Security and compliance terms, in plain English.

A

AIMSAI management system

A management system for developing, providing or using AI responsibly. ISO/IEC 42001 sets out the requirements. Learn more about AIMS

B

BECBusiness email compromise

Fraud where an attacker uses a hijacked or look-alike email account to trick staff into paying money or sharing data, often posing as a supplier or senior manager.

BIABusiness impact analysis

An assessment of which activities matter most and how quickly each must be restored after a disruption. It sets RTO and RPO targets in business continuity work. Learn more about BIA

BIMIBrand Indicators for Message Identification

A DNS record that lets supporting inboxes show your logo next to authenticated email. It requires DMARC at quarantine or reject. Learn more about BIMI

C

CERT-InIndian Computer Emergency Response Team

India's national agency for cyber security incidents. Specified cyber incidents must be reported to CERT-In within 6 hours. Learn more about CERT-In

Conditional Access

Microsoft Entra ID policies that allow, block or challenge sign-ins based on conditions such as user, device, location and risk. Commonly used to enforce MFA. Learn more about Conditional Access

Consent manager

Under India's DPDP Act, a registered entity through which a data principal can give, manage, review and withdraw consent. Learn more about Consent manager

CVSSCommon Vulnerability Scoring System

An open standard for rating the severity of a software vulnerability on a 0 to 10 scale. Penetration test reports often give a CVSS base score per finding. Learn more about CVSS

D

Data fiduciary

Under India's DPDP Act, the organisation that decides why and how personal data is processed. Learn more about Data fiduciary

Data principal

Under India's DPDP Act, the individual the personal data relates to. For a child, this includes their parent or lawful guardian. Learn more about Data principal

DKIMDomainKeys Identified Mail

An email authentication method in which the sending server signs messages with a private key, and receivers check the signature against a public key published in DNS under a selector. Learn more about DKIM

DMARCDomain-based Message Authentication, Reporting and Conformance

A DNS policy that tells receivers what to do with mail that fails SPF and DKIM alignment (none, quarantine or reject) and where to send reports. Learn more about DMARC

E

EDREndpoint detection and response

Software on laptops and servers that records activity, detects suspicious behaviour and lets responders isolate a device. Microsoft Defender for Endpoint is one example. Learn more about EDR

I

ISMSInformation security management system

A structured way to manage information security risks: scope, leadership, risk assessment and treatment, controls, internal audit and improvement. ISO/IEC 27001 sets out the requirements. Learn more about ISMS

L

Landing zone

A pre-configured cloud foundation (accounts or subscriptions, networking, identity, logging and guardrails) that workloads are deployed into. Learn more about Landing zone

Least privilege

Giving each person or system only the access needed for their task, and removing it when no longer needed.

M

MDMMobile device management

Central management of laptops, phones and tablets: enrolment, configuration, encryption, updates and remote wipe. Jamf and Microsoft Intune are examples. Learn more about MDM

MFAMulti-factor authentication

Signing in with more than one kind of proof, such as a password plus an authenticator app or security key.

MTA-STSMail Transfer Agent Strict Transport Security

A policy that tells sending mail servers to deliver to your domain only over encrypted, verified connections. Learn more about MTA-STS

P

PCI DSSPayment Card Industry Data Security Standard

The security standard for organisations that store, process or transmit payment card data. Learn more about PCI DSS

Phishing

Messages that impersonate a trusted sender to trick people into clicking a link, opening a file or revealing credentials.

PIMSPrivacy information management system

A management system for personal data. ISO/IEC 27701 sets out the requirements; since 2025 it can stand alone or run alongside an ISO/IEC 27001 ISMS. Learn more about PIMS

R

Ransomware

Malware that encrypts or steals data and demands payment. Tested, isolated backups and fast detection limit the damage. Learn more about Ransomware

RPO and RTORecovery point objective and recovery time objective

RPO is the most data you can afford to lose, measured in time. RTO is how quickly a system must be running again after a disruption. Learn more about RPO and RTO

S

SoAStatement of Applicability

The ISO/IEC 27001 document listing every Annex A control, whether it applies, why, and how it is implemented. Learn more about SoA

SOC 2 Type I and Type II

SOC 2 is an AICPA attestation on a service organisation's controls against the Trust Services Criteria. Type I covers control design at a point in time; Type II covers operating effectiveness over a period. Learn more about SOC 2 Type I and Type II

SPFSender Policy Framework

A DNS TXT record listing the servers allowed to send email for your domain. A domain should have exactly one, and evaluating it may use no more than 10 DNS lookups. Learn more about SPF

V

VAPTVulnerability assessment and penetration testing

Finding weaknesses with scanning and review (assessment), then safely attempting to exploit them as an attacker would (penetration testing), within an authorised scope. Learn more about VAPT

X

XDRExtended detection and response

Detection and response that correlates signals across endpoints, email, identity and cloud apps. Microsoft Defender XDR is one example.

Z

Zero trust

A security approach that verifies every access request explicitly, grants least privilege and assumes breach, instead of trusting anything inside the network.