allocation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat IntelligenceInformation Security

Evidence-based knowledge about existing or emerging threats, including context, mechanisms, indicators, and actionable advice. Used to inform security decisions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat Intelligence PlatformInformation Security

A technology solution that collects, aggregates, and operationalizes threat intelligence from multiple sources to support security decision-making and response.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat Intelligence Platform (TIP)Information Security

A technology solution that collects, organises, and analyses threat intelligence data from multiple sources. TIPs enable security teams to understand the threat landscape and make informed decisions about defensive measures.Used in: NIST SP 800-53 Rev 5, CIS Controls v8, NIST Cybersecurity Framework 2.0

Threat LandscapeRisk Management

The current state of threats facing an organization or industry, including active threat actors, attack methods, and emerging attack trends.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat Landscape AnalysisRisk Management

A comprehensive assessment of the current and emerging threats facing an organization or industry, informing security strategy and priorities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat ManagementInformation Security

The ongoing process of identifying, evaluating, and responding to cybersecurity threats facing an organization.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat ModelingInformation Security

A structured approach to identifying and prioritizing potential security threats to a system, application, or organization and defining countermeasures.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat ModellingInformation Security

A structured approach for identifying, quantifying, and addressing security threats to a system or application. Threat modelling analyses potential attack vectors and helps prioritise security controls during the design phase.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat RegisterRisk Management

A documented catalog of identified threats to an organization including their sources, capabilities, motivations, and historical activity patterns.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Threat ResponseInformation Security

Actions taken to address and neutralize identified threats, including containment, eradication, and recovery activities.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat VectorInformation Security

A path or means by which a threat actor can gain access to a target system to deliver a malicious payload or carry out an attack.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Threat and Vulnerability ManagementInformation Security

An ongoing programme for identifying, evaluating, and addressing threats and vulnerabilities in an organisation's IT environment. Combines threat intelligence, vulnerability scanning, risk prioritisation, and remediation tracking.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Three Lines ModelGovernance

A governance framework that assigns risk management responsibilities across three lines: operational management, risk oversight, and independent assurance.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, COBIT 2019

Three Lines of DefenceGovernance

A governance model that divides risk management responsibilities into three layers: first line (business operations and management controls), second line (risk management and compliance functions), and third line (internal audit).Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, COBIT 2019

Tier 1 AnalystInformation Security

An entry-level SOC analyst responsible for monitoring security tools, performing initial alert triage, and escalating potential incidents.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Tier 2 AnalystInformation Security

An experienced SOC analyst who performs deep-dive investigations of escalated incidents and conducts advanced threat analysis.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Tier 3 AnalystInformation Security

A senior SOC analyst or threat hunter who handles the most complex incidents, performs threat hunting, and develops detection rules.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Time-Based One-Time PasswordInformation Security

An algorithm that generates temporary passwords using the current time as a variable, commonly used in two-factor authentication applications.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Time-Based One-Time Password (TOTP)Information Security

A temporary passcode generated by an algorithm that uses the current time as one of its factors. TOTP is commonly used in multi-factor authentication applications such as Google Authenticator and Microsoft Authenticator.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Token-Based AuthenticationInformation Security

An authentication method that uses digitally signed tokens instead of credentials for each request, enabling stateless and scalable access control.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

TokenisationInformation Security

The process of replacing sensitive data with non-sensitive placeholder values (tokens) that have no exploitable meaning. Tokenisation is widely used in payment card processing to protect cardholder data and reduce PCI DSS scope.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, CIS Controls v8

TokenizationInformation Security

A data security technique that replaces sensitive data with non-sensitive placeholder tokens that map back to the original data through a secure vault.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Tone at the TopGovernance

The ethical atmosphere that is created in the workplace by the organisation's leadership. The tone set by senior management and the board directly influences the organisation's culture, control environment, and compliance posture.Used in: COBIT 2019, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Top RiskRisk Management

The most significant risks to an organization as determined through assessment processes, typically requiring board-level visibility and management attention.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Tracking PixelPrivacy and Data Protection

A tiny invisible image embedded in web pages or emails that monitors user activity such as page views, email opens, and conversions.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Trade ComplianceCompliance and Regulatory

Adherence to laws and regulations governing international trade, including import/export controls, customs requirements, and trade sanctions.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Traffic AnalysisInformation Security

The examination of network communication patterns, volumes, and metadata to identify anomalies, security threats, or intelligence without necessarily reading content.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Traffic ShapingInformation Security

Network management techniques that control the flow of network traffic to optimize performance and ensure quality of service for critical applications.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Transfer Impact AssessmentPrivacy and Data Protection

An evaluation of the risks to personal data when transferred to a third country, considering the legal framework and supplementary measures required.Used in: GDPR, ISO 27001:2022

Transnational RegulationCompliance and Regulatory

Regulatory frameworks that apply across multiple countries or jurisdictions, requiring organizations to comply regardless of where they are headquartered.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

TransparencyPrivacy

The principle that individuals should be clearly informed about how their personal data is being collected, used, and processed. Transparency is a foundational principle of GDPR and requires clear, plain language in privacy communications.Used in: GDPR, ISO 27001:2022

Transparency PrinciplePrivacy and Data Protection

A data protection requirement that personal data processing information be presented to individuals in a clear, accessible, and easily understandable manner.Used in: GDPR, ISO 27001:2022

Transparent Data EncryptionInformation Security

Database encryption that automatically encrypts data before writing to storage and decrypts when reading, without requiring application changes.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Transport Layer SecurityInformation Security

A cryptographic protocol that secures communications over computer networks, widely used to protect web traffic, email, and other data transmissions.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Transportation ComplianceCompliance and Regulatory

Regulations governing transportation operations including safety standards, environmental requirements, security mandates, and driver regulations.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, NIST SP 800-53 Rev 5

Trojan HorseInformation Security

Malicious software disguised as legitimate software. Trojans create backdoors in security systems, allowing attackers to gain unauthorised access to the compromised system.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Trust BoundaryInformation Security

A boundary in a system where the level of trust changes, requiring security controls to validate data and authorize access as information crosses between zones.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Trust Services CriteriaAudit

The five criteria used in SOC 2 audits: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Organisations select which criteria apply.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Trustworthy AIAI & Technology

AI systems that are lawful, ethical, and robust throughout their lifecycle. The concept, promoted by the EU's High-Level Expert Group on AI, encompasses seven key requirements including human agency, technical robustness, privacy, transparency, diversity, societal wellbeing, and accountability.Used in: GDPR, ISO 27001:2022

Two-Factor AuthenticationInformation Security

An authentication method that requires two different types of verification, such as a password and a one-time code, before granting access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Two-Factor Authentication (2FA)Information Security

An authentication process that requires exactly two different factors to verify a user's identity. 2FA is a subset of multi-factor authentication and typically combines a password with a mobile device verification.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

Type I ReportAudit and Assurance

An audit report that describes an organization's system and the suitability of control design at a specific point in time.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0

Type II ReportAudit and Assurance

An audit report that evaluates both the design and operating effectiveness of controls over a specified period, typically six to twelve months.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0