Acceptable use policy (AUP)
A policy that defines permitted and prohibited use of an organization’s systems, networks, and data.
CISSP Knowledge Base
CISSP Exam Glossary
Master the terminology you need to prepare for the CISSP exam. Clear, practical definitions for complex security concepts.
A
Access control
The process of allowing, limiting, or denying access to resources based on defined rules.
Accountability
The ability to trace an action to the individual or entity responsible for it.
ALE
Annualized Loss Expectancy: the expected yearly financial loss from a specific risk.
Asset
Anything of value to an organization, including data, people, hardware, software, facilities, and reputation.
Asset classification
Assigning data or assets categories based on sensitivity, value, and required protection.
Attack surface
The total set of possible points where an attacker could attempt to enter, influence, or extract data from a system.
Availability
Ensuring authorized users have reliable, timely access to systems and data.
B
Bastion host
A hardened system placed in an exposed network location and used as a controlled entry point to more trusted systems.
Bell–LaPadula model
A confidentiality model that enforces “no read up” and “no write down” across security levels.
Biba model
An integrity model that enforces “no read down” and “no write up” to prevent contamination of higher-integrity information.
Business continuity plan (BCP)
Documented procedures for maintaining or restoring critical business functions during and after a disruption.
Business impact analysis (BIA)
A process that identifies critical processes and quantifies the impact of their interruption.
C
Certificate authority (CA)
A trusted entity that issues and manages digital certificates used to bind identities to public keys.
Chain of custody
Documentation that records who collected, handled, transferred, and stored evidence from collection through disposition.
Ciphertext
Data that has been transformed by encryption and is unreadable without the appropriate key.
Compensating control
An alternative safeguard that provides comparable protection when a primary control cannot be implemented.
Confidentiality
Preventing unauthorized disclosure of information.
Control
A safeguard or countermeasure used to modify risk.
Control objective
A desired security outcome that controls are intended to achieve.
Cryptographic hash
A one-way function that creates a fixed-length value used to verify data integrity.
D
Data controller
The party that determines why and how personal data is processed.
Data custodian
The person or team responsible for the day-to-day safeguarding, storage, and handling of data.
Data owner
The business role accountable for classifying information and defining its protection requirements.
Data processor
A party that processes personal data on behalf of a controller.
Data remanence
Residual representation of data that remains on media after normal deletion or reformatting.
Defense in depth
Using multiple complementary controls so that failure of one safeguard does not expose an asset.
Demilitarized zone (DMZ)
A network segment that separates public-facing services from the internal network.
Digital signature
A cryptographic mechanism that supports integrity, authentication, and nonrepudiation using a private key.
Disaster recovery plan (DRP)
A plan for restoring IT systems, data, and infrastructure after a disruptive event.
Due care
The reasonable actions a prudent organization takes to protect assets.
Due diligence
The ongoing investigation and verification that safeguards remain appropriate and effective.
E
EAL
Evaluation Assurance Level: a Common Criteria rating that describes the rigor of a product security evaluation.
Encapsulation
Wrapping data with protocol information as it moves down a networking stack for transmission.
Encryption
Transforming readable plaintext into ciphertext using an algorithm and key to preserve confidentiality.
Entropy
A measure of randomness or unpredictability, commonly used when evaluating key strength.
F
Federated identity
An arrangement in which one trusted identity provider authenticates users for multiple independent services.
Firewall
A device or software control that permits or blocks network traffic according to security rules.
G
Governance
The system by which an organization directs, controls, and monitors security activities to meet business objectives.
H
Hardware security module (HSM)
A dedicated device that securely generates, stores, and uses cryptographic keys.
I
Identity and access management (IAM)
The policies, processes, and technologies used to manage identities and control access to resources.
Incident response plan (IRP)
A documented approach for preparing for, detecting, containing, eradicating, and recovering from security incidents.
Integrity
Protecting the accuracy, completeness, and trustworthiness of information.
IPsec
A suite of protocols that protects IP traffic through authentication, integrity, and optional encryption at the network layer.
L
Least privilege
Granting only the access required to perform an assigned task.
Likelihood
The estimated probability that a threat event will occur or successfully exploit a vulnerability.
M
Mandatory access control (MAC)
An access-control model in which system-enforced labels and clearances determine access decisions.
Mantrap
A physical access-control space with two interlocking doors used to restrict entry to secure areas.
Mean time between failures (MTBF)
The average time a repairable system operates before failing.
Mean time to repair (MTTR)
The average time required to restore a failed system or component to operational status.
Multifactor authentication (MFA)
Authentication that requires evidence from two or more different factor categories, such as something known and something possessed.
N
Network segmentation
Dividing a network into smaller zones to limit access, reduce attack paths, and contain breaches.
Nonrepudiation
Assurance that a party cannot credibly deny having performed a specific action or transaction.
O
OAuth 2.0
An authorization framework that allows a client to obtain limited access to resources without receiving a user’s password.
One-time password (OTP)
A password that is valid for only one authentication attempt or a limited time period.
P
Penetration test
An authorized simulated attack used to identify and validate exploitable weaknesses.
Personally identifiable information (PII)
Information that can identify, distinguish, or be linked to a specific individual.
Phishing
A social-engineering attack that uses deceptive messages or sites to obtain information, credentials, or action from a target.
Plaintext
Readable, unencrypted data before encryption or after successful decryption.
Principle of least functionality
Configuring systems to provide only required services, ports, protocols, and features.
Privacy by design
Building privacy requirements and protective measures into systems and processes from the beginning.
Public key infrastructure (PKI)
The people, policies, hardware, software, and procedures used to create, manage, distribute, and revoke digital certificates.
R
Recovery point objective (RPO)
The maximum acceptable amount of data loss measured in time.
Recovery time objective (RTO)
The maximum acceptable time to restore a business process after disruption.
Residual risk
Risk remaining after controls have been applied.
Risk appetite
The amount and type of risk an organization is willing to pursue or retain.
Risk assessment
The process of identifying threats and vulnerabilities, evaluating likelihood and impact, and determining risk.
Risk treatment
The decision to avoid, mitigate, transfer, or accept a risk.
Role-based access control (RBAC)
An access-control model that assigns permissions to roles and assigns users to those roles.
S
Salt
Random data added to a password before hashing to make precomputed attacks more difficult.
Secure Software Development Life Cycle (SSDLC)
Integrating security activities and requirements throughout software planning, design, development, testing, deployment, and maintenance.
Security information and event management (SIEM)
A platform that collects, correlates, analyzes, and alerts on security logs and events.
Separation of duties
Dividing sensitive tasks among multiple people to reduce fraud, error, and abuse of privilege.
Single sign-on (SSO)
An authentication approach that lets a user access multiple related systems after signing in once.
SOC 2
An AICPA reporting framework that evaluates controls relevant to security, availability, processing integrity, confidentiality, and privacy.
Statement of applicability (SoA)
An ISO/IEC 27001 document that lists applicable controls and explains inclusions or exclusions.
T
Threat
A potential cause of an unwanted incident.
Threat modeling
A structured process for identifying assets, threats, attack paths, and mitigations during system design.
Tokenization
Replacing a sensitive data value with a non-sensitive token while storing the original value separately.
Transport Layer Security (TLS)
A protocol that provides confidentiality, integrity, and authentication for communications over a network.
Two-person control
A safeguard requiring two authorized people to complete a sensitive action or access a critical asset.
V
Vulnerability
A weakness that may be exploited by a threat.
Z
Zero trust
A security approach that continuously verifies access and does not grant trust solely because a user or device is inside a network boundary.