Technology, Cyber and Data

The terms

• Algorithmic Bias

  Algorithmic bias is a systematic error in an automated system that produces unfair results for certain people or groups, often because of skewed data, flawed design choices or the way outputs are used.

  Subdomain: AI Governance and Risk

• Chief Information Security Officer (CISO)

  The CISO is the senior executive accountable for an organisation's information security strategy, policies and programme, who reports on cyber risk to executives and the board.

  Subdomain: IT and Data Governance

• Cloud Governance

  Cloud governance is the set of policies, roles and checks that decide who may buy and use cloud services, how data and costs are controlled, and how security and legal duties are met.

  Subdomain: IT Resilience and Third-Party Risk

• Cyber Incident Response Plan

  A cyber incident response plan is a documented set of roles, steps and contacts that tells an organisation how to detect, contain, remove and recover from a cyber incident.

  Subdomain: Cyber Risk and Incident Response

• Cyber Supply Chain Risk Management Acronym: C-SCRM

  Cyber supply chain risk management is the practice of identifying and reducing the security risks that come from suppliers, software components, hardware and service providers an organisation depends on.

  Subdomain: IT Resilience and Third-Party Risk

• Cybersecurity Risk

  Cybersecurity risk is the potential for loss from attacks on, or failures of, information systems, including damage to data, operations, finances and reputation.

  Subdomain: Cyber Risk and Incident Response

• Data Classification

  Data classification is the practice of sorting information into categories by sensitivity and value, such as public, internal, confidential and restricted, so that each category gets matching handling and protection rules.

  Subdomain: IT and Data Governance

• Data Lineage

  Data lineage is a record of where a piece of data came from, what systems and transformations it passed through, and where it ends up, allowing any reported figure to be traced to source.

  Subdomain: IT and Data Governance

• Data Loss Prevention (DLP)

  Data loss prevention is a set of tools and rules that detect sensitive information and block or flag attempts to send it outside approved channels, whether by accident or on purpose.

  Subdomain: IT and Data Governance

• Data Minimisation

  Data minimisation is the principle of collecting and keeping only the personal data a stated purpose truly needs, in amounts no larger and for no longer than that purpose requires.

  Subdomain: Data Protection and Privacy

• Data Protection Impact Assessment (DPIA)

  A DPIA is a structured assessment, done before starting a new use of personal data, that identifies privacy risks to individuals and decides what safeguards are needed to reduce them.

  Subdomain: Data Protection and Privacy

• Data Retention Schedule

  A data retention schedule is a document listing each type of record or data the organisation holds, how long it must be kept, the reason, and what happens when that period ends.

  Subdomain: IT and Data Governance

• Disaster Recovery Testing

  Disaster recovery testing is the planned exercise of restoring systems and data from backups or alternate sites, to prove that recovery can meet its time and data-loss targets before a real failure.

  Subdomain: IT Resilience and Third-Party Risk

• End-User Computing (EUC) Risk

  End-user computing risk is the chance of errors, data loss or misuse arising from spreadsheets, macros, databases and small tools built and run by business staff outside formal IT development and control.

  Subdomain: IT and Data Governance

• Explainability

  Explainability is the ability to describe, in terms a person can follow, why an AI or statistical model produced a particular output or decision.

  Subdomain: AI Governance and Risk

• Identity and Access Management (IAM)

  Identity and access management is the set of processes and tools that establish who a user is, give them the right level of access to systems and data, and review and remove that access over time.

  Subdomain: Information Security Frameworks

• Incident Response

  Incident response is the organised process of detecting, assessing, containing and recovering from a security incident or operational disruption, and learning from it afterwards.

  Subdomain: Cyber Risk and Incident Response

• Information Security Risk Assessment

  An information security risk assessment is a structured exercise that identifies what information assets matter, what threats and weaknesses could harm them, and how likely and costly the harm would be.

  Subdomain: Information Security Frameworks

• Insider Threat

  An insider threat is the risk that someone with authorised access, such as an employee, contractor or partner, harms the organisation by misusing data, systems or premises, on purpose or by mistake.

  Subdomain: Cyber Risk and Incident Response

• IT Change Management

  IT change management is the controlled process for requesting, assessing, approving, testing, scheduling and recording changes to systems, so that updates do not cause outages, security gaps or unauthorised alterations.

  Subdomain: Information Security Frameworks

• IT Governance

  IT governance is the structure of decision rights, policies and oversight through which leaders direct technology so that it supports business strategy, delivers value, and keeps its risks within acceptable limits.

  Subdomain: IT Resilience and Third-Party Risk

• Model Inventory

  A model inventory is a central register of every model or AI system an organisation uses, recording its purpose, owner, status and risk rating so that none escapes review.

  Subdomain: AI Governance and Risk

• Post-Incident Review

  A post-incident review is a structured look back at a security or operational incident, after it is resolved, to establish what happened, why, how well the response worked and what must change.

  Subdomain: Cyber Risk and Incident Response

• Principle of Least Privilege

  Least privilege is the rule that every person, account or application gets the smallest set of permissions that lets it do its job, and keeps them only while the need lasts.

  Subdomain: Information Security Frameworks

• Privacy Notice

  A privacy notice is the statement an organisation gives people to explain what personal data it collects, why, how it is used and shared, how long it is kept, and what rights they have.

  Subdomain: Data Protection and Privacy

• Privileged Access Management (PAM)

  Privileged access management is the set of tools and rules that control, record and limit the use of powerful accounts, such as system administrators, database owners and service accounts.

  Subdomain: Information Security Frameworks

• Purpose Limitation

  Purpose limitation is the principle that personal data should be gathered for a clear, stated and lawful reason and not reused for something that does not fit that reason.

  Subdomain: Data Protection and Privacy

• Security Operations Centre (SOC)

  A security operations centre is a team, often with dedicated tools and premises, that monitors an organisation's systems around the clock, detects security events and starts the response.

  Subdomain: Cyber Risk and Incident Response

• Shadow IT

  Shadow IT is the use of apps, cloud services, devices or software by employees or teams without the knowledge or approval of the organisation's IT and security functions.

  Subdomain: IT and Data Governance

• Shared Responsibility Model

  The shared responsibility model divides security and compliance duties between a cloud provider and its customer, with the split depending on the service type, so that each knows what it must secure.

  Subdomain: IT Resilience and Third-Party Risk

• Single Point of Failure (SPOF)

  A single point of failure is any one component, person, supplier or process whose breakdown would stop an entire service or system because no backup or alternative route exists.

  Subdomain: IT Resilience and Third-Party Risk

• Social Engineering

  Social engineering is the manipulation of people, through deception, pressure or trust, into handing over information, access or money that they would not otherwise give to an attacker.

  Subdomain: Cyber Risk and Incident Response

• Training Data Governance

  Training data governance is the set of controls over where AI training data comes from, how good it is and whether it may lawfully be used, covering provenance, quality, consent and bias.

  Subdomain: AI Governance and Risk