Security Leadership Glossary

A reference for organizations evaluating vCISO, fractional CISO, and security leadership services.

Browse by category

Browse A-Z

Showing 542 terms

B

Backup Strategy

Backup and Restoration

Balanced Scorecard

Baseline Configuration

Behavior-Centric Learning

Board-Level Security Governance

Boundary Defense

Breach Notification

Breach and Attack Simulation

Break-Glass Account

Bring Your Own Device (BYOD) Policy

Business Continuity Management System (BCMS)

Business Continuity Plan

Business Impact Analysis

C

CIS Controls v8.1

CIS Foundations Benchmark

CISA Binding Operational Directive

CISA Known Exploited Vulnerabilities (KEV)

CISA Zero Trust Maturity Model

CISO Advisory Services

CISO as a Service

CSF Implementation Tiers

Capability Maturity Model

Capital vs Operating Spend

Certificate Management

Certification Body

Certified Information Security Manager

Certified Information Systems Security Professional

Chain of Custody

Change Management Policy

Chief Information Security Officer (CISO)

Clean Desk Policy

Cloud Access Security Broker

Cloud Infrastructure Entitlement Management

Cloud Native Application Protection Platform

Cloud Security Posture Management

Cloud Service Provider Assessment

Cloud Workload Protection Platform

Common Vulnerabilities and Exposures

Common Vulnerability Scoring System

Common Weakness Enumeration

Communication Tree

Compensating Controls

Complementary User Entity Controls

Compliance Calendar

Compliance Framework Selection

Computer Security Incident Response Team

Concentration Risk

Conditional Access

Confidentiality Integrity Availability (CIA)

Configuration Drift

Configuration Hardening Standard

Configuration Management

Configuration Standard

Consensus Assessments Initiative Questionnaire

Consent Management

Container Security

Containment Strategy

Containment, Eradication, and Recovery

Contingency Plan Testing

Contingency Planning

Continuity Planning

Continuity of Operations

Continuous Compliance

Continuous Monitoring

Continuous Threat Exposure Management

Contract Security Clauses

Contractual Security Requirements

Control Assessment

Control Cost-Benefit Analysis

Control Crosswalk

Control Effectiveness

Control Framework

Control Implementation

Control Inheritance

Control Mapping to Policy

Control Objectives

Control Selection

Controlled Unclassified Information

Coverage Metrics

Credential Management

Crisis Communications

Crisis Management

Crisis Management Team

Critical Business Functions

Critical Function Identification

Cross-Border Data Transfer

Cryptography Policy

Culture Assessment

Cyber Insurance

Cyber Insurance Coverage

Cyber Insurance Policy Review

Cyber Resilience

Cyber Risk Appetite Statement

Cyber Risk Quantification

Cybersecurity Culture

Cybersecurity Governance

Cybersecurity Maturity Model Certification

Cybersecurity and Privacy Learning Program

E

Emergency Notification

Encryption Key Management

Encryption Policy

Encryption at Rest

Encryption in Transit

Endpoint Detection and Response

Endpoint Protection

Enterprise Asset Inventory

Enterprise Risk Management

Enterprise Security Policy

Entitlement Management

Evidence Collection

Evidence Preservation

Executive Awareness

Exploit Prediction Scoring System

Exposure Management

Extended Detection and Response

F

Factor Analysis of Information Risk (FAIR)

False Positive Management

Federal Information Security Modernization Act

Federal Zero Trust Strategy

Federated Identity

Field-Level Encryption

First Responder

Forensic Readiness

Foundational Controls

Fourth-Party Risk

Fractional CISO

Fractional Resourcing

Full Interruption Test

G

General Data Protection Regulation

Geographic Redundancy

Governance Framework Selection

Governance, Risk, and Compliance

H

HIPAA Privacy Rule

HIPAA Security Rule

Host-Based Intrusion Prevention

I

ISO/IEC 27001 Certification

Identity Federation

Identity Governance and Administration

Identity Lifecycle Management

Identity Provider (IdP)

Identity and Access Management

Immutable Backup

Impact Analysis

Incident Classification

Incident Commander

Incident Detection

Incident Handling

Incident Response Coordination

Incident Response Lifecycle

Incident Response Plan

Incident Response Policy

Incident Response Retainer

Incident Response Runbook

Incident Severity Classification

Incident Triage

Incident Volume Metrics

Indicators of Compromise

Information Security Management System (ISMS)

Information Security Policy

Information Security Program

Infrastructure as Code (IaC) Security

Infrastructure-as-Code (IaC)

Insider Threat Awareness

Insurance Premium Optimization

J

Joiner-Mover-Leaver (JML)

Just-in-Time Access

Just-in-Time Training

K

Key Management System

Key Risk Indicators (KRIs)

Kubernetes Security

L

Learning Management System

Learning Program Governance

Likelihood Determination

Logging and Monitoring Standard

Loss Exceedance Curve

O

OMB Memorandum M-22-09

Onboarding Due Diligence

Operational Resilience

Organizational Profile

Orphaned Accounts

P

Password Policy

Passwordless Authentication

Patch Compliance Rate

Patch Management

Penetration Testing

Personally Identifiable Information

Phishing Failure Rate

Phishing Simulation

Phishing-Resistant MFA

Policy Attestation

Policy Communication

Policy Enforcement

Policy Exception Process

Policy Framework

Policy Governance

Policy Hierarchy

Policy Lifecycle Management

Policy Ownership

Policy Version Control

Post-Incident Activity

Post-Incident Analysis

Principle of Least Privilege

Privacy Awareness Training

Privacy Controls

Privacy Impact Assessment

Privacy Program

Privacy by Design

Privileged Access Management

Privileged Access Workstation

Privileged Account

Probabilistic Risk Modeling

Program Charter Development

Program Maturity Roadmap

Protected Health Information

Provisioning and Deprovisioning

Pseudonymization

Public Key Infrastructure

Purpose Limitation

Q

Qualitative Risk Assessment

Quantitative Risk Assessment

R

Ransomware Recovery Plan

Ransomware Response

Readiness Assessment

Recertification

Records of Processing Activities

Recovery Capability Validation

Recovery Objectives

Recovery Point Objective

Recovery Runbook

Recovery Strategy

Recovery Time Objective

Reference Architecture

Regulatory Notification Timeline

Regulatory Obligation Register

Remediation SLA

Remote Access Policy

Resilience Strategy

Return on Security Investment

Right-to-Audit Clause

Risk Acceptance

Risk Assessment

Risk Context Establishment

Risk Evaluation

Risk Identification

Risk Management Framework

Risk Mitigation

Risk Prioritization

Risk Quantification

Risk Reassessment

Risk Trend Reporting

Risk-Adjusted Investment

Risk-Based Vulnerability Management

Role-Based Access Control

Role-Based Training

Roles and Responsibilities (RACI)

Root Cause Analysis

S

SEC Cybersecurity Disclosure

Sarbanes-Oxley Act

Sarbanes-Oxley IT Controls

Secrets Management

Secure Access Service Edge

Secure Baseline

Secure Configuration Baseline

Secure Data Destruction

Secure Data Sharing

Secure Network Architecture

Security Advisories

Security Architecture

Security Architecture Review

Security Awareness Program

Security Baseline Establishment

Security Budget Allocation

Security Categorization

Security Champions

Security Charter

Security Culture

Security Decision Rights

Security Function Buildout

Security Information and Event Management

Security Maturity Model

Security Metrics

Security Mission Statement

Security Operating Model

Security Operations Center

Security Operations Center (SOC) Maturity

Security Orchestration Automation and Response

Security Program Charter

Security Program Ownership

Security Ratings

Security Roadmap

Security Scorecard

Security Steering Committee

Security Tooling Rationalization

Security Vision

Segregation of Duties

Sensitive Data Discovery

Serverless Security

Service Account

Service Level Agreement

Session Management

Severity Rating

Shared Responsibility Model

Simulated Attack Exercise

Simulated Phishing

Single Loss Expectancy

Social Engineering Awareness

Software Bill of Materials

Standard Operating Procedures

Standardized Information Gathering (SIG) Questionnaire

Statement of Applicability (SoA)

Subcontractor Risk

Supply Chain Continuity

Supply Chain Risk Assessment

Supply Chain Risk Management

Supply Chain Transparency

Syncable Authenticators

System Description

U

User Access Review

W

Workload Identity

Z

Zero Trust Architecture

Zero-Day Vulnerability

Promotional banner for the Pentest Readiness checklist download