Glossary
The terms, without the fog
Short, honest definitions of what gets used every day in audit, compliance and incident response.
A
C
-
Chain of custody
The continuous trail that demonstrates a piece of evidence came from where it is claimed to and was not altered at any point along the way.
See the definition -
Control exception
A formal, temporary and documented authorisation to operate without meeting a specific control, with reason, owner and expiry date.
See the definition -
CVSS
A standard for describing and scoring the intrinsic characteristics of a vulnerability, from 0 to 10, independently of where it is installed.
See the definition
E
-
EPSS
A statistical model that estimates the probability of a specific vulnerability being exploited in the wild over the next thirty days.
See the definition -
Evidence
An artefact that lets a third party who was not present verify that a control ran, when, over what scope, and without later alteration.
See the definition -
External attack surface
The set of an organisation's assets and services reachable from the internet without prior credentials.
See the definition
F
-
False positive
A finding reported by a tool or an analyst that, checked against the real system, does not correspond to an exploitable vulnerability.
See the definition -
Finding deduplication
Recognising that several results from different sources or campaigns describe the same problem, and treating them as a single entity.
See the definition
G
I
M
P
R
-
Remediation plan
A document assigning every open finding an owner, a concrete action and a committed date, and recording its verified closure.
See the definition -
Retest
Re-running the original reproduction steps for a specific finding after it has been fixed, to verify whether it is still exploitable.
See the definition -
Risk appetite
The level of risk management declares it is willing to accept in pursuit of its objectives, expressed so that concrete cases can be decided against it.
See the definition
S
-
Security posture
The measurable state of an organisation's controls at a given moment, as against what its policies declare.
See the definition -
Service level agreement
A contractual commitment on measurable service parameters, with a defined measurement method and declared consequences for missing them.
See the definition -
Statement of Applicability
A signed document recording, control by control, which apply to the system, which do not, and on what justification.
See the definition -
Supplier criticality
The classification that decides how much assessment depth and monitoring a third party warrants, based on the damage its failure would cause.
See the definition
Want to see it on your own data?
The proof of concept stands up an environment with your real scope. No cost, no commitment to continue.