Glossary
Plain-language meanings for the jargon used across the guides and the auditor. Short on purpose: for the legal text, use the official sources linked on the what changed page.
- Annex A
- The list of 93 security controls in ISO 27001:2022, grouped into four themes: organisational, people, physical and technological. You pick the ones that apply to you. Read more
- Attack surface
- Everything about your systems that an attacker could try to reach: websites, open ports, accounts, staff, suppliers.
- Availability
- Information and systems are there when they are needed. Read more
- BCDR (business continuity and disaster recovery)
- Plans and practice for keeping the business running, and getting systems back, after an incident or outage. Read more
- CAA record
- A DNS record that lists which certificate authorities are allowed to issue TLS certificates for your domain. Read more
- Certificate Transparency (SCT)
- A public log of issued certificates. A signed certificate timestamp (SCT) is proof that a certificate was logged, which helps catch mis-issued ones. Read more
- CIA triad
- Confidentiality, integrity and availability: the three things information security protects. Read more
- Confidentiality
- Only the right people can see the information. Read more
- Controller and processor
- Under the GDPR, the controller decides why and how personal data is used. A processor handles data on the controller's behalf and must follow its instructions. Read more
- CSP (Content-Security-Policy)
- A web server header that tells browsers which sources of scripts, styles and other content a page may load. It limits the damage from injected code. Read more
- Data subject
- The person that personal data is about. Read more
- DKIM
- A way of signing outgoing email with a key published in DNS, so receivers can check the message was not altered and really came from your domain.
- DMARC
- A DNS policy that tells receivers what to do with email that fails SPF and DKIM checks (nothing, quarantine, or reject), and where to send reports. Read more
- DNSSEC
- Digital signatures on DNS records, so resolvers can detect forged answers. Read more
- DPIA (data protection impact assessment)
- A structured look at the privacy risks of a new system or use of data. The GDPR requires one when processing is likely to put people at high risk. Read more
- DPO (data protection officer)
- A person responsible for overseeing GDPR compliance. Some organisations must appoint one, for example public bodies and those doing large-scale monitoring. Read more
- Essential and important entities
- The two categories of organisation covered by NIS2. Essential entities are mostly large organisations in the most critical sectors and face stricter supervision. Read more
- HSTS (Strict-Transport-Security)
- A web server header telling browsers to only ever connect to the site over HTTPS. Read more
- Integrity
- Information is accurate and has not been changed by someone who should not have changed it. Read more
- ISMS (information security management system)
- The set of policies, processes and responsibilities an organisation uses to manage information security. ISO 27001 is the standard for it. Read more
- MFA (multi-factor authentication)
- Signing in with more than one kind of proof, such as a password plus a code from an app or a hardware key. Read more
- NIS2
- The EU directive that sets cybersecurity risk-management and incident-reporting duties for organisations in critical and important sectors. Read more
- Pseudonymisation
- Replacing identifying details with codes, with the key to reverse it kept separately. It reduces risk, but the data is still personal data under the GDPR. Read more
- Risk register
- A list of the risks you have identified, with how likely and how serious each is, who owns it and what you are doing about it. Read more
- SPF
- A DNS record listing which servers may send email for your domain. Read more
- Statement of Applicability
- An ISO 27001 document listing every Annex A control, whether you use it, and why. Read more
- Supply chain risk
- The risk that a weakness at a supplier or software provider becomes a problem for you. Read more
- TLS
- The encryption that protects connections between a browser and a website (the padlock). TLS 1.3 is the current version; versions below 1.2 are considered insecure. Read more
- XSS (cross-site scripting)
- An attack where someone gets their own script to run inside another site's pages. A strict CSP is one of the main defences. Read more