This glossary covers essential cybersecurity and password management terminology from password policies and zero-knowledge encryption to RBAC, API authentication, and compliance frameworks like GDPR and SOC 2.
Compliance — the process of adhering to laws, regulations, standards, and contractual obligations governing data protection, privacy, and security practices. Compliance requirements vary by industry (healthcare, finance, retail), geography (GDPR in EU, CCPA in California), and business relationships (SOC 2 for vendors). Compliance mandates specific security controls, documentation, audits, and reporting to demonstrate adherence.
HIPAA — Health Insurance Portability and Accountability Act, a U.S. federal legislation establishing national standards for protecting sensitive patient health information from disclosure without patient consent or knowledge. HIPAA's Privacy Rule governs protected health information (PHI) use and disclosure, while the Security Rule mandates administrative, physical, and technical safeguards for electronic PHI (ePHI).
ISO 27001 — an international standard specifying requirements for establishing, implementing, maintaining, and continually improving information security management systems (ISMS). ISO 27001 provides a systematic approach to managing sensitive information through risk assessment, security controls, policies, procedures, and continuous improvement. The standard covers 114 controls across 14 domains including access control, cryptography, physical security, incident management, and business continuity.
GDPR — General Data Protection Regulation, a comprehensive EU data privacy law that regulates how organizations collect, process, store, and protect personal data of EU residents. Enacted in May 2018, GDPR grants individuals rights including data access, rectification, erasure ("right to be forgotten"), and data portability. Organizations must implement privacy by design, obtain explicit consent, report breaches within 72 hours, appoint data protection officers when required, and demonstrate compliance through documentation.
NIST — National Institute of Standards and Technology, a U.S. government agency that develops cybersecurity frameworks, standards, and guidelines widely adopted globally for improving security posture and risk management. The NIST Cybersecurity Framework provides a voluntary framework of standards, guidelines, and best practices for managing cybersecurity risks across five functions: Identify, Protect, Detect, Respond, and Recover. NIST Special Publication 800-53 provides security and privacy controls for federal systems and organizations.
PCI DSS — Payment Card Industry Data Security Standard, a security framework mandating requirements for organizations that store, process, or transmit credit card information to prevent fraud and data breaches. Established by major card brands (Visa, Mastercard, American Express), PCI DSS includes 12 requirements across six control objectives: secure networks, protect cardholder data, vulnerability management, access controls, monitoring, and information security policies.
Security audit — a systematic evaluation of an organization's information systems, policies, procedures, and controls to assess security posture, identify vulnerabilities, and verify compliance with standards and regulations. Security audits examine access controls, encryption implementation, network security, application security, physical security, incident response capabilities, and policy adherence. Audits may be internal (self-assessment), external (independent auditors), or regulatory (compliance verification). Security audit processes include documentation review, control testing, vulnerability scanning, penetration testing, interviews, and evidence collection.
SOC 2 — an auditing framework developed by AICPA for evaluating service organizations' security, availability, processing integrity, confidentiality, and privacy controls. SOC 2 reports demonstrate to customers and stakeholders that organizations implement appropriate security measures protecting customer data. SOC 2 Type I audits assess control design at a point in time, while Type II audits evaluate control effectiveness over 6-12 months. SOC 2 compliance requires documented policies, access controls, encryption, monitoring, incident response, vendor management, and regular security assessments.