Cybersecurity & Compliance Glossary
Plain-English definitions for the security and compliance terms that actually come up in SMB conversations — written to explain what a term means for you, not just repeat a textbook definition.
Compliance & Frameworks
SOC 2 #
An audit report, not a certification, that proves a service organization's security controls actually work — evaluated by an independent CPA firm against the Trust Services Criteria. Type I checks controls at a point in time; Type II checks them over a period (usually 6-12 months), which is what most enterprise customers actually want to see.
ISO/IEC 27001 #
An international standard for running an information security management system (ISMS) — the ongoing process of identifying risks and managing controls, not a one-time checklist. Certification is issued by an accredited body after an external audit and requires periodic surveillance audits to maintain.
HIPAA #
The U.S. law governing protected health information (PHI). The Security Rule sets technical/administrative/physical safeguards for electronic PHI; the Privacy Rule governs use and disclosure. Applies to covered entities (providers, insurers) and their business associates (vendors handling PHI on their behalf).
PCI DSS #
The Payment Card Industry Data Security Standard — a set of 12 requirements for any organization that stores, processes, or transmits cardholder data, enforced by the card brands (Visa, Mastercard, etc.) through merchant agreements rather than government regulation.
CMMC #
The Cybersecurity Maturity Model Certification — the DoD's framework for verifying that contractors and subcontractors handling Controlled Unclassified Information (CUI) actually implement NIST SP 800-171's security requirements, rather than just self-attesting to them.
NIST CSF #
The NIST Cybersecurity Framework — a voluntary, outcome-based structure (Identify, Protect, Detect, Respond, Recover, and as of 2.0, Govern) for organizing a security program. It's not prescriptive about how to implement controls, which makes it a common reference point other frameworks get mapped against.
GDPR #
The EU's General Data Protection Regulation — governs how personal data of EU residents is collected, processed, and stored, with extraterritorial reach (it applies to you if you handle EU residents' data, regardless of where your business is based) and steep penalties for violations.
CCPA / CPRA #
California's consumer privacy law (CCPA, amended and expanded by CPRA) — gives California residents rights over their personal data (access, deletion, opt-out of sale) and imposes obligations on businesses that meet revenue or data-volume thresholds, regardless of where the business itself is located.
GRC #
Governance, Risk, and Compliance — the umbrella term for how an organization sets security direction (governance), identifies and manages exposure (risk), and demonstrates it meets its obligations (compliance). In practice, the three are tightly linked: your compliance requirements shape your risk priorities, which shape your governance decisions.
vCISO #
A virtual or fractional Chief Information Security Officer — senior security leadership delivered as a contracted service rather than a full-time hire, typically at a fraction of the fully loaded cost of an in-house CISO. Common for organizations that need strategic security direction but can't justify (or can't yet afford) a full-time executive.
Access & Identity
Multi-Factor Authentication (MFA) #
Requiring more than one proof of identity to log in — typically something you know (password) plus something you have (an authenticator app, hardware key) or something you are (biometric). The single highest-leverage control most SMBs can implement, since it stops the vast majority of credential-based attacks even when a password is compromised.
Single Sign-On (SSO) #
Letting users authenticate once with a central identity provider and gain access to multiple connected applications without logging in separately to each. Reduces password fatigue and gives IT a single place to enforce MFA and revoke access when someone leaves.
Zero Trust #
A security model built on "never trust, always verify" — no user or device is trusted by default just because it's inside the network perimeter. Every access request is authenticated, authorized, and continuously validated, which matters a lot more now that "inside the network" barely means anything with remote work and cloud apps.
Least Privilege #
Giving users and systems only the access they actually need to do their job, nothing more. Sounds obvious; is routinely violated in practice because it's easier to grant broad access once than to manage narrow access on an ongoing basis — which is exactly why it needs a deliberate review process.
Role-Based Access Control (RBAC) #
Assigning permissions to roles (e.g., "Finance Analyst," "Help Desk") rather than to individuals, then assigning people to roles. Makes access easier to audit and consistent across people in the same job, instead of permissions accumulating differently for every individual over time.
Privileged Access Management (PAM) #
Controls specifically for accounts with elevated access — domain admins, root, database owners. Typically includes vaulting credentials, requiring just-in-time access instead of standing privileges, and session recording, since these accounts cause outsized damage if compromised.
Identity and Access Management (IAM) #
The umbrella discipline covering how identities are created, authenticated, authorized, and deprovisioned across an organization's systems. MFA, SSO, and RBAC are all pieces of a broader IAM program, not separate initiatives.
Password Manager #
A tool that generates and stores unique, high-entropy passwords per account so users don't reuse (or can't remember) weak ones. One of the cheapest controls available relative to the risk it closes off — password reuse across personal and business accounts is a routine entry point for attackers.
Credential Stuffing #
Automated login attempts using username/password pairs leaked from other, unrelated breaches — betting that people reuse passwords across sites. Defended against primarily by MFA and unique passwords, not by making your own password policy more complex.
Session Hijacking #
Stealing or reusing an authenticated session token to impersonate a logged-in user without needing their password — often via malware, a compromised browser extension, or a man-in-the-middle attack. Increasingly relevant as more phishing kits target session tokens specifically to bypass MFA.
Threats & Attacks
Phishing #
Fraudulent messages, usually email, designed to trick someone into handing over credentials, clicking a malicious link, or taking an action that benefits the attacker. Still the leading initial access vector for breaches because it targets people, not infrastructure.
Spear Phishing #
Phishing tailored to a specific person or organization using real, researched details — name, role, recent activity — that make the message far more convincing than a generic mass-sent attempt.
Business Email Compromise (BEC) #
An attack where someone impersonates (or actually compromises) a trusted internal or vendor email account to redirect a payment, change bank details, or request sensitive data — no malware required, just a convincing enough message at the right moment in a real business process.
Ransomware #
Malware that encrypts an organization's data and demands payment for the decryption key — frequently paired now with data theft and a threat to leak it (double extortion), which means even a good backup strategy doesn't fully neutralize the risk anymore.
Zero-Day Vulnerability #
A software flaw that's being actively exploited before the vendor has released a patch — "zero days" of warning. You can't patch your way out of a zero-day in the moment, which is why layered detection and response controls matter as much as patch management.
Supply Chain Attack #
Compromising an organization indirectly, through a trusted vendor, software dependency, or managed service provider rather than attacking it directly — exploiting the fact that you generally trust things your vendors ship to you by default.
Man-in-the-Middle Attack #
Intercepting communication between two parties who believe they're talking directly to each other — often on unsecured Wi-Fi — to eavesdrop on or alter the traffic, including stealing credentials or session tokens in transit.
Denial-of-Service (DoS/DDoS) #
Overwhelming a system or network with traffic or requests until it can't serve legitimate users. Distributed denial-of-service (DDoS) does this from many sources at once, usually a botnet, making it much harder to block than traffic from a single source.
Malware #
Any software designed to damage, disrupt, or gain unauthorized access to a system — the umbrella term covering ransomware, spyware, trojans, worms, and more. What it actually does once it's in varies widely; how it typically gets in (phishing, malicious downloads, unpatched software) doesn't vary nearly as much.
Insider Threat #
Risk originating from someone with legitimate access — an employee, contractor, or partner — whether through malicious intent, negligence, or a compromised account being used by someone else. Harder to detect than external attacks precisely because the access itself isn't unusual.
Advanced Persistent Threat (APT) #
A sustained, well-resourced intrusion — often nation-state or organized-crime affiliated — focused on maintaining long-term, stealthy access rather than immediate, visible damage. Most SMBs aren't the primary target of APT activity, but can be a stepping stone into a larger target through a supply chain relationship.
Data Protection
Encryption at Rest #
Encrypting data while it's stored — on a disk, in a database, in a backup — so that someone who gains unauthorized access to the storage medium itself still can't read the data without the key.
Encryption in Transit #
Encrypting data while it moves between systems (e.g., TLS for web traffic) so it can't be read or altered by anyone intercepting the connection along the way. Needed alongside, not instead of, encryption at rest — they protect against different points of exposure.
Data Loss Prevention (DLP) #
Technical controls that detect and block sensitive data from leaving an organization's environment in unauthorized ways — an email with a credit card number attached, a file upload to an unsanctioned cloud service — whether the cause is malicious or just careless.
Data Classification #
Labeling information by sensitivity (e.g., public, internal, confidential, restricted) so that handling, access, and protection requirements scale appropriately instead of treating every piece of data the same way.
Personally Identifiable Information (PII) #
Data that can identify a specific individual, alone or combined with other data — name, SSN, address, email. What exactly counts as PII varies by jurisdiction and regulation, which is part of why data classification needs to reflect your actual applicable legal requirements, not a generic default.
Protected Health Information (PHI) #
Individually identifiable health information covered by HIPAA — not just medical records, but anything that connects health data to an identifiable person, including billing records and appointment scheduling data held by a covered entity or business associate.
Data Retention Policy #
A documented set of rules for how long different categories of data are kept and when/how they're disposed of. Exists as much to limit liability (you can't leak data you no longer have) as to meet regulatory requirements that mandate minimum or maximum retention periods.
Data Masking #
Obscuring real data with realistic but fictional values, typically so development and test environments don't expose actual production data to a broader set of people than necessary.
Tokenization #
Replacing sensitive data with a non-sensitive substitute (a token) that has no exploitable value on its own, with the mapping back to the real data held separately and tightly controlled — common for payment card data to reduce PCI DSS scope.
Backup and Recovery #
Maintaining copies of data that can restore operations after loss, corruption, or a ransomware event. A backup that hasn't been tested for actual restoration isn't a real control — it's an assumption, and a common one that fails exactly when it's needed most.
Network & Infrastructure
Firewall #
A control point that filters network traffic based on defined rules, blocking traffic that doesn't meet the policy. Modern ("next-gen") firewalls go beyond simple port/protocol filtering to inspect traffic content and application behavior.
Virtual Private Network (VPN) #
An encrypted tunnel between a device and a network, used to protect traffic over untrusted networks or to extend access to internal resources remotely. Increasingly supplemented or replaced by zero-trust network access models that authenticate per-application rather than granting broad network-level access.
Network Segmentation #
Dividing a network into separate zones so that a compromise in one segment doesn't automatically grant access to everything else — e.g., isolating point-of-sale systems from general office network traffic.
Endpoint Detection and Response (EDR) #
Software on individual devices (laptops, servers) that monitors for suspicious behavior, not just known malware signatures, and enables investigation and response directly on the endpoint. Has largely superseded traditional signature-based antivirus as the baseline expectation.
Security Information and Event Management (SIEM) #
A system that centralizes log data from across an environment and correlates it to detect patterns indicating a security event — the difference between having logs and actually being able to use them to detect something happening.
Intrusion Detection/Prevention System (IDS/IPS) #
Network or host-based tools that monitor for known attack patterns. An IDS alerts on suspicious activity; an IPS can also actively block it in real time, trading a small risk of false-positive disruption for faster response.
Patch Management #
The process of identifying, testing, and applying software updates that fix known vulnerabilities, on a defined cadence rather than ad hoc. Unpatched, known vulnerabilities remain one of the most common ways attackers actually get in — not because patches don't exist, but because they weren't applied in time.
Vulnerability Scanning #
Automated scanning of systems and applications to identify known vulnerabilities, misconfigurations, and missing patches. Typically run on a recurring schedule as an ongoing control, distinct from a one-time penetration test.
Penetration Testing #
An authorized, simulated attack against a system or environment to actually exploit vulnerabilities and demonstrate real-world impact, not just list what a scanner found. More labor-intensive and point-in-time than vulnerability scanning, which is why the two are complementary, not interchangeable.
Attack Surface #
The complete set of points where an attacker could potentially gain access — every exposed system, open port, public application, and user account. Reducing attack surface (decommissioning unused systems, closing unnecessary access) is often cheaper and more effective than adding more detection on top of a bloated one.
Governance & Risk
Risk Assessment #
A structured process for identifying threats, evaluating the likelihood and impact of each, and prioritizing which risks need treatment first. Underpins nearly every compliance framework's expectation that controls be chosen deliberately, not just copied from a generic checklist.
Risk Register #
A maintained, living document listing identified risks, their assessed severity, the owner responsible, and the current treatment plan or status — the operational artifact a risk assessment process should actually produce and keep current, not a one-time report.
Third-Party Risk Management #
Assessing and managing the security risk introduced by external parties — vendors, contractors, partners — who have access to your systems or data. Your own controls don't matter much if a vendor with broad access to your environment has weak ones.
Vendor Risk Management #
The specific discipline of evaluating vendors before and during a relationship — security questionnaires, contractual requirements, ongoing monitoring — as a subset of broader third-party risk management focused specifically on suppliers.
Security Awareness Training #
Ongoing education for employees on recognizing and responding to security threats — phishing, social engineering, safe data handling. Most effective as a continuous program with periodic reinforcement (including simulated phishing), not an annual slideshow nobody remembers by March.
Acceptable Use Policy #
A documented policy defining what employees can and can't do with organizational systems, devices, and data — the baseline expectation-setting document most frameworks require before anything more specific can be enforced.
Separation of Duties #
Splitting critical tasks across more than one person so no single individual can both initiate and approve a sensitive action without anyone else involved — a structural control against both fraud and honest mistakes going unchecked.
Audit Trail #
A chronological record of who did what, when, across a system — the evidence that lets you reconstruct what actually happened after the fact, whether for an internal investigation, a compliance audit, or incident response.
Security Posture #
The overall state of an organization's security readiness at a given point in time — a shorthand term for "how exposed are we, really," synthesizing controls, gaps, and risk across the whole environment rather than any single metric.
Compensating Control #
An alternative safeguard used when the originally specified control isn't feasible, that meets the intent and rigor of the original requirement. Common in compliance contexts (especially PCI DSS) where a documented, justified compensating control can satisfy an auditor even without the literal control in place.
Incident Response & Continuity
Incident Response Plan #
A documented, pre-agreed process for detecting, containing, eradicating, and recovering from a security incident — and critically, who does what, in what order, so decisions aren't being improvised for the first time during an actual event.
Breach Notification #
The legally required disclosure of a data breach to affected individuals and/or regulators, within deadlines that vary significantly by state, industry, and the type of data involved — one of the most time-sensitive and easy-to-get-wrong parts of incident response.
Digital Forensics #
The scientific process of collecting, preserving, and analyzing digital evidence after a security incident, in a way that holds up to scrutiny — including legal scrutiny, if the incident ends up in litigation or regulatory action.
Chain of Custody #
Documentation proving exactly who handled a piece of evidence, when, and what was done to it, from collection through final use. Breaks in the chain of custody can make evidence inadmissible or simply less credible, which is why it has to be planned for before an incident, not improvised during one.
Tabletop Exercise #
A discussion-based simulation where stakeholders walk through a hypothetical incident scenario to test (and find gaps in) an incident response plan, without actually executing the technical response — the cheapest, lowest-risk way to find out a plan doesn't actually work the way everyone assumed.
Recovery Time Objective (RTO) #
The maximum acceptable length of time a system can be down after an incident before the business impact becomes unacceptable — a target that should drive your recovery investment, not just a number someone picked because it sounded reasonable.
Recovery Point Objective (RPO) #
The maximum acceptable amount of data loss, measured in time, between the last good backup and an incident — directly determines how frequently you need to back up a given system, since a 24-hour RPO means losing up to a day of data is considered acceptable.
Business Continuity Plan (BCP) #
A broader plan for keeping critical business functions running (or resuming them quickly) through any disruption — not just a cyber incident, but also natural disasters, outages, or loss of key facilities. Incident response is a specific subset focused on security events; BCP is the larger umbrella.
Social Engineering #
Manipulating a person, rather than a system, into doing something that undermines security — phishing, pretexting phone calls, tailgating into a building. The common thread across nearly every major breach, regardless of how sophisticated the technical controls were.