Words you can work with.

Three related functions: checking an identity claim, deciding permitted actions and recording relevant activity.

In context: A staff member logs in, receives permission to export bookings, and leaves an export event in a log.

Rules and mechanisms that determine and enforce permitted access to resources.

In context: A booking application permits approved staff to read records but restricts exports.

Checking whether existing permissions remain appropriate and approved.

In context: After a role change, review groups, direct permissions and privileged access.

A recorded review must be connected to actual follow-up; the label alone proves little.

A model showing which subjects may perform which actions on which objects.

In context: Rows identify subject accounts; columns identify resources. A cell can show whether the receptionist account may read or modify a booking record.

A system record through which an identity can be represented and given access.

In context: A person may have an ordinary account and a separate administrative account.

An account, a person, a permission and an active session are different things.

Recording relevant activity so that it can be traced and reviewed in the AAA context.

In context: A log records which account requested an export and when.

A record alone does not prove which human controlled an account.

A control carried out through organizational rules, responsibilities or processes.

In context: An approval procedure and a staff-awareness program are administrative controls.

Control categories can overlap; an ISO Annex A theme is a different classification scheme.

An AI-enabled application that can perform actions or coordinate steps with some degree of autonomy, depending on its design and permissions.

In context: An assistant drafts replies and may be allowed to call an approved booking tool.

Agent designs, tools and autonomy vary; no single LLM-based architecture is universal.

Changes in data, context or model-related behaviour over time that can make prior performance assumptions unreliable.

In context: An assistant's replies become less suitable as booking practices and input data change.

Drift is a reason to monitor and investigate, not automatic proof of malicious interference. Full drift taxonomy and diagnosis are not taught here.

Context-dependent properties including validity and reliability, safety, security and resilience, accountability and transparency, explainability and interpretability, privacy, and fairness with harmful bias managed.

In context: A plausible reply is checked for its task accuracy, information handling and effects on people.

Properties and trade-offs interact; meeting one does not establish universal trustworthiness.

A notification that an observation or rule condition may need attention.

In context: A monitoring tool flags an unusual export volume.

An alert is not automatically a confirmed incident, including when AI generated it.

Examining and interpreting information to understand patterns, relationships, meaning or causes relevant to a question.

In context: Investigate why a recovery result missed its target before evaluating what action is needed.

This is the guide's general explanatory use. It is broader than the particular step called risk analysis and does not replace the full ISO performance-evaluation requirements.

The reference-control annex associated with ISO/IEC 27001; the 2022 overview has 93 controls grouped in four themes.

In context: Use the annex comparison and applicability reasoning as taught in the authorized course or standard.

The saved eight examples do not teach every control, prove that all apply, or establish a requirement to memorize all 93. Detailed authorized teaching remains missing and may require payment.

A recurring fee associated with maintaining a credential under the issuer's current terms.

In context: Check the current ISC2 fee and maintenance rules when budgeting.

PAID unless an applicable entitlement covers it. Prices and eligibility are changeable; the payment guide is a dated snapshot, not a quote.

An observation that differs from an expected pattern or reference behaviour.

In context: An account appears to sign in from an unusual location.

An anomaly is a signal for investigation, not proof of compromise or identity.

A source identifying intended correct answers to questions.

In context: Check whether a saved practice item has a publisher-provided key and whether it is current and relevant.

A key is different from a full explanation; editorial examples are not official or independently validated marking keys.

Software that performs a task for a person or organization.

In context: A booking application records appointments. The operating system supplies the platform on which it runs.

Systems that generate outputs such as predictions, recommendations or decisions for objectives, using various techniques and designs.

In context: A service predicts demand or generates a draft reply.

AI, machine learning, generative AI, LLMs and agents are related terms rather than synonyms.

Something of value that supports an organization's objectives and may need protection.

In context: Information, staff knowledge, services, software, devices and paper files can all be assets.

A maintained record of relevant assets, their purpose, responsible owner and status.

In context: A list containing only office laptops would miss a hosted booking service and its data.

The stages through which an asset is acquired, authorized, used, maintained and retired.

In context: Check support and disposal needs before buying a device, then maintain its status during use.

The person or role responsible for relevant decisions about an asset in its organizational context.

In context: The bookings manager may own the business information even though a provider owns the server.

Ownership here means organizational responsibility; it does not establish legal title.

Cryptographic mechanisms using a related public and private key pair.

In context: A signing scheme uses a private signing key and a public verification key.

Not every asymmetric algorithm can both encrypt and sign.

Access decisions based on attributes of subjects, resources, actions and context.

In context: A policy considers the user's role, the record's sensitivity and the access context.

A product's label does not prove that the required policy is enforced.

A systematic, independent and documented process for obtaining and evaluating evidence against criteria.

In context: An auditor compares verified access-review evidence with the applicable requirements.

The saved shared definition is an introductory concept, not a complete current auditing standard or auditor qualification.

The requirements or other reference points against which audit evidence is compared.

In context: An approved access policy and relevant ISMS requirements form part of the defined criteria.

Identify applicable criteria before drawing conformity conclusions.

Checking evidence for a claimed identity.

In context: A system checks a password and another factor before accepting a staff identity claim.

A type of evidence used for authentication, commonly knowledge, possession or inherence.

In context: A password is knowledge; a separately controlled authenticator may supply possession evidence.

Two passwords do not constitute two distinct factor types.

A means through which evidence for an identity claim is demonstrated.

In context: A staff member uses a password or a security authenticator to support a login claim.

The exact assurance depends on the mechanism, its binding and its protection.

Deciding which actions a subject is permitted to perform on a resource.

In context: An authenticated receptionist can read bookings but cannot approve refunds.

Anonymous access can also be authorized, as with a public page.

Access to and use of information or services by authorized parties when needed.

In context: A confidential, accurate booking database still fails availability if staff cannot use it during business hours.

A retained copy intended to support recovery of information.

In context: A protected booking copy may support restoration after accidental deletion.

A copy's existence does not prove that restoration will work or meet recovery objectives.

The defensive function that protects, detects and responds during relevant security work or exercises.

In context: Defenders review observations and improve response during an agreed exercise.

The label does not require a separate department.

A family of short-range wireless technologies that includes Bluetooth Classic and Bluetooth Low Energy.

In context: A device's radio capabilities and use context determine which Bluetooth functions it supports.

The Bluetooth name alone does not establish that a connection or device is secure.

A cloud characteristic in which capabilities are available over networks through standard access mechanisms.

In context: Users reach a service from suitable client devices.

Network access does not mean every resource is publicly accessible.

Maintaining or resuming important business activities during disruption.

In context: A studio uses an agreed alternative booking process while its main system is unavailable.

Analysis of how disruption affects business activities, their dependencies and recovery priorities.

In context: Identify the consequences of losing booking access and the resources needed to resume service.

Investigating why a problem happened and which conditions contributed to or sustained it.

In context: Check whether an approval bypass arose from workflow design, unclear requirements or another evidenced cause.

Do not default to blaming staff, prescribing retraining or requiring a fixed number of whys.

An independent assessment through the organizational certification route.

In context: A certification body assesses an organization's ISMS against the relevant requirements.

A personal Foundation certificate does not certify an organization or authorize its holder to act as a certification body.

Records of how evidence was collected, handled, transferred and controlled, helping establish its provenance and integrity.

In context: Record who handled an evidence copy, when, and under what conditions.

The appropriate evidence process depends on circumstances and obligations; every incident does not require an identical legal procedure.

Controlling relevant changes through planning, approval, implementation, verification and records.

In context: Review the impact of a booking-system change before introducing it.

An approved plan does not prove the implemented change worked as intended.

Three core information-security objectives: limiting disclosure, preserving accuracy and completeness, and enabling authorized use when needed.

In context: Sending an export to the wrong recipient affects confidentiality; corrupting dates affects integrity; an outage affects availability.

One event can affect several objectives.

In NIST media sanitization, applying logical techniques to user-addressable storage to resist simple recovery through ordinary interfaces.

In context: Select a supported clearing method suitable for the medium and the information.

Clearing is not a paper-media method, a fixed overwrite-pass rule or a guarantee for every virtual-storage situation.

A model with on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service.

In context: A service consumer requests and uses pooled capacity without managing the provider's entire infrastructure.

The five characteristics describe the model; they do not establish security or compliance.

The property that makes finding two different inputs with the same cryptographic hash output computationally difficult.

In context: An adversary should not readily construct two different documents with the same digest.

It is resistance to finding collisions, not a promise that collisions cannot exist.

Providing relevant information to an intended audience for a defined purpose.

In context: Tell staff which export procedure changed, where the current version is and what action is expected.

A full ISO communication plan and duties are not supplied by this definition.

Cloud infrastructure for a defined community of organizations with shared concerns.

In context: Organizations with common mission or policy needs use a community cloud.

A deployment label does not prove a specific security level.

Ability to apply relevant knowledge and skills to achieve intended results.

In context: A staff member demonstrates the approved export process correctly.

Course attendance or possession of a certificate alone is not the same as demonstrated competence.

Meeting applicable requirements and being able to demonstrate that they are met.

In context: A business identifies an applicable obligation and keeps suitable evidence of its implementation.

Applicable requirements depend on the organization and context.

An exam method that adjusts item selection using an estimate of performance as the test proceeds.

In context: The selected current CC exam uses CAT.

A scaled score is not a raw percentage. Check current issuer rules for length, navigation and format rather than treating a glossary as booking instructions.

Limiting information access and disclosure to authorized parties.

In context: A booking export is made available only to approved recipients.

An agreed reference state for a system's configuration.

In context: Record the approved settings against which later changes are reviewed.

A baseline must remain appropriate and be maintained; it is not automatically secure forever.

Maintaining knowledge and control of relevant system settings and changes.

In context: Compare current settings with the approved baseline and investigate deviations.

Recurring activity to improve results or the management system over time.

In context: Use performance evidence, findings and experience to choose and evaluate improvements.

Improvement is broader than fixing one finding. In the selected 2022 structure it is clause 10.1.

Learning and development activity recorded under a credential's maintenance requirements.

In context: A credential holder records qualifying learning according to the issuer's rules.

This glossary does not award CPE credit or demonstrate completion of maintenance duties.

A measure used to influence risk or help meet a security objective.

In context: An approval rule, a door lock and a firewall are different control examples.

A control's existence does not prove that it is effective or that every organization needs it.

A grouping used in the 2022 Annex A overview: organizational, people, physical or technological.

In context: Training is a people-theme example; secure areas are a physical-theme example.

These four themes differ from the general administrative, technical and physical control categories.

Action to eliminate a detected nonconformity; in ordinary problem-solving, correcting the particular detected problem.

In context: Correct the particular approval record or affected transaction as appropriate.

Correction does not necessarily remove the cause.

Action to eliminate the cause or causes of a nonconformity and prevent recurrence.

In context: Change a verified workflow weakness, then check whether later approvals work.

Implementation alone does not demonstrate effectiveness. In the selected 2022 structure nonconformity and corrective action are clause 10.2.

Relating observations to help interpret events or activity.

In context: Connect a login record, an export record and a later alert.

Related observations do not by themselves establish cause or attribution.

A digest computed from input by a cryptographic hash function; commonly used fixed-output functions produce a digest of their specified length.

In context: Compare a file's digest with an independently trusted expected digest.

A hash is not reversible encryption, and a bare hash does not authenticate a supplier. Variable-output constructions also exist; the specified function determines the output-length rules.

A parameter used by a cryptographic mechanism to control its operation.

In context: A decryption process requires the appropriate key material.

Key protection and lifecycle management affect the protection actually achieved.

Methods for protecting information using cryptographic mechanisms such as encryption, hashing and signatures.

In context: Choose a mechanism according to the confidentiality, integrity or origin-evidence need.

This introduction supplies no current algorithm-selection, key-size or deployment checklist.

Information analysed and placed in context so that it supports decisions about cyber threats.

In context: An organization uses relevant threat information to adjust monitoring priorities.

A raw indicator alone is not a complete intelligence assessment.

A concise display of selected information and measures used to monitor a situation or support decisions.

In context: A view shows verified access-review progress, exceptions and the period covered.

This is the introductory use in the guide, not an issuer-mandated design. Data quality, context and interpretation matter; a green dashboard does not prove security.

Assigning information to categories that guide appropriate handling and protection.

In context: Classify a client booking export according to its sensitivity and business needs.

A classification scheme must fit the organization and its obligations.

The actions and protections applied as information is collected, used, stored, transferred, retained and disposed of.

In context: An export follows approved access, transfer, retention and disposal rules.

Changing the displayed or supplied representation of data to limit exposure of selected values.

In context: A staff view shows only part of a reference value.

Masking is not automatically encryption, access control or effective anonymization.

Adversarial manipulation of training data intended to affect an AI system's behaviour.

In context: A conceptual case involves deliberately corrupted training examples.

Only the reviewed conceptual excerpts are assigned; the source's known-error taxonomy index and attack procedures are excluded.

The cryptographic process for recovering readable information from ciphertext with the appropriate mechanism and key.

In context: An authorized recipient recovers a protected booking export.

The recovered plaintext still needs appropriate handling.

Combining complementary safeguards to reduce exposure and support detection and response.

In context: Access restrictions, monitoring and recovery arrangements address different parts of a service's protection.

No layer or combination guarantees that every attack will be stopped.

A network zone used to separate exposed services from other protected systems through controlled communication paths.

In context: An internet-facing service is isolated from internal booking records.

A zone name alone does not enforce the intended policy.

Something that a service, process or asset relies on to work.

In context: A booking service depends on staff accounts, network connectivity, a provider and usable appointment data.

Removing or disabling access and identity/account arrangements that are no longer justified.

In context: Remove obsolete permissions after a role change and handle accounts, credentials and active sessions appropriately when access ends.

A role move does not universally require deleting the entire account. Account state, audit retention, downstream permissions, sessions and tokens require context-specific handling.

In NIST media sanitization, making target data infeasible to recover with advanced laboratory methods while making the medium unusable.

In context: Use a suitable destruction process for the medium being retired.

The glossary does not prescribe a destruction technique or authorize destruction of real records.

A cryptographic mechanism using a private signing key and corresponding public verification key to support integrity and origin evidence.

In context: A recipient verifies a signature using a suitably trusted public key.

A signature does not normally conceal the document, prove every statement in it or guarantee a legal result. It is not universally private-key encryption of a hash.

Restoring technology and data after disruption in support of business needs.

In context: Restore the booking application and its usable data, then confirm the service works.

Technology recovery is part of a broader continuity picture.

Access control that permits specified permission decisions to be made or delegated by authorized subjects.

In context: An authorized owner can grant another user access within the system's permitted rules.

Discretion exists within the applicable policy; it is not unlimited freedom.

Information that is controlled and maintained, together with the medium containing it.

In context: A controlled wiki procedure and a retained approval record can both be documented information.

It need not be a paper manual. The complete ISO required-record list remains a gap.

The distributed naming system using domain names, resource records, authoritative servers and resolvers.

In context: A resolver obtains records needed to find the destination for a booking-service name.

One domain name need not correspond to one website or one IP address.

Reasonable conduct expected under comparable circumstances and levels of competence.

In context: A responsible administrator checks that a sensitive change has appropriate safeguards.

This is not a universal rule that care occurs only after diligence.

Prudent and thorough investigation, analysis or review relevant to a decision or responsibility.

In context: Before relying on a service provider, investigate its capabilities and the evidence supporting its claims.

This is not a universal before-and-after timeline or a substitute for legal advice.

Testing a running application to examine its behaviour and possible security weaknesses.

In context: Observe how a running test application responds to authorized test conditions.

The glossary describes the concept; no live testing or unapproved target is assigned.

The extent to which intended results are achieved.

In context: Check whether the access-approval process actually prevents unauthorized exports.

A completed activity is not automatically an effective control.

The relationship between results achieved and resources used.

In context: Compare the staff effort required by two approaches that achieve the intended approval outcome.

Using fewer resources alone does not prove effectiveness.

In the selected NIST incident-response usage, involving a higher level of management in response efforts.

In context: A decision requiring higher management authority is elevated while specialists are added through escalation.

NIST SP 800-61r3 distinguishes this from escalation in RS.MA-04. Local plans can use different terms; verify actual roles and authority.

Computing integrated into a device for particular functions.

In context: A controller inside equipment performs a defined operational task.

Embedded systems, IoT and ICS can overlap, but they are not synonyms.

Adding the relevant protocol information as data moves through a network stack.

In context: An application message is carried within transport and network protocol structures.

This is a conceptual introduction, not a packet-analysis or fragmentation lesson.

Transforming readable information into ciphertext that can be recovered through an appropriate cryptographic process and key.

In context: Protect a sensitive export in the defined storage or transfer context.

Encryption does not authorize disclosure to the receiving party or secure every endpoint.

Supplier lifecycle milestones concerning a product's retirement or the end of relevant support or maintenance.

In context: An important unsupported application triggers a replacement or exception decision.

These milestones are not universally identical. Verify the product, supplier terminology and actual support arrangement.

In the selected NIST incident-response usage, escalation generally increases response resources or adjusts time frames; involving higher management is distinguished as elevation.

In context: Request specialist response capacity through escalation; involve the necessary higher management through elevation.

This is the terminology of NIST SP 800-61r3, RS.MA-04. Other organizations can use different labels; follow the actual plan and authority arrangements.

Judging information or results against criteria or objectives.

In context: Compare verified recovery results with the agreed recovery target.

This general use differs from merely measuring a value; exact ISO performance-evaluation requirements remain open.

A failure by a test or detection process to identify a relevant condition that is actually present.

In context: A scan misses an existing weakness.

One clean result does not prove the absence of weaknesses.

A test or detection result that incorrectly indicates its target condition is present.

In context: A scan reports a weakness that is not present, or a detector classifies benign activity as malicious.

The underlying event may be real even when its classification is wrong. Interpret the term in the actual test or detection context; findings need validation.

A mechanism that enforces a policy on network communications.

In context: A rule permits a required application path and blocks unapproved paths.

Capabilities vary: packet, session, application-aware and host application controls are not identical.

An audit conducted by or on behalf of the organization itself.

In context: An external consultant can conduct the studio's internal audit on its behalf.

The auditor's employment status alone does not determine the party category; competence and impartiality still matter.

An organized structure for reasoning about and coordinating a subject or set of outcomes.

In context: The NIST CSF helps organize cybersecurity outcomes and discussions.

A framework is not automatically a law, a certification or a complete implementation recipe.

AI models that learn characteristics of input data and use them to produce derived synthetic content, such as text, images, audio or video.

In context: An application generates a draft booking reply or an image.

Not all generative models are language models, and plausible output is not verified evidence. The source is conceptual; model design and implementation are not taught here.

Direction, accountability and oversight that guide organizational decisions and activities.

In context: Leadership sets security priorities, assigns responsibilities and reviews results.

Related work that connects direction and oversight, decisions under uncertainty, and applicable obligations.

In context: A security decision should have an accountable owner, a risk rationale and awareness of relevant requirements.

These functions are related but are not interchangeable.

The physical parts of a computing system.

In context: A laptop, storage device and network switch are hardware.

A composition of two or more distinct cloud infrastructures that remain unique entities but are bound by technology enabling data and application portability.

In context: An organization binds distinct private and public clouds so data and applications can move between them.

The actual responsibilities and trust boundaries still need examination.

Updated to the cited NIST portability definition; integration alone is insufficient.

Coordinating identities and their access through definition, provisioning, review and removal.

In context: Manage human, administrator and service access as responsibilities and roles change.

A defined set of duties and authorized activities used to decide what access an identity needs.

In context: Reception duties justify scheduling permissions; they do not automatically justify system administration.

A job role and a product's RBAC role need not be identical. Duties, approval, access fulfilment and review must be connected in the actual process.

The effect an event or condition could have on relevant objectives.

In context: Losing booking access could interrupt appointments and delay revenue.

Impact describes effects in the chosen scenario and assessment method. Do not assume that every formal vocabulary uses impact and consequence identically or that one universal scale applies.

In the selected NIST context, an occurrence that actually or imminently endangers information or system confidentiality, integrity or availability without lawful authority, or violates or imminently threatens relevant law, policy or procedure.

In context: A confirmed account takeover differs from an unexplained login anomaly that still needs investigation.

NIST cites a US statutory definition here; do not treat this paraphrase as a universal legal test or the exact ISO definition. Establish organizational criteria. An event or alert is not automatically an incident.

Coordinated work to detect, respond to and recover from cybersecurity incidents, supported by wider preparation and continual improvement.

In context: In the selected NIST model, Govern, Identify and Protect support preparation; Detect, Respond and Recover organize incident-response work.

The selected current reference is NIST SP 800-61r3 integrated with CSF 2.0. Its model is not a universal mandatory sequence. The superseded r2 lifecycle is not presented as the current NIST model.

Documented arrangements for coordinating how an organization handles security incidents, including relevant responsibilities, authority and communications.

In context: A plan identifies who can authorize an urgent service shutdown and how response participants coordinate.

This is an introductory synthesis, not a complete plan template or the full data-handling-policy implementation required by CC 5.3. The actual plan, decision criteria, evidence handling and exercises remain to be learned and assessed.

A control-system context within operational technology used to monitor or control industrial processes.

In context: A plant's control system affects physical operations.

Safety, reliability and performance can constrain security decisions.

Data understood in a meaningful context.

In context: The number 14 becomes useful when it means fourteen appointments tomorrow.

Protecting information and systems against unauthorized access, use, disclosure, disruption, modification or destruction to preserve confidentiality, integrity and availability.

In context: Protect booking records from inappropriate disclosure, incorrect changes and loss of required access.

This is a conceptual paraphrase of the selected NIST meaning. Appropriate protection also depends on organizational context, privacy duties and risk decisions.

Linked policies, objectives, responsibilities, processes, resources and review used to direct and control information security.

In context: A studio connects its access rules, risk decisions, operating work and improvement process.

An ISMS is broader than a product, a document set, an IT department or a certificate.

A cloud service model offering fundamental computing resources on which a consumer deploys software.

In context: A consumer manages its deployed operating systems and applications on provider infrastructure.

The actual offering and contract determine detailed responsibilities.

Potential harm associated with people who have relevant internal access or knowledge.

In context: A trusted person's access may be misused, and internal mistakes can also cause harm.

Do not treat all insiders as malicious or all incidents as deliberate acts.

Preserving information's accuracy and completeness, including protection against accidental or unauthorized changes.

In context: An accidental edit to appointment dates can harm integrity even without an attacker.

A recurring process for directing, collecting, processing, analysing and disseminating intelligence.

In context: A decision need shapes collection, analysis and the product supplied to an audience.

Different sources use different phase labels and intelligence-type taxonomies.

A person or organization that can influence a decision or activity, be affected by it, or consider itself affected by it.

In context: Clients, staff, suppliers and authorities may have relevant requirements or expectations.

This is a paraphrase of a stable shared term in the saved TC176 list, attributed there to ISO 9000:2015. Determining relevant parties and applicable ISMS requirements still needs the current PECB course or legitimate standard.

Connected devices that combine sensing or actuation with computing and communication functions.

In context: A connected environmental sensor sends readings to another service.

Not every embedded system is an industrial control system.

The network protocol family supporting addressing and delivery of packets between networks.

In context: A system uses an IP destination to send traffic toward another network.

IP addressing is different from a domain name, an account or an application permission.

A model describing link, internet, transport and application responsibilities.

In context: TCP has a transport role; DNS has an application role.

Models organize functions; real products do not have to implement separate visible pieces for every layer.

The IP version with 32-bit addresses.

In context: Interpret an address together with its actual prefix and network context.

Do not assume old classful network defaults.

The IP version with 128-bit addresses.

In context: IPv6 provides a larger address space than IPv4.

Using IPv6 does not automatically encrypt or secure all traffic.

The selected first cybersecurity credential in this study route.

In context: Use the current CC outline and its official AI applications alongside the saved foundational teaching.

Credential fees are separate from this FREE glossary. Course completion and exam readiness are not established by a mapped syllabus.

ISC2's professional ethics rules, whose four canons concern societal protection, responsible and lawful honesty, competent service to principals, and support for the profession.

In context: Use the actual preamble and canons to reason about a conflict between an instruction and professional responsibilities.

This is a short paraphrase, not the exact code. Read the issuer wording and practise new ethical cases; a generic organizational policy or PECB code is not a substitute. No acceptance is performed here.

The 2022 ISO 27001 requirements are organized through context, leadership, planning, support, operation, performance evaluation and improvement in clauses 4–10.

In context: Use the structure to connect an objective, its operating process, performance review and improvement.

OUTLINE ONLY — clause headings do not supply the requirements, required records, applicability decisions or full Annex A teaching. Those remain a selected PAID PECB course/authorized-text gap; licensed text access is conditional.

A requirements standard for a quality management system.

In context: The saved TC176/APG papers can introduce shared management-system concepts while retaining their quality-management context.

ROLE ONLY — these supplements do not supply ISO 27001 requirements. No separate purchase or mastery of an entire quality standard is prescribed for this route.

A requirements standard for a service management system.

In context: Distinguish service-management requirements from the ISMS requirements in ISO/IEC 27001.

ROLE ONLY — full text and a complete comparison of management-system standards are not saved. Do not purchase every mentioned standard automatically.

The 2026 overview standard describing information-security concepts, principles and relationships within the family.

In context: Use the current role note to distinguish the overview from requirements and control guidance.

The withdrawn 2018 edition's vocabulary role must not be represented as the purpose of the current edition. A newer publication does not automatically replace a dated exam or normative reference.

The selected 2022 ISMS requirements standard.

In context: An organization uses the relevant requirements to establish and operate its ISMS.

Full base text is not saved; public overviews do not reconstruct every requirement. Legitimate access may require payment unless provided through a course or library.

The 2022 information-security control-guidance standard.

In context: Consult authorized guidance to understand relevant control implementation considerations.

The full text is not saved; access is conditional. It is not a separate organizational ISMS requirements certificate.

Implementation guidance whose saved 2017 edition explains the requirements of ISO/IEC 27001:2013.

In context: Recognize its relationship to the standards family without importing old clause explanations as current 2022 teaching.

ROLE ONLY — the 2013-based implementation discussion is not assigned as current 2022 guidance. Full text is not saved. Confirm the official course's required editions and legitimate access before any conditional purchase.

The 2022 information-security risk-management guidance standard.

In context: Use appropriate guidance to deepen ISO-specific risk reasoning.

The full text is not saved; access is conditional. The selected NIST examples do not substitute for all ISO-specific teaching.

An indicator used to understand the operation of a control.

In context: A team tracks whether required access reviews were completed and exceptions resolved.

Indicator labels and boundaries vary across organizations.

An indicator used to track performance in relation to an objective.

In context: Track progress against an agreed training or response objective.

Completion numbers alone do not establish the desired business outcome.

An indicator used to monitor risk and relevant tolerance or exposure.

In context: An increasing count of important unsupported assets prompts a risk review.

One indicator cannot predict every incident.

A marker associated with information to communicate a classification or handling expectation.

In context: A booking export carries an internal-use label.

A label may communicate a rule without technically enforcing it; product behaviour must be checked.

A language model built using deep-learning methods and trained on very large text datasets.

In context: A language-based assistant uses an LLM to draft text.

Only the first sentence of the selected NIST LLM bullet supports this introduction; its later two-type taxonomy, training generalizations and fire-service recommendations are unassigned. An LLM is not the whole surrounding application or every kind of generative AI.

Direction and support through decisions, responsibilities and resources that enable the management system to work.

In context: Management assigns responsibility and supports follow-up on security findings.

A signed policy alone does not demonstrate every leadership duty.

Giving only the access needed for an authorized task and context.

In context: A receptionist can schedule appointments without receiving system-administration privileges.

An assessment of how possible or probable an event or outcome is within stated conditions.

In context: A risk analysis states a time horizon, assumptions and evidence for its likelihood judgment.

A label such as high is not automatically a measured probability.

A record of relevant events or activity in a system or service.

In context: A record shows when an account requested an export.

Completeness, time context, protection and availability affect its usefulness.

Computer methods that learn from data and adapt model behaviour for a task, often with the aim of improving performance.

In context: A model learns patterns used to classify incoming requests.

The NIST term-definition pair is attributed to SP 800-55v1. Learning is a method and goal; improvement, correctness, fairness and safe use in a new context are not guaranteed.

Software intended to harm systems, information or their users.

In context: An organization protects systems from harmful software and checks relevant observations.

The definition does not supply a complete malware taxonomy, analysis course or prevention guarantee.

Management's evaluation of suitable evidence to make decisions about the management system, changes, improvement and resources.

In context: Review performance and findings, then record decisions, owners and follow-up.

Generic APG examples are not the full ISO 27001 input/output and record checklist; that teaching remains outstanding.

Linked organizational elements used to set direction and objectives and operate processes to achieve them.

In context: Policies, responsibilities, resources and review work together rather than remaining separate files.

Shared management-system concepts do not make ISO 9001 supplements ISO 27001 requirements.

Access control that enforces centrally defined policy and restricts subjects' discretion over permissions.

In context: A user cannot freely relax the centrally enforced access policy.

MAC here means mandatory access control; abbreviations can mean other things in other contexts. Central administration alone does not identify MAC: the distinguishing issue is mandatory enforcement that constrains subjects from changing or delegating permissions. Role and attribute mechanisms can implement mandatory policy.

The total business interruption that can be tolerated for the activity under consideration.

In context: A fictional studio sets an eight-hour total interruption limit.

This is a business limit, distinct from a resource recovery target; values must come from the actual context.

In the selected NIST usage, an objective, quantifiable value obtained through measurement.

In context: Eighteen of twenty in-scope accounts have the agreed configuration.

Interpret the collection method, scope and units. Other sources may use measure and metric differently.

A cloud characteristic in which resource use is monitored, controlled and reported through metering appropriate to the service.

In context: A service records consumption of storage or computing capacity.

Metered use is not automatically a security-effectiveness measure.

In the selected shared management-system vocabulary, a process for determining a value. NIST SP 800-55v1 uses the narrower sense of obtaining quantitative values by quantitative methods.

In context: Count verified in-scope accounts with the agreed configuration.

State which vocabulary applies. Determining a value does not by itself establish control effectiveness or the full ISO performance-evaluation requirements.

A process intended to make access to target data on storage media infeasible at the chosen level of effort.

In context: Choose and verify an appropriate clear, purge or destroy outcome for the medium.

Method choice depends on the medium, information and obligations; a delete command alone is not a universal answer.

In the selected NIST usage, a measure or assessment result designed to track progress against a target, support decisions and improve performance.

In context: Compare verified configuration coverage with the agreed target over time.

This is NIST SP 800-55v1 terminology, not a universal dictionary rule. A metric can use an assessment result; ninety percent configuration coverage does not mean ninety percent security.

Fine-grained separation and policy enforcement between workloads or resources.

In context: A workload is allowed to reach only its approved service dependencies.

Segmentation requires actual enforcement and appropriate rules.

A knowledge base that organizes observed adversary behaviour through tactics, techniques and related information.

In context: A defender uses a relevant technique description to reason about observed activity.

A mapping does not prove actor identity, successful detection or complete coverage.

A practice assessment intended to resemble some aspects of an exam.

In context: Use legitimate current practice to find gaps and learn from feedback.

GAP — no complete fresh current CC or PECB mock with a verified key and explanations is saved. Payment for an extra bank is conditional, not automatic, and a mock is not an invented formal credential requirement.

In the selected NIST context, direct adversarial manipulation of a model or its updates during training.

In context: A conceptual case involves deliberately modified model updates rather than only altered training examples.

The term is used within the selected source's scope; data-integrity checks alone do not prevent every poisoning path.

Determining the status of a system, process or activity.

In context: Check whether agreed actions are on track and whether relevant conditions have changed.

Security monitoring is a more specific use of observation in the security context.

Authentication using more than one distinct factor type.

In context: A password and an appropriately implemented possession factor can form MFA.

Not all MFA is phishing-resistant.

Connected systems that can exchange information.

In context: Office devices and a hosted service communicate through several linked networks.

Dividing networks or resources into zones with controlled communications between them.

In context: Separate an exposed service from internal business records.

A diagram alone does not establish isolation.

An identity representing a non-person entity, such as a software workload, automated service or device.

In context: An automated booking assistant has an accountable owner and only approved permissions.

Software, service and automation identities are examples. Their ownership and authentication mechanisms vary; human MFA concepts do not prescribe one mechanism for every unattended service.

Evidence that helps counter a later denial of an action or origin.

In context: A properly verified digital signature can support evidence that a particular signing key was used.

Identity binding, key protection and the evidence context matter; no unconditional legal outcome is promised.

Failure to meet a requirement.

In context: A verified transaction has one approval when the applicable rule requires two.

A defensible finding links the applicable requirement, verified evidence and specific failure. A vulnerability or incident is not automatically a nonconformity.

A result to be achieved, connected to organizational needs and a way to evaluate progress.

In context: Improve a defined export-control outcome rather than merely count training sessions.

The exact ISO objective-planning requirements remain with the current course or legitimate standard.

Information supporting the existence or truth of a matter through relevant facts or verification.

In context: A verified access record supports a finding about what permissions were present.

An unsupported opinion or plausible AI output is not automatically verified evidence.

A cloud characteristic allowing a consumer to provision capabilities as needed without routine human interaction with the provider.

In context: An approved user requests additional computing capacity through a service interface.

Self-service still needs authorization and governance.

Software that manages a computer's resources and provides services for applications.

In context: The operating system manages memory, files and processes used by the booking application.

Performing and controlling the planned processes as recurring work.

In context: Run approved access, change, review and risk-treatment activities and retain suitable evidence.

Designing a process is different from demonstrating that it operates; exact requirements need fuller teaching.

Programmable systems or devices that interact with or manage physical processes.

In context: A control system changes how physical equipment operates.

Physical consequences matter as well as information confidentiality.

The internal and external conditions relevant to the organization's objectives and management system.

In context: Service dependencies, contractual needs and operating conditions inform the ISMS boundary.

Full context requirements and amendment coverage need the current course or legitimate standard.

A seven-layer model: physical, data link, network, transport, session, presentation and application.

In context: Use the layers to distinguish signals, local links, routing, transport and application-related functions.

The model is an aid to reasoning; the excluded archived OSI explanation is not reinstated.

A unit of information carried through a packet-based network, with protocol context and payload.

In context: A larger application exchange is carried through network packets.

Packets are not all the same size.

A secret value used as knowledge-based authentication evidence.

In context: A system checks whether the submitted password matches the expected secret through its authentication mechanism.

The saved NIST password rules have a defined scope; do not treat them as universal EU law or a single rule for every system.

An update intended to correct or change software, including security weaknesses.

In context: A supplier releases an update affecting the booking application.

Downloading or installing it does not by itself prove the weakness has been effectively addressed.

Identifying affected assets and coordinating the planning, preparation, deployment, verification and monitoring of updates.

In context: Prioritize an important exposed service, plan deployment and confirm the result.

A single universal patch deadline is not supplied by the saved illustrative examples.

The selected second route leading to the PECB Certificate Holder in ISO/IEC 27001:2022 Foundation award under its requirements.

In context: Use the current handbook and complete the selected official course and activities.

PAID SELECTED ROUTE — official course and activities are not obtained or completed. Foundation is not Lead Auditor, Lead Implementer, organizational certification or a professional licence.

The syllabus labels high-level general, high-level specific and topic-specific used in the saved Foundation handbook.

In context: Recognize the three names without treating a different source's policy taxonomy as an exact substitute.

GAP — the handbook names these categories but does not teach their exact definitions, boundaries or examples. Learn those from the selected PAID PECB course; they are not invented here.

An authorized test examining exploitable paths within an agreed scope.

In context: A test investigates whether a defined access path can be abused.

It does not prove that no other weakness exists; scope and rules matter.

Measurable results of relevant activities or processes.

In context: Review how an access-review process and its intended results changed over a defined period.

A convenient activity count may not show the outcome that matters.

Deceptive communication intended to manipulate someone into revealing information or taking a harmful action.

In context: A message imitates a provider and asks a staff member to use a false login page.

A polished message, familiar name or AI-generated text does not establish authenticity.

An authentication protocol's ability to keep secrets and valid authentication responses from a fake verifier without depending on the user's alertness.

In context: A prompt for a second code does not automatically make a login phishing-resistant.

This is a bounded NIST concept, not a guarantee against every kind of phishing. Full mechanism and assurance teaching remains open.

A control involving physical access, equipment or the environment.

In context: A locked records room restricts physical access to paper files.

An iterative pattern: plan objectives and approach, perform the work, evaluate results, and act to improve.

In context: Plan an export process, operate it, check results and adjust it.

It is not a one-time project or a complete normative clause-by-clause map.

A cloud service model in which a consumer deploys applications using supported platform capabilities while the provider manages underlying infrastructure.

In context: A team deploys an application to a managed runtime.

The customer still makes important application, identity and data decisions.

A statement of organizational direction and expectations.

In context: A policy sets the expectation that sensitive exports require protection and approval.

The general concept does not supply PECB's precise policy-category definitions.

The continuing development, communication, use and review of a policy as circumstances change.

In context: An owner reviews a changed operating need, updates the approved policy and communicates the current expectation.

INTRODUCTION ONLY — no universal mandatory stage list is implied. Exact PECB policy development/review teaching and its policy-category definitions remain with the selected PAID official course.

A transport endpoint identifier within the relevant protocol context.

In context: A service listens on a transport port at a host address.

A familiar port number does not prove which application is running or whether its traffic is safe.

Cryptography intended to resist attacks using classical computers and sufficiently capable quantum computers.

In context: A migration discussion asks which cryptographic uses may require future replacement.

The saved introduction is not an algorithm list or migration plan, and quantum risk does not affect every primitive equally.

The property that makes finding an input matching a given hash output computationally difficult.

In context: Given a digest, finding an input with that digest should be difficult.

Appropriate handling of information about people, including the purpose, limits and conditions of that handling.

In context: Keeping a client record secret does not by itself justify collecting it or retaining it indefinitely.

The saved EU/EEA example is introductory; applicable legal duties need current contextual sources.

Cloud infrastructure for the exclusive use of one organization.

In context: An organization uses a cloud dedicated to its own needs.

Private does not automatically mean on-premises, complete customer control or superior security.

The secret member of an asymmetric key pair.

In context: A signing key must be protected from unauthorized use.

Sharing a private signing key can weaken individual origin and accountability claims.

Authority to perform a particular action or set of actions in a system.

In context: Permission to change account settings gives more power than permission to read a booking.

Instructions describing how to carry out an activity.

In context: An export procedure explains the approval, protection, transfer and recording steps.

Principles governing responsible professional conduct and judgment.

In context: Represent your competence honestly and keep security claims proportional to the available evidence.

ISC2 and PECB have distinct codes and credential processes; reading this glossary does not accept either code.

Creating or enabling the identity/account arrangements and approved access needed for an authorized task.

In context: Approved reception access is granted when a person starts the relevant duties.

Creating an account is not by itself approval for every permission. The product workflow, identity binding and evidence need separate checks.

Cloud infrastructure made available for use by the general public under the provider's offering.

In context: Organizations subscribe to a provider's generally available cloud services.

Public cloud does not mean that every customer's data is public.

The shareable member of an asymmetric key pair used for the relevant public-key operation.

In context: A recipient uses a public verification key whose binding is suitably trusted.

Shareable does not mean that any supplied key is authentic.

In NIST media sanitization, making target-data recovery infeasible with advanced laboratory techniques while potentially allowing the medium to be reused.

In context: A supported purge method is chosen for a reusable storage device.

Purge is not a paper-media method, and logical or virtual-storage limitations matter.

Collaborative work between adversarial testers and defenders to learn and improve.

In context: Testers and defenders jointly examine how a permitted scenario was detected.

It is an arrangement or function, not a requirement to employ a third department.

Assessment using descriptive categories and reasoned judgments.

In context: A team uses low, medium and high categories with defined meanings.

Assessment using meaningful numerical estimates, units and assumptions.

In context: A loss estimate states its currency, period, evidence and uncertainty.

Assigning the number 3 to high risk is not enough to make the assessment quantitative.

A cloud characteristic allowing capabilities to expand and contract in response to demand.

In context: Capacity changes as demand for a hosted application changes.

Elasticity does not remove the need for limits, configuration and cost oversight.

Retained information providing evidence of activity or results.

In context: An approval record shows what was authorized, by whom and when.

Instructions explaining what to do are different from evidence that it was done.

The target point before disruption to which information should be recoverable, expressing a tolerable data-loss window.

In context: A one-hour RPO requires the intended recovery point to be no more than an hour before the interruption.

An RPO is a target, not proof of actual data loss or backup success.

The target time within which a resource or service should be restored after disruption.

In context: A four-hour RTO is missed when the required usable service returns after five hours.

Allow for business reprocessing and dependencies; an RTO is normally shorter than the total tolerable downtime.

An adversarial exercise function used to test agreed objectives and defensive capabilities.

In context: A team follows an authorized scenario under defined rules.

The label grants no permission to test another organization.

Additional components or capacity intended to reduce dependence on a single component.

In context: A second connection may support service when the first connection fails.

Shared failure causes can defeat redundancy; redundancy is different from backup and proven recovery.

A communication presenting relevant results, interpretation and matters for decision or action.

In context: A security report explains a trend, its evidence and limits, and who should act.

A table of numbers alone may not answer the decision question. Full reporting requirements and independently marked interpretation cases remain outside this entry.

Risk that remains after a response or treatment.

In context: MFA may reduce account-takeover exposure while some recovery and human-process risks remain.

Treatment does not guarantee elimination.

A cloud characteristic in which provider resources are pooled to serve multiple consumers according to demand.

In context: Underlying capacity is allocated and reassigned as required.

The implementation still needs appropriate isolation and access controls.

People, time, knowledge, tools and other support needed to carry out intended work.

In context: Provide appropriate staff capability and time for access reviews.

Generic QMS examples do not prescribe the full ISO 27001 support requirements.

Keeping information for a justified period under applicable business and other requirements.

In context: Define how long a booking record is needed and when its disposition should be reviewed.

There is no universal retention period in this glossary; preservation obligations can affect disposal.

Removing or invalidating access that is no longer approved.

In context: Departure handling may require permission removal and separate actions on active sessions and tokens.

Disabling one account does not prove that all access everywhere stops immediately.

Uncertainty about consequences for objectives; security risk is commonly considered through likelihood and impact in context.

In context: A deceptive login message could lead to account takeover, disclosure and service disruption.

No single scoring formula is universal.

An authorized decision to retain a risk in the relevant context.

In context: An accountable decision-maker accepts a documented residual exposure with a reason and review conditions.

Exact ISO approval and acceptance requirements remain in the current course or licensed standard.

Developing an understanding of likelihood, consequences and relevant uncertainty.

In context: Examine how an account could be compromised and what the resulting disruption might be.

Analysis is one part of risk assessment.

The broader work of identifying, analysing and evaluating risk.

In context: Describe the scenario, understand it and compare the result with relevant decision criteria.

Do not substitute risk analysis for every assessment activity; exact methods vary.

The reference points used to evaluate the significance or acceptability of risk.

In context: An organization defines which service impacts require escalation.

The glossary does not provide a complete ISO criteria or acceptance framework.

Comparing analysed risk with criteria to inform priorities and decisions.

In context: Compare the assessed booking-service disruption with the organization's tolerance for interruption.

It is different from identifying the scenario or estimating its likelihood.

Describing what might happen, to what, and with what possible consequences.

In context: Identify a booking-export scenario involving an inappropriate recipient.

Recurring work that sets context, identifies and understands risk, prioritizes decisions, responds and monitors or adjusts the result.

In context: A completed risk response becomes part of the context for the next review.

The saved NIST sequence is a notional example, not a universal formula or the complete ISO/PECB risk process. Method selection, criteria, treatment records and applied assessment remain incomplete.

The person or role accountable for managing a particular risk in its organizational context.

In context: A service manager owns the recorded service-interruption risk and follows up its agreed actions.

An action owner and a risk owner may have different responsibilities.

A maintained record of risk scenarios, owners, reasoning, actions, status and review information.

In context: A register connects an account-takeover scenario to its response and the remaining exposure.

A populated spreadsheet alone does not establish sound risk management.

A decision and associated action intended to change or retain exposure, such as avoiding, reducing, sharing or accepting it.

In context: Choose access controls and recovery arrangements, assign actions and review what remains.

Terminology and required approvals vary. Sharing or insurance does not remove every responsibility or risk.

A description connecting an objective or asset, an event, relevant weaknesses or conditions, and consequences.

In context: A reused password and unsuitable authentication expose a booking account to takeover and disruption.

The word phishing by itself is not a complete scenario.

A plan connecting selected risk responses with implementation responsibilities and follow-up.

In context: Record the agreed access changes, owner, implementation status and review of remaining exposure.

This introduction does not supply the complete required ISO contents, approvals or records.

Grouping permissions by roles and assigning identities to suitable roles.

In context: The receptionist role grants the tasks needed for reception work.

Review role membership and accumulated permissions as duties change.

Agreed authorization and boundaries for a test or exercise, including scope, exclusions, contacts, timing, stop conditions, evidence and reporting.

In context: A paper plan states which fictional systems are in scope and when activity must stop.

No real test is authorized by this glossary.

The defined boundaries and applicability of the ISMS.

In context: State which service, locations, activities and dependencies the proposed ISMS covers.

This orientation is not the full ISO scope-setting checklist or a reviewed scope for a real organization.

A structured summary comparing results with objectives, criteria or targets.

In context: A scorecard compares observed review results with an agreed objective and explains exceptions.

This is a general editorial distinction used in the guide. Dashboard, scorecard and report labels overlap in practice; no universal product taxonomy or complete reporting lesson is claimed.

An audit by an interested party, such as a customer, or someone acting on its behalf.

In context: A customer audits a supplier's relevant processes.

The commercial relationship and audit purpose matter, rather than whether the auditor is physically outside the organization.

The property that makes finding a different input with the same digest as a particular given input computationally difficult.

In context: Given one document, finding another document with its digest should be difficult.

This differs from finding any pair of colliding inputs.

Understanding relevant security expectations, risks and one's contribution to protection.

In context: A staff member knows how and where to report a suspicious request.

Awareness is different from demonstrated competence.

Shared expectations and behaviours that influence how people handle security in practice.

In context: Leadership makes it practical to report mistakes and learn from them.

An observable computing occurrence with security relevance or implications.

In context: A login attempt, software update or application request can be an event without being an incident.

NIST separates events, adverse events and incidents. Negative consequences or an alert need analysis; they do not automatically establish a cybersecurity incident.

Capabilities that collect and help analyse security information and events for detection, investigation and reporting.

In context: An analyst reviews related observations from several systems.

Not every SIEM uses AI, and a SIEM does not guarantee that all incidents will be detected.

Observing and reviewing information to understand activity or detect conditions needing attention.

In context: Review relevant logs and alerts for suspicious account use.

Collecting records and interpreting them are different tasks.

Assessment using numbers to express ordered categories rather than fully measured quantities.

In context: A score of 4 represents a higher category than 2.

It does not follow that 4 represents twice the risk of 2.

Dividing conflicting responsibilities to reduce inappropriate end-to-end control by one person.

In context: The person requesting a refund does not alone approve and reconcile it.

Allocation of security and operational tasks between a service provider and customer.

In context: The provider operates some infrastructure while the customer controls its data, identities and selected configurations.

Determine the actual division from the service and contract; an AI SaaS customer may not own the model weights.

An arrangement that lets an authenticated identity access multiple services without independently signing in to each in the usual way.

In context: A staff member uses an organizational sign-in to reach several applications.

SSO does not guarantee immediate revocation of all sessions and tokens.

Manipulating people or social processes to obtain access, information or another advantage.

In context: An impostor pressures a receptionist to bypass an approval check.

A system understood through its people, organizational practices, data and technology together.

In context: An assistant's risks depend on who uses it, which records it receives and how staff check its output.

A model capability claim alone is not a demonstrated business or control outcome.

Computer programs and associated instructions or data used by a computing system to perform tasks.

In context: An operating system and a booking application are different kinds of software.

Software may include associated data. In these introductory comparisons, ordinary invoice records are user data and the application is the software; this is not a universal exclusion of all data from software.

A cloud service model in which a consumer uses the provider's application running on cloud infrastructure.

In context: Staff use a hosted booking application rather than deploying its underlying software themselves.

Using SaaS does not remove customer responsibilities for appropriate data and access decisions.

In an internal document hierarchy, a specific requirement supporting policy; in formal standardization, an agreed reference document.

In context: An internal standard may specify approved protection requirements. ISO/IEC 27001 is a published requirements standard.

These are different uses of the word; identify the context.

A document connecting an organization's control choices with their justification and status in the ISMS and risk-treatment context.

In context: Explain why relevant controls are selected and how their implementation is understood.

It is not a copied technology list. Full required contents, Annex A comparison and justification rules still need authorized teaching; full text is not saved.

Examining code or related artifacts without executing the target application to look for security problems.

In context: A reviewer or tool examines application code for a relevant weakness.

Static and dynamic testing have different visibility and limitations.

Cryptographic mechanisms using shared secret key material.

In context: Appropriate shared key material is used in a symmetric encryption and decryption process.

Distributing and protecting the secret is part of the security problem.

A discussion exercise in which participants work through a scenario and its decisions.

In context: Staff discuss who authorizes a booking-service shutdown and how customers would be informed.

A discussion exercise is not a live attack, a full technical recovery test or proof of readiness.

In ATT&CK, the adversary's purpose or tactical objective for an action.

In context: Ask why the adversary performs a step.

Interpret the term within the ATT&CK context.

A control implemented through technology.

In context: An access restriction enforced by an application is a technical control.

Technology still depends on appropriate configuration, operation and review.

In ATT&CK, a way an adversary works toward a tactical objective.

In context: Ask how the adversary performs the action.

A technique label is different from a particular actor attribution.

An audit by an independent auditing organization, such as a certification body or governmental agency.

In context: An independent certification body assesses the studio's ISMS.

Third party describes the relationship and purpose, not a personal Foundation credential.

A possible cause of harm to an asset or objective.

In context: A deceptive login attempt can threaten a booking account.

A threat is different from a vulnerability and from the whole risk scenario.

An individual or group associated with potentially harmful cyber activity.

In context: Common motivation categories include criminal, state, ideological and malicious-insider interests.

Motives can overlap; a category does not establish who performed a particular attack.

Structured reasoning about what is being built, what can go wrong, appropriate responses and how to check them.

In context: Map an export flow, its boundaries, possible failures and the controls to examine.

A scanner run or a long list of attack names is not a complete threat model.

Learning activities intended to develop knowledge or skills for tasks.

In context: A staff member practises using the approved export procedure.

Attendance alone is not proof that the person can perform the task.

A transport protocol providing an ordered, reliable byte stream between endpoints.

In context: An application can use TCP's delivery and ordering service.

Transport reliability is different from confidentiality or application correctness.

Validating and prioritizing observations or incidents for further handling according to context and risk.

In context: Investigate an important privileged-account alert before a lower-impact routine event.

Triage is not simply first-in-first-out processing.

A datagram transport protocol that does not itself provide TCP's ordered reliable byte-stream guarantees.

In context: An application using UDP must account for the delivery properties it needs.

Absence of TCP's guarantees does not by itself mean an application is unsuitable.

A logical division of a local network.

In context: Different device groups are placed in distinct logical network segments.

A VLAN is not encryption and is not sufficient evidence that all relevant paths are isolated.

A mechanism providing a protected tunnel across an otherwise less trusted path between defined endpoints.

In context: A staff device establishes an approved tunnel to an organizational gateway.

Protection is bounded by the tunnel, routes and endpoints; a VPN does not guarantee anonymity or safe handling after decryption.

A weakness or condition that can be exploited or contribute to harm.

In context: An exposed service with an uncorrected weakness may be vulnerable.

Not every weakness has already caused an incident.

A test that looks for possible weaknesses and produces findings requiring interpretation.

In context: A scan flags a possible exposed software weakness.

Scans can report false positives and miss issues; findings need validation.

Wireless local-network technology whose security depends in part on the configured security mode.

In context: A Wi-Fi speed generation and a WPA security mode describe different properties.

The saved reading is a conceptual overview, not a configuration or device-compatibility guarantee.

Wi-Fi security-mode families with Personal and Enterprise forms and additional configurations.

In context: WPA3 Personal and WPA3 Enterprise are distinct modes, not speed generations.

Learn the saved supported/deprecated mode list in its scope. Legacy WEP, TKIP and old WPA modes are excluded as current recommendations.

An approach that grants no implicit trust merely because of network location or ownership.

In context: Access decisions consider the requested resource and relevant identity and context.

It is an architectural approach, not a single product or a promise that all risk disappears.