Glossary

159 terms from Governance, Risk and Compliance, in plain words, each with the chapter that teaches it.

Search the glossary

A

accept: A treatment where the risk owner knowingly decides to live with a risk, usually because fixing it would cost more than the risk itself. The owner signs it and sets a review date, as Kettle & Crane's owners did for the warehouse flood.
acceptable use policy (AUP): A policy setting out what staff may and may not do with the company's computers, accounts, network and data. Every Kettle & Crane new starter signs it, and it warns that the company may monitor its systems.
annualized loss expectancy (ALE): The expected cost of a risk per year, averaged over many years: SLE x ARO. Kettle & Crane's ransomware risk is $20,000 x 0.2 = $4,000 a year, even though most years cost nothing.
annualized rate of occurrence (ARO): How many times a year an incident is expected to happen. Once every five years is 0.2, and the warehouse flood, once in 50 years, is 0.02.
anti-bribery: Laws and policies that forbid offering, giving or accepting something of value to improperly influence a decision. Jo's policy says not to pay a customs agent's $300 cash 'expediting fee' that comes with no receipt.
anti-money laundering (AML): Rules meant to catch money laundering, which is making money from crime look like it came from honest business. Warning signs include a café overpaying an invoice and asking for the refund to go to a different account.
assessment: A broader and usually less formal evaluation than an audit, often done to improve things rather than to prove them. It can be internal or external.
assessment types (risk): How often risks are assessed. One-time is for a single event, ad hoc is triggered by something such as attack news, recurring follows a schedule, and continuous runs all the time, usually through tools.
asset: Something of value to the business, such as the order database or a laptop. It is one of the three things a risk needs, along with a threat and a vulnerability.
asset value (AV): What an asset is worth to the business in dollars, counting the item, the work to replace it and lost sales. The file server ransomware case adds up to $40,000.
attestation: A formal written statement, signed by someone accountable, that something is true, such as controls being in place or a policy having been read. Examples are the owners signing the PCI AOC and staff signing the AUP each year.
Attestation of Compliance (AOC): The PCI DSS form in which a merchant's accountable people sign that they meet the standard. Kettle & Crane's owners sign one for the payment processor every January.
audit: A formal, independent check of whether an organization meets a set of criteria, such as a standard, a law or its own policies. It rests on evidence, never on someone's word alone.
audit charter: A document approved by the board or audit committee that sets up internal audit: its purpose, its authority to see any record, its independence and its scope. Kettle & Crane's charter lets Alex self-assess and has an outside firm audit every two years.
audit committee: A board committee, independent of management, that oversees financial reporting, audits, risk and compliance. Auditors report to it. At Kettle & Crane it is the owners and their outside accountant.
avoid: A treatment that stops the activity creating the risk, such as switching off Kettle & Crane's old, attacked blog. It is the only treatment that removes a risk completely.

B

benchmark: A published list of secure settings for one product. Adopting one is a governance decision. Kettle & Crane's Laptop Build Standard requires CIS Benchmark Level 1.
board of directors: A small group elected by a company's shareholders to set direction, hire the chief executive and answer for results, including security. At Kettle & Crane, the two owners play this part.
bug bounty program: A program that pays rewards to outsiders who report security flaws. A vulnerability disclosure policy offers thanks, not money.
business continuity: Keeping the business working during and after a crisis. Kettle & Crane's business continuity policy is approved by the owners.
business impact analysis (BIA): An analysis of how much it would hurt if each part of the business stopped, whatever the cause, and how fast it must come back. It lists critical functions, their dependencies and their recovery targets (MTD, RTO, RPO).
BYOD (bring your own device): Staff using their own phones or laptops for work. A BYOD policy sets the deal: Kettle & Crane protects its data in a work profile, and staff such as Priya keep their privacy.

C

CCPA (California Consumer Privacy Act): California's state privacy law. It gives residents rights over their personal data and requires answers to their requests within 45 days.
centralized governance: One group, usually at the head office, makes security decisions for the whole organization. Rules are the same everywhere, but decisions can be slow. Kettle & Crane is centralized.
change management policy: A high-level policy saying how changes to systems must be requested, approved and tested before they go live. It reduces the risk that an unplanned change causes an outage. Auditors often sample change tickets to check that each change was approved.
CIS Benchmark: A widely used published set of secure settings for a product, such as the one for Windows 11. Kettle & Crane's laptops must meet Level 1.
clean desk policy: A policy requiring sensitive papers and devices to be put away when nobody is at the desk: screens locked, printouts collected and desks cleared. It stops a visitor photographing the wholesale price list on Sam's desk.
compensating control: A different control that reduces the same risk when the normal rule can't be followed. The warehouse label printer can't use a second factor, so it gets its own network segment instead.
compliance: Following the laws, regulations, contracts and standards that apply to an organization, and being able to prove it. It is a minimum, not the same as being secure.
compliance reporting: Telling people about compliance status. Internal reporting goes to management and the owners. External reporting goes to regulators, partners such as the card processor, or customers.
conflict of interest: A situation where someone involved in a decision has a personal interest that could influence it, or seem to, such as Jo's family member owning bidder Ridgeline. It is handled by disclosing, stepping aside and recording.
contractual impacts: A consequence of non-compliance where partners end contracts, raise prices or refuse to renew, because their contracts require compliance.
control value: The yearly saving a control brings: ALE before − ALE after − the control's yearly cost. If it is positive, the control pays for itself; immutable backups score $4,000 − $800 − $600 = $2,600 a year.
critical function: An activity the business can't do without for long. Kettle & Crane's are online orders, wholesale orders, shipping and payroll.
cyber insurance: Insurance that pays a breach's clean-up and legal costs, the usual way to transfer cyber risk. Insurers ask about controls and may refuse to pay if basics are missing; Kettle & Crane requires its MSP to carry at least $1 million.

D

data controller: The organization that decides why and how personal data is used. Kettle & Crane is the controller of its customers' data and stays responsible for the processors it chooses.
data custodian: The person who looks after data day to day (access, backups, encryption) following the owner's rules. Alex is the custodian of the customer list.
data owner: The senior person accountable for a set of data, who decides who may use it and how it is protected. Priya owns the customer list.
data processor: An organization that handles personal data for the controller and follows its instructions, such as Kettle & Crane's shop platform and payroll service.
data retention: Keeping each kind of record for a set period and then deleting it safely. The IRS asks employers to keep payroll tax records at least four years, and Kettle & Crane deletes abandoned carts after 90 days.
data subject: The person the personal data is about, such as a shop customer. Privacy laws give them rights to see, correct and delete their data, and the controller must answer in time.
decentralized governance: Each department or site makes its own security decisions. It is faster and fits local needs, but rules drift apart, as with a 300-shop chain where each region sets its own rules.
denial-of-service attack: An attack that floods or breaks a service so real users can't reach it. Kettle & Crane's rules of engagement forbid the pen testers from using one.
dependency: A system, person or supplier that a business function needs in order to work. A function recovers only as fast as its slowest dependency, such as the office fiber line for shipping.
disaster recovery: Restoring systems after a crisis, alongside business continuity, which keeps work going during one.
due diligence: Careful checking before you sign, while you can still walk away. For vendors it covers security, evidence, finances, references, history and subcontractors, as Alex did for Cascade.

E

EDR (endpoint detection and response): Security software on computers that detects and stops attacks such as ransomware before they spread. The owners chose it for $1,200 a year to bring R2 under the risk appetite.
evidence (audit): Proof that a claim is true, such as records, observations, test results, audit reports or certificates, rather than someone's word. Audits rest on it, and strong conclusions use more than one kind.
exception (audit): A tested case where a control didn't work, such as change ticket T1033 having no approver. It is not the same as a policy exception.
expansionary, neutral, conservative: Three styles of risk appetite, from most to least willing to take risk. Expansionary takes risk for growth, neutral weighs each case, and conservative prefers safety. Kettle & Crane's owners are conservative about customer data.
exposure factor (EF): The share of an asset's value lost in one incident, from 0% to 100% and written as a decimal from 0 to 1. Backups mean ransomware would cost about half the file server's value, so EF is 0.5.
expression of interest (EOI): A short public notice asking who would like to bid for some work. The vendors' brief replies are also called expressions of interest. Kettle & Crane's EOI got 8 replies.

F

FCPA (Foreign Corrupt Practices Act): A US law that forbids bribing foreign officials to win business. As of October 2026 it still applies.
fines: Money penalties for non-compliance set by law or contract. GDPR fines can reach €20 million or 4% of worldwide yearly revenue, and card brands' fines get passed on to merchants.
fuzzy matching: Comparing names by how alike they are rather than requiring an exact match, so different spellings still get caught. screen.py holds any supplier scoring 0.85 or more against a listed name, such as Verdanto Exports Holding.

G

gap analysis: A comparison of where you are now with where you want to be, area by area, listing the gaps to plan work. Kettle & Crane's biggest gap is Detect, which Cascade's monitoring closes.
GDPR (General Data Protection Regulation): The European Union's privacy law, covering anyone who handles data of people in the EU. It gives data subjects rights and allows large fines. It would apply to Kettle & Crane only if it sold to EU customers.
GLBA (Gramm-Leach-Bliley Act): A US law covering how financial institutions protect customer data. It doesn't apply to Kettle & Crane.
governance: The system that decides who sets direction, who makes which decisions, and how anyone checks they are carried out. Kettle & Crane's owners ruling that card data is never stored on office computers is governance; Alex configuring the shop to follow that rule is management.
guideline: Advice on a recommended way to do something, which people may adapt, such as a passphrase tip. It is the only optional layer of the policy pyramid.

H

heat map: A grid from Security Fundamentals in 50 Pages that sorts risk scores into bands. Here, 15 to 25 is High, 8 to 14 Medium and 1 to 7 Low.
HIPAA (Health Insurance Portability and Accountability Act): A US law protecting health information in health care. It doesn't apply to Kettle & Crane.
hosted payment page: A checkout page run by the payment processor, so card numbers never touch Kettle & Crane's servers. It transfers much of the card risk and means a shorter PCI SAQ applies.

I

immutable backup: A backup copy that can't be changed or deleted, so ransomware can't destroy it. For $600 a year it cut Kettle & Crane's ransomware EF from 50% to 10%.
impact: How much harm a risk does if it happens, rated from 1 to 5 in Kettle & Crane's register.
independent attestation: A report in which an outside auditor examines a company's controls and gives its opinion, such as the SOC 2 Cascade sent. Customers trust it more than a self-assessment.
independent third-party audit: An audit by a firm that has no stake in the result and reports against a standard, as in a SOC 2.
inherent risk: The level of a risk before any controls are applied. Ransomware's inherent score is 15 (likelihood 3 x impact 5).
internal and external audit: Internal checks are done by the organization's own people: cheaper, but insiders may miss things they're used to. External checks are done by an independent outsider such as an audit firm or regulator, and others trust them more.
interview: An evidence-gathering conversation with the people who do the work, which shows whether practice matches the documents. Sam's interview explained why urgent changes skipped approval.

K

key risk indicator (KRI): A measurement that warns a risk is growing. An example is the share of staff who click the monthly phishing test email rising from 5% to 20%.

L

likelihood: How probable it is that a risk happens in a given period, rated from 1 to 5 in Kettle & Crane's register.
loss of license: A regulator withdrawing permission to operate, such as a food processing license. For a card merchant, the equivalent is losing the right to accept cards.

M

management: The daily work done inside the direction governance sets. The owners deciding card data is never stored on office computers is governance; Alex configuring the shop to send cards straight to the processor is management.
master service agreement (MSA): A contract negotiated once that holds the terms for all work between two companies: payment, liability, data protection, breach notice, audit rights and exit. Kettle & Crane's MSA with Cascade sits above each SOW.
maximum tolerable downtime (MTD): The longest a function can be down before the harm becomes unacceptable. The function's owner sets it; Priya says 24 hours for online orders.
MDM (mobile device management): Software that lets IT manage staff devices, such as setting up a work profile and wiping it. Kettle & Crane's BYOD policy requires the company's app.
mean time between failures (MTBF): The average time a system runs between breakdowns: running time divided by failures. The office fiber line failed twice in two years, an MTBF of about 8,760 hours.
mean time to repair (MTTR): The average time to fix a system once it breaks, such as the fiber line's 48 hours.
memorandum of agreement (MOA): A formal agreement between partners that spells out each party's exact duties and is often binding. Kettle & Crane's MOA with Hearth says each roasts for the other for up to four weeks if a roaster breaks.
memorandum of understanding (MOU): A usually non-binding record that two parties intend to cooperate and broadly how, such as sharing fraud warnings with the Portland Roasters Co-op.
mitigate: A treatment that puts controls in place to make a risk less likely, less harmful, or both. A second factor makes phishing less likely to succeed; immutable backups make ransomware less harmful.
MSP (managed service provider): An outside company that runs IT services for clients, often with admin access to their computers. Kettle & Crane hires Cascade as its MSP for after-hours monitoring and help desk.

N

NIST Cybersecurity Framework (CSF) 2.0: A free framework published in 2024 by the US National Institute of Standards and Technology. It groups security work into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Kettle & Crane self-assesses against it.
non-disclosure agreement (NDA): A contract in which one or both sides promise to keep shared information secret and use it only for an agreed purpose. Kettle & Crane and Cascade signed a mutual NDA before Alex shared the network diagram.

O

observation and inspection: Gathering evidence by watching a process happen, such as a packer printing a label, and by examining records, settings and documents directly.
OCPA (Oregon Consumer Privacy Act): Oregon's state privacy law, one of the state privacy laws that partly apply to Kettle & Crane.
OFAC (Office of Foreign Assets Control): The US Treasury office that publishes the SDN sanctions list. Its free Sanctions List Search uses fuzzy matching.

P

PCI DSS (Payment Card Industry Data Security Standard): A security standard for anyone who accepts payment cards. It comes from a contract with the card brands, not a law. Kettle & Crane meets it each year with an SAQ and an AOC.
penetration test: An authorized attack on your systems to prove which weaknesses can actually be used. It is run under rules of engagement, like Cascade's March test in SOW 2.
phishing: Tricking people, usually by email, into giving away passwords or clicking something harmful. It is Kettle & Crane's top risk, R1.
playbook: A guide to what to do in a situation such as ransomware. It calls on runbooks for the exact steps.
policy: A short, high-level statement of what the organization wants and why, approved by the top people and rarely naming products or numbers. An example is Kettle & Crane's Information Security Policy.
policy exception: Written, time-limited permission to break one rule, with a reason and usually a compensating control. An example is letting the label printer go without a second factor.
policy pyramid: The four layers of governance documents: policy, standard, procedure and guideline, from a few broad ones at the top to many detailed ones below. Only guidelines are optional.
procedure: Step-by-step instructions for doing one task the required way, such as the New Starter Procedure. Like policies and standards, it is mandatory.
procurement: The formal process of buying goods and services. It uses the EOI, RFI, RFP and RFQ documents, which narrow the field step by step.

Q

qualitative: Risk analysis with words or simple 1-5 scores based on people's judgment. It is quick and works for every risk. Kettle & Crane's 1-25 register scores are qualitative even though they are numbers.
quantitative: Risk analysis that puts dollar figures on each risk, using AV, EF, SLE, ARO and ALE. It needs real figures but speaks the owners' language.
questionnaire (audit): Written questions to the people responsible, used as evidence in an audit or assessment. The answers are only claims until they are checked.

R

ransomware: Malware that encrypts files and demands payment. It is risk R2: ransomware hitting Kettle & Crane's file server.
reconnaissance: Gathering information about a target at the start of a penetration test. Passive reconnaissance uses only public sources; active reconnaissance scans the systems.
recovery point objective (RPO): The most data a function can afford to lose, measured back from the failure to the last good copy. Online orders' RPO is 1 hour, so backups must run at least that often.
recovery time objective (RTO): The target time to bring a function back. It must be no longer than the MTD (RTO ≤ MTD); online orders' RTO is 8 hours.
recusal: Stepping aside from a decision because of a conflict of interest, as Jo did from comparing the MSP proposals.
reference architecture: A proven, documented design for a common kind of system, showing the parts, how they connect and where the controls sit. A cloud provider's design for a small web shop is one.
regulator: A government body that makes and enforces rules for an industry or a kind of data. Governance must make sure those rules are followed.
regulatory examination: An inspection by a regulator of an organization it oversees, such as a bank. The organization can't refuse.
reputational damage: Customers and partners losing trust after a failure. It is often the most expensive harm of non-compliance, and it stays with Kettle & Crane even when financial risk is transferred.
request for information (RFI): Questions to learn what vendors offer before you have decided exactly what to buy, such as 'Do you monitor macOS?'
request for proposal (RFP): A detailed description of your needs that asks each vendor to propose a solution and a price. It is used for complex work like the MSP contract.
request for quote (RFQ): A request for a price on something defined exactly, such as 14 antivirus licenses for one year.
residual risk: The level of risk left after controls are in place. It is the number compared with the risk appetite; ransomware's residual score fell to 6 after backups and EDR.
RFC (Request for Comments): A numbered IETF document, often a finished internet standard that never changes once published. RFC 9116 defines security.txt and RFC 8446 defines TLS 1.3.
right to be forgotten: A data subject's right to have their personal data deleted unless a law requires keeping it.
right-to-audit clause: A contract term giving the customer the right to inspect the vendor's controls, records and premises, or to have an independent auditor do so. A typical clause allows one audit a year with 30 days' notice.
risk: The chance that something bad happens, combined with how much harm it would do. It needs an asset, a threat and a vulnerability, and is best written as a cause, an event and a consequence.
risk appetite: The amount and kind of risk an organization will take on to reach its goals. The owners set it, and it should be checkable; Kettle & Crane's rule is that no residual risk may score above 8 without the owners' written approval.
risk management: The ongoing loop of identifying, assessing, treating and monitoring risks.
risk owner: The person accountable for one risk: they decide its treatment, make sure it happens and report on it. It is usually the manager of the area that would suffer; the owners own card skimming.
risk register: The list of an organization's risks with their ratings, score, owner, status, review date and treatment decisions. Kettle & Crane keeps it in risks.csv.
risk score: Likelihood times impact, from 1 to 25, which sets the order of work. It is banded High (15+), Medium (8-14) or Low (1-7).
risk statement (cause, event, consequence): Writing each risk as one sentence with a cause, an event and a consequence, so it can be measured and owned. For example: because email has no second factor (cause), a phished password lets an attacker in (event), so they can send fake invoices (consequence).
risk tolerance: How far a single risk may go past the appetite before it must be escalated. Kettle & Crane's owners let a score of 9 or 10 wait one quarter.
risk treatment: The risk owner's choice of what to do about an assessed risk: mitigate, transfer, avoid or accept, often a mix. It is the third step of risk management and is recorded in the register.
rules of engagement: A signed document, attached to a pen test's SOW, that says exactly what testers may and may not do: scope, timing, methods, data handling, contacts and stop rules, and who authorized it.
runbook: A detailed, step-by-step guide for one routine operational task, with the exact commands and expected output, such as 'Enroll a personal phone'.

S

safe harbor: The part of a vulnerability disclosure policy that promises not to take legal action against finders who follow the rules in good faith.
sampling: Testing a fair, usually random selection of items to judge the whole set, such as 10 of Kettle & Crane's 60 change tickets. A small sample gives a wide range, so a found exception means widening the test.
sanctions: Government restrictions on dealing with certain countries, organizations or people, so suppliers must be screened before payment. The word also means penalties ordered by a regulator or court; the context tells you which.
SAQ (Self-Assessment Questionnaire): PCI DSS's checklist for small merchants, filled in each year with evidence. Using a hosted payment page means a shorter SAQ applies.
SDN list (Specially Designated Nationals): OFAC's list of people and organizations US businesses must not deal with, directly or indirectly.
security program binder: One document that gathers the program's current state (policy reviews, risk register, BIA, vendor review and gap analysis) with a short summary on top. binder.py builds it from the CSV records for each quarterly steering committee meeting.
security steering committee: A small group that meets regularly to review security risks and projects and decide within limits the board set. At Kettle & Crane it is the two owners plus Alex, meeting quarterly.
security.txt: A small text file at `/.well-known/security.txt`, defined by RFC 9116, that tells finders how to report flaws. It needs at least one Contact written as a link (mailto:, https: or tel:) and exactly one Expires date, which should be less than a year away.
seed: The starting value that makes 'random' choices repeatable, so an auditor can show how a sample was picked. In real audits, record a seed chosen at test time and keep it secret from the people being tested until the sample is drawn.
self-assessment: An organization rating itself against a framework, usually with a questionnaire. It is cheap and repeatable; Kettle & Crane scores itself 0-4 on each NIST CSF function, with evidence behind each answer.
service credit: A discount on the next bill owed when an SLA is missed. The shop platform owes 10% below 99.9% uptime and 25% below 99.0%, which is small next to the real harm.
service level agreement (SLA): The agreement that contains the service levels and says what happens when they are missed, usually service credits. It gives you a lever but doesn't transfer the risk.
service level objective (SLO): One measurable target for a service, such as 99.9% monthly availability or answering critical alerts within 15 minutes. It sits inside an SLA.
single loss expectancy (SLE): The expected cost of one incident: AV x EF. One ransomware attack on the file server is $40,000 x 0.5 = $20,000.
single point of failure: A component with no backup whose failure stops a function. The office fiber line, shared by wholesale and shipping, was the worst kind.
SOC 2 (System and Organization Controls 2): A common independent attestation report in which an outside auditor gives an opinion on a company's controls. Cascade sent one during due diligence.
SOX (Sarbanes-Oxley): A US law requiring companies listed on a US stock exchange to keep controls over their financial reporting. It doesn't apply to Kettle & Crane.
standard: Exact, measurable rules that carry out a policy and that a technical person can check, such as 'passwords are at least 14 characters'.
statement of work (SOW): A document describing one specific project or service under an MSA: what will be done, the deliverables, the schedule and the price. Kettle & Crane's SOW 1 covers monitoring and SOW 2 the pen test.

T

third-party risk management: Choosing vendors carefully, writing protections into contracts and keeping watch on them, following the vendor lifecycle.
threat: Something that could harm an asset, such as a phishing gang or a flood. It is one of the three things a risk needs.
TLS (Transport Layer Security): The protocol that encrypts web connections such as HTTPS, defined in RFCs (TLS 1.3 is RFC 8446). A standard can require a minimum version by citing them.
transfer: A treatment that moves a risk's financial impact to someone else, usually by paying them, as with cyber insurance or a payment processor. It moves the money, not the responsibility.

U

UK Bribery Act: A UK anti-bribery law that also covers bribes between private businesses.
uptime: The percentage of time a service is available. In a 30-day month, 99.9% allows 43.2 minutes down, and each extra 'nine' cuts the allowance tenfold.

V

vendor: A company that supplies goods or services to you, such as Kettle & Crane's shop platform, payroll service or Cascade. Many hold your data or can access your systems.
vendor lifecycle: The stages of a vendor relationship: select, assess, contract, monitor and offboard. Offboarding means getting your data back, removing access and confirming deletion.
vendor lock-in: Being stuck with a vendor because leaving is too costly or difficult, for example because the data is in a format only that vendor reads. It is reduced with standard exports such as CSV, exit clauses and shorter terms.
vendor security questionnaire: A set of security questions every finalist answers, here weighted 1-3 with must-haves that disqualify on a 'no'. Ridgeline failed must-have Q1.
vulnerability: A weakness a threat can use, such as email with no second factor. It is one of the three things a risk needs.
vulnerability disclosure policy (VDP): A policy telling outsiders how to report a security weakness and what you promise in return: scope, rules for the finder, safe harbor and reply times. It offers thanks, not money.

W

work profile: A separate area on a personal phone that holds work data. If Priya's phone is lost or she leaves, IT wipes only that profile and her photos stay.