Glossary

193 terms from Protecting Data, in plain words, each with the chapter that teaches it.

Search the glossary

A

AES (Advanced Encryption Standard): A widely used encryption algorithm. With a 256-bit key, it is the common choice for full disk encryption on laptops.
Aggregation: Pieces of data that do little harm alone can become harmful once they are put together, so the combined data may need a higher class. Customer names alone may be sensitive, but names joined to card numbers and home addresses become restricted.
Anonymization: Deidentification that cannot be undone. No key or table exists that links the records back to people, as when Alex prepares sales data for the university.
Attorney-client privilege: A legal rule that keeps confidential communications between a client and its lawyer private, even in court. Sharing them with outsiders can waive it, for example if someone forwarded the lawyer's advice to a supplier.
Availability: The part of the CIA triad that means data is there when it is needed. Critical data, such as Kettle & Crane's order database, is mainly about availability.

B

Backup: A copy of data kept so it can be recovered after a failure, usually held for weeks. A backup is not retention, and old backups must still follow the retention schedule.
Bank identification number (BIN): The first six or eight digits of a card number, which identify the bank that issued the card. Under PCI DSS, a masked card number may show at most the BIN and the last four digits.
Banner marking: A marking at the top and bottom of every page of a classified document that shows the highest classification on that page, such as SECRET.
Base64: An encoding that rewrites data using 64 readable characters. It hides text only from a quick glance: the Linux base64 command turns 'Kettle' into S2V0dGxl, and base64 -d decodes it straight back, because no key is involved.
Breach Notification Rule: The HIPAA rule that says affected people must be told about a breach of health data without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people must also go to HHS within 60 days (smaller ones are reported once a year), and a breach affecting more than 500 residents of one state must also go to that state's media.
Brute force: An attack that tries every possible value until one matches. Card numbers have so few possible values that an attacker can hash them all, which is why a bare hash is weak protection for them.
Business associate: A company that handles PHI on behalf of a HIPAA covered entity, such as a billing service or a cloud provider that hosts a clinic's records. It must protect PHI too.
Business associate agreement: The contract a business associate signs with a covered entity, promising to protect the PHI it handles.

C

California Consumer Privacy Act (CCPA): California's comprehensive privacy law. It gives people rights over their personal data, such as seeing and deleting it.
Certificate of destruction: A signed record from a disposal service saying what was destroyed, when and how. It is the organization's proof that disposal happened, like the one Kettle & Crane gets from its shredding company.
Chain of custody: A record of who collected, handled and stored a piece of evidence, and when. It lets a court trust that the evidence was not changed.
Change control: A process that controls and records changes to systems and data. Alex uses it to protect the DNS records, and it helps keep financial records accurate under SOX.
Children's Online Privacy Protection Act (COPPA): The US law, with the FTC's COPPA Rule, that covers websites and online services aimed at children under 13 or that knowingly collect their data. It requires verifiable parental consent before collecting a child's personal information.
CIA triad: The three goals of security: confidentiality, integrity and availability. Most data classes are about confidentiality, but the critical class is about availability.
Ciphertext: The scrambled, unreadable result of encryption. A stolen laptop with full disk encryption shows only ciphertext.
Clear: The lightest NIST sanitization method. It overwrites all the space a user can write to using the device's normal commands, so ordinary recovery tools fail and the device can be reused inside the company.
Code obfuscation: Renaming variables and scrambling the layout of a program so it is hard to copy or study.
Commercial and government classes: The two families of class names the exam uses. Businesses use public, sensitive, confidential and restricted (plus critical), and the US government uses confidential, secret and top secret for national security information.
Compliance: Meeting the laws, regulations, contracts and standards that apply to an organization. For data, the rules mostly depend on what kind of data you hold.
CompTIA Security+: A widely recognized entry-level IT security certification from CompTIA. Its current exam, SY0-801, tests core security knowledge, and its objective 3.3 covers concepts and strategies for protecting data.
Confidential: In business use, data that only people with a business need and the owner's approval may see, because a leak would seriously harm the business, such as the café contracts. In US government use, it is the lowest classification level: a leak could cause damage to national security.
Confidential computing: Technology that keeps data encrypted everywhere outside the processor, so it stays protected while it is being processed.
Confidentiality: The part of the CIA triad that means only the right people can read the data. Most data classes describe how much confidentiality the data needs.
Container: A separate, encrypted work area that MDM creates on a staff-owned phone. Alex can wipe the work data without touching the person's own photos.
Contractual standard: A standard that becomes binding because you signed a contract, not because it is a law. PCI DSS binds Kettle & Crane through its agreement with its payment company.
Controlled unclassified information (CUI): US government information that is not classified but still needs protection, such as some law enforcement records. It is not a classification level, and it is marked with a 'CUI' banner.
Copyright: Legal protection for creative works such as text, photos and software code. It applies automatically when the work is created.
Covered entity: Under HIPAA, a health care provider that bills electronically, a health plan, or a health care clearinghouse. HIPAA's rules apply to the PHI these organizations hold.
Creation: The first stage of the data management life cycle, when data is typed, captured or received. It is the best moment to classify, label and collect only what is needed.
Critical: Data the organization cannot work without, so its main need is availability, not secrecy. Kettle & Crane's order database and its public DNS records are both critical.
Cryptographic erase: A purge method that destroys the key of a fully encrypted drive, leaving only unreadable ciphertext. It also suits SSDs and cloud storage, where you cannot shred the disks yourself.

D

Data at rest: Data that is stored, such as on a drive or in a database. Full disk encryption protects it.
Data breach: An incident in which data is stolen, exposed or reached by someone who is not allowed to see it. Many laws set deadlines for telling regulators and the affected people.
Data classification: Sorting data into a small number of classes by how much harm a leak, change or loss would cause. Each class comes with its own handling rules.
Data controller: In privacy law, the organization that decides why and how personal data is processed. Kettle & Crane is the controller of its customers' data, even when other companies do part of the work.
Data custodian: The person or team, usually IT, that looks after data technically by carrying out the owner's decisions: permissions, backups, encryption and patches. At Kettle & Crane this is Alex.
Data handling: The everyday rules for treating data according to its class wherever it goes. It covers endpoints, marking and labeling, geofencing, data location and data placement.
Data in transit: Data moving over a network. TLS protects it, for example when customers send card details to the online shop.
Data in use: Data being worked on in memory or shown on a screen. It is usually plaintext, which makes it the hardest state to protect.
Data location: Where data physically sits in the world: which country, state or data center, counting every copy. It matters because it decides which laws apply.
Data loss prevention (DLP): A tool that watches data leaving the company by email or upload and blocks or removes content that matches rules, such as anything that looks like a card number or a design file.
Data management life cycle: The five stages data passes through: creation, management, distribution, retention and disposal. Naming them lets an organization plan the protection for each stage ahead of time.
Data minimization: Collecting and sharing only the least data a task needs. Kettle & Crane's order form doesn't ask for a birth date because shipping coffee doesn't need one, and data never collected can never leak.
Data operator: The person or system that works with data every day, entering, updating and processing it under rules set by others. Examples are the shipping helpers and the nightly accounting job.
Data owner: The senior person accountable for a set of data. The owner decides its class, who may access it, how long it is kept and what protection it needs, as Sam does for the café contracts.
Data placement: The design decision about which server, database, network zone or storage tier holds each piece of data. The most valuable data goes in the most protected place.
Data processor: An outside organization that processes personal data on behalf of a controller and only on its instructions, like the email service that sends Kettle & Crane's order updates.
Data protection roles: The named jobs that make someone responsible for each data set. Inside an organization they are the owner, custodian, steward and operator; in privacy law they are the controller, processor and subprocessor.
Data residency: A rule in a law or contract that data must stay inside a certain country or region, such as a café chain requiring its order data to stay in the US.
Data sharing agreement: A written agreement, used when sharing data outside the company, that says what the recipient may do with the data and when they must delete it.
Data sovereignty: The idea that data stored in a country is generally subject to that country's laws.
Data states: The three conditions data can be in: at rest (stored), in transit (moving over a network) and in use (being worked on). Each state needs its own kind of protection.
Data steward: The person responsible for the quality and proper use of data: that it is accurate, consistent, correctly labeled and used for its approved purpose. Priya is the steward for customer data.
Data subject: The person that personal data is about, such as a Kettle & Crane customer.
Data subprocessor: An organization that a processor hires to do part of its processing for a controller, such as the cloud host behind Kettle & Crane's email service. It needs the controller's prior approval and is bound to the same duties.
Data transpose: Protecting data by rearranging values instead of replacing them, for example swapping letters or shuffling zip codes between customers. Anyone who knows the pattern can undo it, so it is weak on its own.
Declassification: In government use, removing classification altogether so the information becomes unclassified. Moving from top secret to secret is a downgrade, not a declassification.
Defend Trade Secrets Act: A 2016 US federal law protecting trade secrets. Information counts as a trade secret only if the owner took reasonable measures to keep it secret.
Degaussing: A traditional purge method that wipes magnetic media such as hard disks and tapes with a strong magnetic field. It ruins modern hard drives and does not work on SSDs or flash.
Deidentification: Removing or changing the parts of a data set that identify people, so it can be used without revealing who it is about. Alex does this to the sales data before sharing it with a university.
Department of Health and Human Services (HHS): The US agency that enforces HIPAA and receives reports of health data breaches.
Destroy: The strongest NIST sanitization method: shredding, disintegrating, pulverizing or burning the media, so recovery is infeasible and the device cannot be used again.
Direct identifier: A field that names a person on its own, such as a name, email address, phone number or account number.
Disposal: The last stage of the life cycle: destroying data, and often its media, so it cannot be recovered, including every copy and backup. Simply deleting a file is not disposal.
Distribution: The life cycle stage where data is shared with another person, team, system or company. Each recipient should get only the minimum, over an approved encrypted channel, with a record kept.
DNS (Domain Name System): The internet's address book. It turns a name like kettleandcrane.com into a server's numeric address, and its records are public but critical.
Downgrading: Lowering a data's class, such as the Decaf launch date going from confidential to public at launch. Only the person responsible for the data may decide it.
Dynamic masking: Masking done on the fly as data is shown, based on who is looking. The stored original is untouched, so a manager may see a full phone number while Priya sees ***-***-4471.

E

Electronic discovery (e-discovery): The process in a lawsuit where each side must find and hand over relevant electronically stored information, such as emails, files and chat logs.
Electronically stored information (ESI): Emails, files, chat logs, databases and other digital records that may have to be handed over in e-discovery.
Encoding: Rewriting data in another format, such as Base64. It hides meaning from a glance but uses no key, so anyone can reverse it.
Encryption: Scrambling data with a secret key so only someone with the key can read it again. It is the method to choose when the right people must read the data again and everyone else must not.
Endpoint: Any device at the edge of the network that a person uses or that collects data, such as a laptop, phone, tablet, card terminal or printer. Data is in use there, copies pile up, and the devices leave the building.
Executive Order 13526: The presidential order that governs US classified information. It defines confidential, secret and top secret by the damage a disclosure could cause to national security.
Expert Determination: One of HIPAA's two ways to deidentify health data: a qualified expert shows that the risk of re-identifying anyone is very small.

F

Family Educational Rights and Privacy Act (FERPA): The US law that protects student education records at schools that receive federal funding.
Federal Trade Commission (FTC): The US agency that enforces the COPPA Rule and the GLBA Safeguards Rule for financial institutions that are not banks.
Filtering: Leaving out the rows or fields that a person or system should not receive, based on rules. Jo's buying export, for example, leaves out customer names and addresses.
Full disk encryption: Encrypting everything on a drive, so a stolen laptop or tablet shows only ciphertext.

G

General Data Protection Regulation (GDPR): The European Union's privacy law. It applies to any company offering goods to people in the EU and requires breach notice to the supervisory authority within 72 hours of becoming aware, where feasible.
Generalization: Blurring indirect identifiers so they no longer point to one person, for example keeping only the first three digits of a zip code or only the birth year.
Geofencing: Drawing a virtual boundary around a real place and allowing or blocking access depending on whether a device is inside it. The shipping tablets open the order app only inside the warehouse geofence.
Geolocation: Working out where a device is, using GPS, Wi-Fi or its IP address. Geofencing relies on it.
Geotagging: Location saved as metadata inside a photo or file, which can reveal where a site or person is.
GPS (Global Positioning System): A satellite system that lets a device work out its position. Its readings can be faked on some devices.
Gramm-Leach-Bliley Act (GLBA): The US law that requires financial institutions such as banks, lenders and tax preparers to protect their customers' financial information.

H

Hash: The fixed-length result of a hash function. The same input always gives the same hash, and a tiny change gives a completely different one.
Hashing: Running data through a one-way math function that cannot be reversed. It is used to store passwords and prove that files are unchanged, never for data someone must read again.
Health data: Information about a person's physical or mental health, their care, or payment for it. It counts as PHI under HIPAA only when a covered entity or business associate holds it.
Health Insurance Portability and Accountability Act (HIPAA): The 1996 US law protecting PHI held by covered entities and their business associates. Its Privacy, Security and Breach Notification Rules set the duties.
HITECH Act: A 2009 US law that made HIPAA business associates directly liable for protecting PHI.
Homomorphic encryption: Encryption that lets a program compute on data without decrypting it, protecting data while it is in use.

I

IEEE 2883: A standard that NIST SP 800-88 Revision 2 points to for media-specific sanitization techniques.
Impossible travel: Two sign-ins from places too far apart for the time between them. Location-based conditional access can block it.
Indirect identifier: A field such as zip code, birth date or job title that can identify someone when combined with others.
Information security management system (ISMS): The policies and processes an organization uses to run its security. ISO/IEC 27001 sets the requirements for one.
Integrity: The part of the CIA triad that means data stays correct and unaltered. Even public data such as website prices needs integrity, and hashing can prove it.
Intellectual property (IP): Creations of the mind that an organization owns, such as designs, recipes and source code. The House Espresso recipe is Kettle & Crane's intellectual property.
Internal Revenue Service (IRS): The US federal tax agency. Its record-keeping rules set minimum retention periods, such as four years for employment tax records.
ISO/IEC 27001: An international standard from ISO and IEC with requirements for an ISMS. It is voluntary, and an outside auditor can certify an organization against it.

K

Key: The secret value that encrypts and decrypts data. It must be protected at least as well as the data it locks.
Keyed hash: A hash that also uses a secret key, so an attacker cannot simply hash every possible card number to find a match. PCI DSS wants keyed hashes or tokens instead of bare hashes.

L

Labeling: Attaching a data's class as metadata that software can read and act on, or as a physical sticker on a storage device. It lets systems such as DLP enforce the rules.
Least privilege: Giving each person or system only the access its job needs and no more, like the nightly accounting job's limited account.
Legal data: Information created or held for legal purposes, such as contracts, lawsuit documents, communications with lawyers and evidence.
Legal hold: An order to keep all data related to an expected lawsuit or investigation, even after its retention period ends, until the hold is lifted. It overrides the retention schedule.
Location-based conditional access: A sign-in policy that allows or blocks logins based on location, such as accepting admin logins only from US internet addresses.

M

Management (life cycle stage): The life cycle stage where data is stored, used, kept correct, backed up and monitored inside the organization. It is usually the longest stage.
Marking: A visible sign of a data's class that people read, such as a header, footer, stamp, watermark or screen banner.
Masking: Hiding part of a value with symbols such as * while leaving enough visible for the job, so Priya sees ************1111. The production original stays intact.
Metadata: Data that describes other data, such as field names, formats, classification labels or a photo's location.
Microsoft 365: Microsoft's office suite. Its sensitivity labels can add markings to documents and encrypt them.
Mobile device management (MDM): A service that lets Alex enforce settings on phones and tablets, lock them when they leave a geofence, and remotely wipe them if they are lost.
My Health My Data Act: A Washington state law, in force since March 2024, that protects consumer health data collected by businesses HIPAA doesn't cover, such as health apps.

N

National security information: US government information whose leak could harm the country. It is classified as confidential, secret or top secret.
Need to know: The rule that being trusted is not enough: you must also need the data for your work. Priya can't see café contracts because her job never needs them.
NIST (National Institute of Standards and Technology): The US agency that publishes security standards and guidance, including SP 800-88 and the Cybersecurity Framework.
NIST Cybersecurity Framework (CSF): A voluntary NIST framework of security outcomes in six functions: Govern, Identify, Protect, Detect, Respond and Recover.
NIST SP 800-88: The US guidance on media sanitization. Revision 2 (September 2025) defines the clear, purge and destroy methods.
Non-disclosure agreement (NDA): A contract in which a person promises not to reveal information. Morgan and the head roaster signed NDAs for the House Espresso recipe.

O

Obfuscation: An umbrella term for making data or code hard to understand, such as encoding, code obfuscation or steganography. Without a key, a determined attacker can usually undo it.
Operator (COPPA): In the children's privacy law COPPA, the company that runs a website or online service. This is different from the data operator role.
Oregon Consumer Privacy Act (OCPA): Oregon's comprehensive privacy law, in effect since July 2024. It applies to organizations handling the data of at least 100,000 Oregon consumers a year, or 25,000 if more than a quarter of their revenue comes from selling personal data, so it doesn't yet apply to Kettle & Crane.

P

Password hashing functions (Argon2, bcrypt, PBKDF2): Deliberately slow hash functions made for storing passwords, so each guess costs an attacker time. Real systems use them instead of plain SHA-256.
Patch: A software update that fixes flaws in a system. Applying patches to systems that hold data is part of the custodian's job.
Patent: Legal protection for an invention, given in exchange for publishing how it works. A US patent usually lasts 20 years from filing.
Payment Card Industry Data Security Standard (PCI DSS): The card brands' security standard for anyone who stores, processes or sends card data. It binds by contract, not by law, and requires masking card numbers on screen, encrypting card data sent over public networks and never storing the security code after a payment is approved.
Personal data: Information about an identifiable living person, such as a customer's name and address. It is the main term in privacy laws like the GDPR.
Personally identifiable information (PII): Information that can identify or trace a person, such as a name with a home address, a birth date or a Social Security number. Kettle & Crane's customer list is PII.
Pipe: The | symbol in a Linux command line, which sends one command's output into another, as in printf 'House Espresso' | sha256sum. The - in the output means the input came from the pipe.
Plaintext: The readable original data before encryption or after decryption.
Portion mark: A short code in brackets at the start of each paragraph of a classified document, such as (S) or (U), showing that paragraph's level.
printf: A Linux command that prints text exactly as given and adds no line ending unless you ask for one. Piping it into a tool such as `sha256sum` or `base64` means only the text itself is hashed or encoded, without a stray newline.
Privacy Rule: The HIPAA rule that sets who may use and share PHI and requires sharing only the minimum necessary.
Processing: In privacy law, anything done with personal data: collecting, storing, using, sharing or deleting it.
Protected health information (PHI): Individually identifiable health information held by a HIPAA covered entity or business associate. A doctor's note in Kettle & Crane's staff file is not PHI, though it is still sensitive.
Pseudonymization: Replacing people's identifiers with a code, such as customer 4471 becoming C-82913, while a protected table keeps the link. Under the GDPR it still counts as personal data.
Public: Data that anyone may see without harm, such as the shop's price list. It still needs integrity protection against changes.
Purge: A NIST sanitization method that resists even laboratory recovery, using the drive's sanitize command, cryptographic erase or degaussing. It suits media leaving your control, and the device may still be reusable.
Python: A popular general-purpose programming language used for short scripts and larger programs. Its built-in `hashlib` library computes hashes such as SHA-256, and its `secrets` library makes secure random values, for example a token that stands in for a test card number.

Q

Quick format: Rebuilding a drive's empty folder structure without erasing the data. The old data stays recoverable, so a quick format is not disposal.

R

Re-identification: Joining 'anonymous' data with another data set to find the people again, which is the main danger in deidentification.
Redaction: Removing or blacking out content in a document or export before it is released, such as account numbers in a court filing.
Remote wipe: Erasing a lost device over the network, usually through MDM. It only works if the device comes back online.
Restricted: The most tightly controlled commercial class. Only a short named list of people may see it, often under an NDA, like the House Espresso recipe.
Retention: Keeping data for a set period after its active use, long enough for laws and contracts but no longer than needed, then disposing of it on schedule.
Retention policy: A policy that says how long each type of data is kept and why.
Retention schedule: A table of data types and how long each is kept, such as Kettle & Crane keeping order records for four years. Morgan approved it as data owner.

S

Safe Harbor: One of HIPAA's two deidentification methods: removing 18 listed types of identifiers, such as names, most address detail and full dates.
Safeguards Rule: The FTC rule under GLBA that requires non-bank financial institutions to have a written security program. They must report breaches of unencrypted customer information affecting 500 or more people to the FTC within 30 days.
Salt: A random value added to a password before hashing, so two users with the same password get different hashes.
Sanitization: Making data on media impossible to recover at a chosen level of effort, using clear, purge or destroy.
Sarbanes-Oxley Act (SOX): The US law requiring public companies to keep accurate financial reports and internal controls over them. Its main security goal is integrity.
Secret: The middle US government classification level: a disclosure could cause serious damage to national security.
Secure enclave: A protected area of the processor that keeps data safe while it is being processed.
Securities and Exchange Commission (SEC): The US agency that oversees public companies and enforces SOX.
Security clearance: The government's decision, after a background check, that a person can be trusted with information at a given level. It must be paired with a need to know.
Security Rule: The HIPAA rule that requires administrative, physical and technical safeguards for electronic PHI, such as risk analysis, access control, audit logs and encryption.
Sensitive: A commercial class for data that would harm people or the business if it reached the wrong people, typically PII, PHI or intellectual property, such as the customer email list.
Sensitive authentication data: Card data that PCI DSS forbids storing after a payment is approved, including the three- or four-digit security code.
Sensitive PII: PII that is especially harmful if leaked, such as Social Security numbers, driver's license and passport numbers, financial account numbers and biometric data.
Sensitivity label: A Microsoft 365 label such as 'Confidential', saved as metadata in a file. It can add markings and encrypt the content, like the label on Sam's café contracts.
Separation of duties: Splitting a task so no single person controls it from start to finish. For customer data, Morgan decides, Alex implements and Priya checks.
SHA-256: A hash function with a 256-bit result. It is good for checking integrity, but too fast to be a good choice for storing passwords.
sha256sum: A Linux tool that computes the SHA-256 hash of a file or of piped input.
Solid-state drive (SSD): The flash storage in most modern laptops. It spreads writes across hidden spare areas, so overwriting files is not enough, and it needs a sanitize command, cryptographic erase or destruction.
Spyware: Software that secretly watches what a computer does, for example by capturing what is on the screen.
Standard: A published set of requirements or good practices that makes security measurable and comparable. Auditors check against standards, and laws and contracts often point to them.
State breach notification laws: Laws, one in every US state, requiring that people be told when their personal information is breached. Oregon's law gives 45 days, and most of these laws exempt data that was encrypted if the key was not taken.
State comprehensive privacy laws: US state laws, in about 20 states, that give people rights over their personal data, such as seeing and deleting it, and put duties on businesses above a size threshold. Examples are the CCPA and the OCPA.
Static masking: Making a permanently masked copy of a data set, usually for testing or development, while production keeps the real values.
Steganography: Hiding data inside other data, such as a message hidden in the pixels of a photo.
Supervisory authority: A national data protection regulator under the GDPR. A controller must notify it of a breach within 72 hours of becoming aware, where feasible.

T

TLS (Transport Layer Security): The protocol behind https:// that encrypts data in transit, so card details can't be read on the way to the online shop.
Token: A random stand-in for a sensitive value, with no math link to it. Kettle & Crane's order database stores tokens instead of card numbers.
Token vault: The well-protected store that keeps the table linking each token to the real value. Only the vault can swap a token back.
Tokenization: Replacing a sensitive value with a random token, so systems hold no real values and fewer fall under PCI DSS. Only the vault can reverse it.
Top secret: The highest US government classification level: a disclosure could cause exceptionally grave damage to national security.
Trade secret: Valuable information kept secret, such as the House Espresso recipe. It stays legally protected only while the owner takes reasonable security measures to keep it secret.
Trademark: Legal protection for brand names, logos and slogans, such as the Kettle & Crane name.
Transposition cipher: An old cipher that keeps the letters of a message but changes their positions, so KETTLE might become EKTTEL.
Truncation: Permanently removing part of a card number from storage, for example keeping only the last four digits, so the rest can never come back.

U

Unclassified: In government use, information not classified at any level. Unclassified does not automatically mean approved for public release.
USB (Universal Serial Bus): The standard port for plug-in devices such as thumb drives. Alex blocks USB storage on laptops that handle confidential data so files can't leave on a drive.

V

Verifiable parental consent: Under COPPA, consent from a parent, obtained in a way that reasonably makes sure the person really is the parent, before any personal information is collected from a child under 13.
Voluntary framework: A set of security practices an organization adopts by choice, often to show partners its security is well run, such as the NIST CSF.
VPN (virtual private network): A service that sends a device's traffic through a server elsewhere. It can make the device appear to be in another place and so get around a geofence.

Z

Zone: A network segment with its own firewall rules. Kettle & Crane keeps its public pages, customer database and roasting recipe in separate zones.