Glossary terms starting with V

Terms

VLANInformation Security

Virtual Local Area Network, a logical network segment created within a physical network to isolate traffic and improve security through network segmentation.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

VPN ConcentratorInformation Security

A network device that manages multiple VPN connections, handling encryption, authentication, and routing for remote access users.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, CIS Controls v8

VPN Split TunnelingInformation Security

A networking configuration that routes only specific traffic through a VPN tunnel while allowing other traffic to flow directly to the internet.Used in: NIST SP 800-53 Rev 5, CIS Controls v8

Vehicle Access ControlInformation Security

Security measures for controlling and monitoring vehicle entry to organizational facilities, including barriers, permits, and inspection procedures.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, NIST Cybersecurity Framework 2.0

Vendor AssessmentRisk Management

The evaluation of a vendor's capabilities, security posture, financial stability, and compliance status as part of the procurement process.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Vendor ComplianceCompliance and Regulatory

The requirement for third-party vendors to adhere to applicable regulations, standards, and contractual security requirements.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Vendor Due DiligenceRisk Management

The investigation and evaluation of a potential vendor's security practices, financial stability, and compliance posture before establishing a business relationship.Used in: PCI DSS v4.0, NIST Cybersecurity Framework 2.0, ISO 27001:2022

Vendor ManagementGovernance

The discipline of managing external vendors and suppliers to maximize value, minimize risk, and ensure service quality and compliance.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Vendor Privacy AssessmentPrivacy and Data Protection

An evaluation of a third-party vendor's privacy practices and controls before sharing personal data or engaging them for data processing.Used in: GDPR, ISO 27001:2022, NIST Cybersecurity Framework 2.0

Vendor Risk AssessmentRisk Management

A formal evaluation of the risks associated with using a specific third-party vendor, including security, compliance, operational, and reputational considerations.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Vendor Risk ManagementRisk Management

The ongoing process of monitoring and managing the risks associated with third-party vendors throughout the lifecycle of the business relationship.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022, CIS Controls v8

Vendor Security AssessmentRisk Management

A formal evaluation of a vendor's security controls, certifications, and incident response capabilities before sharing data or granting system access.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Vendor Security ReviewRisk Management

An assessment of a vendor's security controls, practices, and certifications to determine whether they meet the organization's security requirements.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Vertical Privilege EscalationInformation Security

An attack where a user gains access to resources or functions intended for users with a higher privilege level.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Video SurveillanceInformation Security

The use of cameras and recording systems to monitor and record activities in and around facilities for security, safety, and compliance purposes.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Virtual Private NetworkInformation Security

A technology that creates an encrypted tunnel between a user's device and a remote server, protecting data in transit and masking the user's IP address.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

Virtual Private Network (VPN)Information Security

A technology that creates an encrypted connection over a less secure network, such as the internet. VPNs provide privacy and data integrity for remote access and site-to-site connectivity.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5, GDPR

VirusInformation Security

A type of malicious software that attaches itself to a legitimate programme or file and spreads when the infected file is executed. Unlike worms, viruses require human action to propagate.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

VishingInformation Security

Voice phishing, a social engineering attack that uses phone calls or voice messages to trick victims into revealing sensitive information. Vishing attacks often impersonate banks, government agencies, or technical support.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Visitor ManagementInformation Security

Processes for registering, tracking, and controlling visitors to organizational facilities, including identification verification and escort requirements.Used in: ISO 27001:2022, NIST Cybersecurity Framework 2.0, CIS Controls v8

Vital RecordsBusiness Continuity

Essential records and documents needed for an organization to continue operations during a crisis and to reconstruct operations afterward.Used in: NIST Cybersecurity Framework 2.0, ISO 27001:2022

Voice PhishingInformation Security

A social engineering attack conducted via telephone where callers impersonate legitimate organizations to trick victims into providing sensitive information.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Volume EncryptionInformation Security

The encryption of an entire storage volume or partition, protecting all files and data stored within that volume from unauthorized access.Used in: ISO 27001:2022, NIST SP 800-53 Rev 5

VulnerabilityInformation Security

A weakness in a system, application, or process that could be exploited by a threat actor to gain unauthorised access or cause harm. Vulnerabilities can exist in software, hardware, configurations, or procedures.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability AssessmentInformation Security

A systematic process of identifying, quantifying, and prioritising security vulnerabilities in systems, applications, and networks.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability DatabaseInformation Security

A repository of known security vulnerabilities with details including severity ratings, affected systems, and available patches or workarounds.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability DisclosureInformation Security

The practice of reporting security vulnerabilities to the affected vendor or organisation so they can be patched before being exploited. Responsible disclosure policies define timelines and processes for vulnerability reporting.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8, ISO 27001:2022

Vulnerability Disclosure PolicyInformation Security

A published policy describing how an organization accepts and handles vulnerability reports from external security researchers.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability ManagementInformation Security

The ongoing practice of identifying, evaluating, treating, and reporting on security vulnerabilities in systems and software. Vulnerability management programmes include regular scanning, risk-based prioritisation, and timely remediation.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability PrioritizationInformation Security

The process of ranking discovered vulnerabilities based on factors such as severity, exploitability, asset criticality, and business impact.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability RemediationInformation Security

The process of fixing or mitigating identified security vulnerabilities through patching, configuration changes, or compensating controls.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability ScanningInformation Security

Automated testing that identifies known security weaknesses in systems, networks, and applications by comparing them against databases of known vulnerabilities.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8

Vulnerability WindowInformation Security

The period between when a vulnerability is discovered or publicly disclosed and when a patch or mitigation is applied.Used in: NIST Cybersecurity Framework 2.0, CIS Controls v8