Glossary

188 terms from Policies, Standards and Risk Management, in plain words, each with the chapter that teaches it.

Search the glossary

A

acceptable use policy (AUP): A policy that sets the rules for how staff may use the organization's systems, networks and data, and that new staff sign on their first day. At Kettle & Crane, its line about limited personal use settled the case of the seasonal worker streaming video on the shipping computer.
accepting: A risk treatment where the organization decides on purpose to live with a risk and take no further action, recorded and signed by someone with the authority and given a review date. Morgan signed the acceptance of R-03, the stolen-laptop risk, because tracking software would cost more than the expected loss.
access control policy: A policy that sets who may use which systems and data, how access is requested, approved, granted and reviewed, and when it is removed. It is built on least privilege, need to know and separation of duties.
access review: A scheduled check by data owners that everyone still needs the access they have, with any access that is no longer needed removed. Kettle & Crane's first review found that Jo could still issue refunds after moving to buying.
advisory: A time-sensitive notice from a vendor, a government agency or an industry group that warns about a current security problem and says what to do about it. The shop vendor's advisory told Alex to update from version 5.1 to 5.3.
AES (Advanced Encryption Standard): A widely used symmetric encryption algorithm, defined in FIPS 197. Kettle & Crane's standard requires AES with a 256-bit key on its laptops, its order database and its backups.
ALE (annualized loss expectancy): The expected cost of a risk per year, found by multiplying the cost of one event (SLE) by how often it happens per year (ARO). For R-03, the stolen laptop, it was about $700.
ARO (annualized rate of occurrence): How many times a year a risk is expected to happen. Two laptop thefts in six years gives an ARO of about 0.33.
asset: Anything of value that the organization must protect: hardware, software, data, services, people and even its reputation. Examples are Kettle & Crane's order system and its staff laptops.
asset identification: Finding and listing everything of value the organization must protect, together with its owner, location and importance. It is the first step before risks can be assessed.
asset inventory: A list of assets that is kept up to date. For each one it records an ID, the owner, the location, its classification and its criticality, as in Kettle & Crane's entries A-01 to A-06.
avoiding: A risk treatment that removes a risk entirely by stopping, or never starting, the activity that creates it. Kettle & Crane avoided R-07 by deciding never to store café card numbers.

B

baseline: The organization's own mandatory minimum security configuration for one type of system, written as a list of settings that can each be checked with a yes or a no. Kettle & Crane's SSH baseline bans root login and passwords and allows at most 4 login attempts.
benchmark: A published list of recommended security settings for one product, each with a reason and a way to check it. It is outside advice until a company adopts it as its own baseline.
blocklist: A list of common and breached passwords that every new password is checked against, so a match is refused. NIST SP 800-63B-4 and Kettle & Crane's password standard both require this check.
bring your own device (BYOD): A policy for staff who use their own phones, tablets or laptops for work. It protects company data with MDM, a separate work area and remote wipe of work data only, as on Sam's personal phone.
bug bounty program: A program that invites outsiders to report security flaws and pays them a reward. Paying is what separates it from a plain vulnerability disclosure policy.
business continuity plan (BCP): A plan for keeping the organization's essential work going, by any means, during and after a serious disruption, covering priorities, workarounds, roles and communication. Kettle & Crane's BCP has Priya take café orders by phone when the order system is down.
business impact analysis (BIA): An analysis of which business activities matter most and how the harm grows when each one stops, whatever the cause. It sets the MTD, RTO and RPO for each activity and ranks recovery priorities.
business process: An activity the company must do, such as taking café orders or paying staff. A BIA starts by listing these processes.

C

categorization: Sorting risks into groups, by type (for example technical, operational, financial or third party) or by severity band, so that similar risks can be handled, reported and routed to the right owner.
CCPA (California Consumer Privacy Act): A broad California consumer privacy law that gives people rights over their personal data, such as the right to see it, delete it or opt out of its sale. It is one of several US state laws that require businesses to have privacy policies and privacy notices.
certificate of destruction: A record from a disposal vendor that proves media were destroyed, listing each drive's serial number. Kettle & Crane gets one when its old order server drives are destroyed.
CIS (Center for Internet Security): A nonprofit that publishes the CIS Benchmarks. Experts from many companies agree on each recommendation, so CIS calls them consensus-based.
CIS Benchmarks: The best-known benchmarks: consensus-based lists of recommended security settings for specific products, grouped into Level 1 and Level 2 profiles. Alex used the Level 1 profile to build the order server's baseline.
CISA (Cybersecurity and Infrastructure Security Agency): The US government agency that publishes cybersecurity advisories and keeps the Known Exploited Vulnerabilities (KEV) catalog.
classification: Putting data into levels according to how much harm its loss would cause, with handling rules and labels for each level. Kettle & Crane uses three levels: Public, Internal and Confidential.
clean desk: A policy that requires staff to leave no sensitive papers, notes, drives or unlocked screens exposed when they step away. The sticky note with the shipping password that Alex found broke this policy.
clear: The weakest of NIST's three sanitization levels: overwriting data with ordinary write commands or resetting a device to factory settings. It defeats simple recovery tools, and the media can be reused.
communication: Getting the risk register's contents to each audience in a form it can use. Morgan gets a one-page summary and heat map, risk owners get their own rows, and outsiders such as the insurer get only a summary letter.
compliance: Following the rules you must follow, whether they come from laws, contracts or your own policies.
confidentiality, integrity and availability: The three main goals of security, often called the CIA triad. Confidentiality keeps information away from people who should not see it, integrity keeps it accurate, and availability keeps it usable when needed. Security incidents are defined by harm to these goals, and FIPS 199 rates systems by them.
configuration drift: A system's settings moving away from their baseline over time, for example when a contractor loosens a setting during a repair and never changes it back. It is found by checking systems against the baseline on a schedule.
COPE (corporate-owned, personally enabled): A device model where the company owns the device but lets staff also use it for personal things. The company keeps a high level of control.
criticality: How much the business depends on an asset, recorded in the asset inventory as high, medium or low. It drives how big the impact is when that asset is harmed.
cryptographic erase: A purge method that destroys the encryption key, so the encrypted data left on the media can never be read. Kettle & Crane uses it before giving a laptop to a new staff member.
current mitigations: The controls already in place that lower a risk's likelihood or impact; analysis counts them only if they are proven to work against this particular threat. R-01's endpoint protection and tested backups lowered its score from 20 to 12.
current risk: A practitioner's name for a risk with today's controls counted, which sits between inherent and residual risk. Security+ itself calls any risk left after controls residual risk.
custodian: The person who does the day-to-day technical care of an asset, such as backups and patching, on the owner's behalf. Alex is the custodian of the order system that Priya owns.
CVE (Common Vulnerabilities and Exposures): A public ID for one known flaw, such as CVE-2026-12345. Vendor advisories list it so everyone can tell which flaw is meant.
cyber insurance: Insurance that pays costs after a cyberattack or data breach, such as recovery work, legal advice, customer notices and lost income. It is a way of transferring risk, and insurers usually expect controls like MFA and backups first.
CYOD (choose your own device): A device model where staff pick from a list of approved models that the company buys and owns. The company keeps a high level of control.

D

data at rest: Data that is stored on disks, in databases or in backups. Kettle & Crane's encryption standard requires AES-256 for it.
data classification and retention policy: A policy that answers two questions about every kind of data: how sensitive is it (its classification level), and how long must it be kept (the retention schedule). It also covers legal holds.
data disposal policy: A policy that sets how data and the media holding it are destroyed so nothing can be recovered, using clear, purge or destroy methods with proof that it was done.
data in transit: Data that is moving over a network. Kettle & Crane's encryption standard allows only TLS 1.2 or 1.3 for it.
data minimization: Collecting only the personal data needed for the stated purpose. It is why Kettle & Crane chose an optional birthday month field over a full date of birth.
data owner: The manager responsible for a set of data, who chooses its classification level and approves who may access it. Priya is the data owner for refunds.
degaussing: Using a strong magnetic field to purge magnetic disks and tapes. It often leaves a hard drive unusable and does nothing to SSDs or flash media.
deprecated: Deprecated means a method is still allowed but on its way out, and disallowed means it may no longer be used. NIST IR 8547 deprecates RSA after 2030 and disallows it after 2035.
destroy: The strongest sanitization level: shredding, crushing, disintegrating or burning the media. Nothing can be recovered, and the media cannot be used again.
DISA (Defense Information Systems Agency): The US defense agency that publishes STIGs, the required security settings for products on Department of Defense systems.
disaster recovery plan (DRP): The IT part of business continuity: a plan for restoring systems and data after a major disruption. It says who can declare a disaster, the restore order, which backups to use and how to test each restored system.

E

encryption: Turning readable data into unreadable data that only someone with the right key can turn back.
encryption standard: A mandatory standard that names which encryption algorithms, key lengths, protocols and approved modules the organization must use, and where. An example is Kettle & Crane's KC-STD-05.
endpoint protection: Security software on laptops and servers that detects and blocks malware and can isolate a device from the network. Its malware alert is the trigger for runbook RB-03.
errata: Recorded corrections to a published RFC. The RFC text itself never changes, so errors are noted separately.
escalation: Passing a decision up to someone with more authority. At Kettle & Crane, any risk that reaches critical (a score of 20 or more) goes to Morgan the same day.
exception: A written, approved permission for one system or person not to follow a policy or standard, usually for a limited time and often with an extra control. It is a kind of acceptance for one gap, such as the old label printer allowed to miss the baseline for six months.

F

FIPS (Federal Information Processing Standards): Standards that NIST publishes for US government systems. Examples are FIPS 197 for AES and FIPS 203 to 205 for post-quantum encryption.
FIPS 140-3: The FIPS standard used to validate encryption modules. Some customers, especially the US government, require encryption to run in modules validated under it.
FIPS 199: The US government standard for security categorization. It rates the impact of losing a system's confidentiality, integrity or availability as low, moderate or high.
firewall: A network control that filters traffic between networks. A reference architecture shows where it sits, and Kettle & Crane's DRP restores it first.
full-disk encryption: Encrypting a laptop's entire disk, so a thief who steals it cannot read the data. Kettle & Crane requires it with AES-256 before a laptop is handed out.

G

GDPR (General Data Protection Regulation): The European Union's privacy law. A business selling to people in the EU must follow it.
governance: How an organization directs and controls its security: who decides, what the rules are, and how everyone knows the rules are followed.
governance, risk, and compliance (GRC) artifacts: The documents and records that governance produces, such as policies, standards, procedures, plans and the risk register.
grep -E: A command that keeps only the lines of text matching a pattern; -E allows extended patterns such as alternatives joined by | inside parentheses. Alex used it to keep the three baseline lines from the sshd -T output.
guideline: Recommended advice that people should follow but may adapt using judgment, so it is not enforced. The four kinds the exam names are benchmarks, advisories, implementation guides and reference architectures.

I

IETF (Internet Engineering Task Force): The group that designs internet protocols and publishes most RFCs.
impact: How bad the harm would be if a risk happened, in money, operations, data, reputation, law or safety. It is rated 1 (minimal) to 5 (severe) on Kettle & Crane's scale.
implementation guide: A guideline that explains how to install, configure and deploy a product or control correctly, written by vendors or agencies. Alex followed the vendor's guide to set up the new Wi-Fi access point with WPA3.
incident response plan: A plan that describes how the incident response program works: its phases, roles and contacts. It sits between the incident response policy, which grants authority, and the playbooks, which give the steps.
incident response policy: A policy that defines what an incident is, requires all staff to report suspected incidents at once, and gives the response team its authority. It let Alex reset Priya's password right after she was phished.
information security policy: The top-level security policy, approved by senior management, that states the commitment to protecting information, sets goals and roles, and points to all the other policies. Kettle & Crane's is KC-POL-01.
inherent risk: The level of a risk before any controls, meaning what would happen with nothing in place. R-01's inherent score was 4 × 5 = 20.
ISAC (Information Sharing and Analysis Center): An industry group that shares threat news among its members in one sector, such as retail. ISACs are one source of advisories.
ISO/IEC 27001: The international standard for running an information security program. It is voluntary, lists 93 controls (14 of them physical) and requires an information security policy.
ISO/IEC 27002: The guidance that goes with ISO/IEC 27001. It names the clean desk idea "clear desk and clear screen".
ISO/IEC 29147: The international standard for the vulnerability disclosure process.

K

Known Exploited Vulnerabilities (KEV) catalog: CISA's list of flaws that attackers are using right now. US federal agencies must fix them by a due date, and everyone else uses the list to decide what to patch first.

L

least privilege: The principle that each person gets only the access needed for their job, and no more.
legal hold: A pause on normal deletion of data related to an expected lawsuit or investigation, which lasts until the lawyers release it.
likelihood: How likely a risk is to happen within a period, usually a year. It is rated 1 (rare) to 5 (almost certain) and depends on threat activity, exposure, history and existing controls.

M

malware: Malicious software, such as ransomware. Kettle & Crane's runbook RB-03 handles a "malware detected" alert on a staff laptop.
management oversight: Senior management directing the risk program and checking that it works, with direction (such as the appetite and funding) flowing down and reports flowing up. Management holds final accountability, which at Kettle & Crane means Morgan.
maximum tolerable downtime (MTD): The longest a business process can stop before the harm becomes unacceptable. For café orders it is three days, because after that cafés start leaving.
mitigating: A risk treatment that adds or improves controls to lower a risk's likelihood, impact or both, while the activity continues. An example is adding MFA to shop admin logins for R-02.
mitigation: Any action or control that reduces a risk.
mobile device management (MDM): A system that lets the company apply settings to phones and tablets, check them and wipe work data. BYOD phones at Kettle & Crane must be enrolled in it.
multifactor authentication (MFA): Proving who you are with two or more different kinds of proof, such as a password plus a code from a phone. Turning it on for shop admins lowered R-02's likelihood.
MUST, SHOULD and MAY: Key words defined in RFC 2119 and borrowed by many standards. Written in capitals, MUST means an absolute requirement, SHOULD means do it unless there is a good, understood reason not to, and MAY means optional.

N

need to know: The principle that, even with the right access level, a person sees specific data only if their work needs it. The risk register itself is shared on this basis.
NIST (National Institute of Standards and Technology): The US agency that publishes widely used security guidance, such as the SP (Special Publication) series, FIPS and the Cybersecurity Framework.
NIST Cybersecurity Framework (CSF) 2.0: NIST's framework for managing cybersecurity. Its Govern function includes setting policy, and it asks organizations to set and communicate risk appetite and tolerance statements.
NIST IR 8547: NIST's report on moving to post-quantum encryption, finalized in October 2026. It deprecates quantum-vulnerable methods such as RSA after 2030 and disallows them after 2035.
NIST SP 1800: NIST's series of practice guides. Each one shows step by step how to build a security capability from real products, which makes them a kind of implementation guide.
NIST SP 800-207: NIST's Zero Trust Architecture publication. It describes the logical parts of a Zero Trust design and is an example of a reference architecture.
NIST SP 800-30: NIST's guide to risk assessment. It uses five levels from "very low" to "very high", much like 1-to-5 scoring.
NIST SP 800-34: NIST's contingency planning guide. It makes the BIA an early step in building continuity and recovery plans.
NIST SP 800-63B-4: NIST's authentication guidance, finalized in July 2025, on which many password standards are based. It calls for long passwords, blocklist checks, no composition rules and no forced changes on a schedule.
NIST SP 800-88: NIST's guidelines for media sanitization (Revision 2, September 2025). It defines the clear, purge and destroy levels.

O

Oregon Consumer Privacy Act: An Oregon privacy law in effect since July 1, 2024, for businesses that handle the personal data of 100,000 or more Oregon consumers a year, or 25,000 or more if at least a quarter of their revenue comes from selling personal data. Kettle & Crane is below these limits but follows the same principles.
owner: The one stakeholder from the business who is accountable for an asset and decides its classification, who may use it and which risks to it are acceptable. Priya owns the order system.

P

passphrase: A long password made of several words, possibly including spaces. NIST's rules make a long passphrase the main defense.
password manager: A tool that creates and stores long, random passwords so people don't have to remember them. Kettle & Crane provides a company password manager to everyone.
password standard: A mandatory standard for passwords: minimum length, the checks run when a password is set, and how failed attempts are handled. Kettle & Crane's KC-STD-02 follows NIST SP 800-63B-4.
PCI DSS (Payment Card Industry Data Security Standard): An external standard that any business accepting payment cards must follow by contract. Version 4.0.1 requires passwords of at least 12 characters on payment card systems.
penetration test: An authorized simulated attack that looks for weaknesses. Its findings are a source of new risks and a trigger for register reviews.
personal data: Any information about an identifiable person, such as a name, address or email.
phishing: A fake message that tricks someone into clicking a link or giving up a password, like the fake shipping email that caught Priya. Even a strong password does not stop it, which is why MFA matters.
physical security standard: A mandatory standard for protecting buildings, rooms and equipment: entry, visitors, secure areas, cameras and equipment. Kettle & Crane's KC-STD-04 includes the locked network cabinet and 30 days of camera footage.
plan: A document that says, before a large event happens, how the organization will respond: who decides, who does what and in what order. Procedures handle single tasks; plans such as the BCP and DRP handle whole situations.
playbook: The broader plan for handling one type of incident, such as ransomware, with goals, roles and decision points. It often calls several runbooks for the technical steps.
policy: A high-level, mandatory statement approved by senior management of what the organization requires and why. Every policy has a purpose, scope, rules, roles, exceptions and enforcement, and approval and review.
post-quantum encryption: Encryption methods designed to resist attacks by future quantum computers. NIST published its first standards for them (FIPS 203, 204 and 205) in August 2024.
privacy notice: The privacy document published on the website. It tells customers what personal data is collected and why, who it is shared with, and how to exercise their rights.
privacy policy: A policy that sets how the organization collects, uses, shares, protects and deletes personal data, built on data minimization, purpose limits and people's rights. The term can also mean the public privacy notice.
privilege creep: The build-up of access people no longer need as they change jobs, such as Jo still being able to issue refunds after moving to buying. Access reviews catch it.
probability: Likelihood expressed as a number from 0 to 1 or as a percentage. For example, a 20% probability per year means about once every five years.
procedure: A mandatory document giving the exact, ordered steps to carry out one task. The exam's two kinds are SOPs and runbooks.
profile: A group of benchmark recommendations. In CIS Benchmarks, Level 1 is a sensible low-impact starting point, and Level 2 adds stricter settings that can break things if you skip testing.
purge: The middle sanitization level, which defeats even laboratory recovery using methods such as a drive's built-in sanitize command or cryptographic erase. The media can still be reused.

Q

qualitative analysis: Risk analysis that uses words or ranks such as low, medium and high, or 1 to 5. It is fast and easy to explain, but subjective, and the results cannot be added up.
quantitative analysis: Risk analysis that uses money for impact and probability for likelihood, so a risk can be compared directly with the cost of a fix. It needs good data; for example, R-03 worked out to about $700 a year.

R

RACI chart: A chart showing who is Responsible (does the work), Accountable (owns the result, one person only), Consulted (asked before) and Informed (told after) for each task. Kettle & Crane used one for treating R-01.
ransomware: Malware that encrypts an organization's data so work stops, usually with a demand for payment to unlock it. Ransomware encrypting the order database is Kettle & Crane's risk R-01.
reference architecture: A tested template design that shows which parts a system needs and how they connect securely. Alex adapted a cloud provider's reference architecture for a small web store.
remote wipe: Erasing data on a device from a distance. Under BYOD, Kettle & Crane can erase only the work area of a lost or departing person's phone, never personal data.
request for comments (RFC): A numbered technical document for the internet community, mostly from the IETF, whose text never changes once published. Some RFCs define standards, such as RFC 8446 for TLS 1.3, while others only give information or advice.
request for proposal (RFP): A buying document sent to vendors to ask for offers. It is not to be confused with an RFC.
residual risk: The risk that remains after controls or treatment are applied, which must fit within the risk appetite or be accepted by management. R-01's residual score is 2 × 4 = 8.
retention: Keeping data for a set period that comes from a law, contract or business need, then disposing of it. Keeping data too long is a risk, and deleting it too early can break the law.
retention schedule: The written list of data types and how long each is kept, with the reason. For example, Kettle & Crane keeps tax records for 7 years and camera footage for 30 days.
reviews: Planned checks that keep the risk register accurate, either on a schedule or triggered by incidents, major changes, new advisories, new laws or audit findings. Sam's move to a new shop platform triggered a review of R-02.
risk: The chance that a threat uses a vulnerability and causes harm, together with how bad that harm would be. Each risk is written as one sentence naming a threat, a weakness and a harm.
risk analysis: Studying each risk closely to work out its impact, its likelihood, its owner and the current mitigations, using a qualitative or quantitative method.
risk appetite: The amount and type of risk an organization is willing to accept to reach its goals, set by top management. Morgan's statement sets a low appetite for risks to customer data, and the appetite line sits at a score of 9.
risk appetite types (conservative, neutral, expansionary): Labels some frameworks use for an organization's overall risk appetite. Conservative avoids risk, neutral is balanced, and expansionary accepts more risk for growth.
risk assessment: Turning a list of risks into a ranked list through scoring and categorization, so the worst risks are dealt with first. Unlike a BIA, it starts from threats.
risk identification: Finding and describing the risks an organization faces before they cause harm. Sources include the asset list, scans, advisories, past incidents and staff interviews.
risk management: The ongoing loop of identifying, assessing and analyzing, recording, treating and reviewing risks. It tells Alex what to fix first and records what the company chose to live with.
risk matrix: A grid of likelihood against impact showing every possible score, where risks farther up and right need action sooner. With each risk's ID placed in its cell, it becomes the heat map Morgan reads monthly.
risk owner: The person accountable for managing one risk: deciding its treatment, making sure it happens and reporting on it, usually the owner of the main affected asset, such as Priya for R-01. The risk owner does not have to do the technical work.
risk register: The single shared record of an organization's known risks, with one row per risk recording its description, category, owner, score, current mitigations, treatment, actions, status and review dates. Because it lists unfixed weak points, Kettle & Crane labels it Confidential.
risk score: Likelihood times impact, each rated 1 to 5, giving a value from 1 to 25. Scores fall into bands that each require an action: low (1–4), medium (5–9), high (10–16) and critical (20–25).
risk threshold: The exact line where an action is required, such as a score of 10, which needs Morgan's signature.
risk tolerance: A measurable limit that turns the appetite into numbers for one area or risk. At Kettle & Crane, owners may accept scores 1–9, only Morgan may accept 10–16, and nobody may accept 20–25.
risk treatment: The risk owner's decision about what to do with an analyzed risk: transfer, accept, avoid or mitigate it. A big risk often gets two of these.
root: The all-powerful administrator account on Linux. Kettle & Crane's SSH baseline bans logging in directly as root.
RPO (recovery point objective): How much recent data the business can afford to lose, measured in time. Café orders need 4 hours, which exposed the gap with Kettle & Crane's once-a-day backups.
RSA: A widely used public-key method, named after its inventors; Kettle & Crane requires keys of at least 2048 bits (3072 for new keys). Because future quantum computers could break it, NIST IR 8547 deprecates it after 2030 and disallows it after 2035.
RTO (recovery time objective): How fast a process must be running again after an outage, which must be shorter than the MTD. For café orders it is 1 day.
runbook: Detailed technical steps for one specific operational situation, such as an alert or a failure, and often partly automated. Runbook RB-03 isolates and scans a laptop when malware is found.

S

safe harbor: A promise in a vulnerability disclosure policy not to take legal action against people who report flaws in good faith and follow the rules.
sanitization: Making data on media impossible to recover with a stated level of effort. NIST SP 800-88 names three levels: clear, purge and destroy.
security categorization: Rating a system (not a risk) by the impact of losing its confidentiality, integrity or availability, as US government systems do with FIPS 199.
security incident: An event that harms, or threatens, the confidentiality, integrity or availability of information or systems.
Security+: CompTIA's entry-level security certification, which tests broad basic security knowledge. Its exam SY0-801 includes objectives on governance, risk and compliance, such as security policies and risk management.
security.txt: A small text file defined by RFC 9116, placed at /.well-known/security.txt on a website, that tells finders where to report flaws. Its Contact and Expires fields are required.
semi-quantitative: Scoring with numbered scales such as 1 to 5, where the numbers are ranks, not dollars.
separation of duties: The principle that no single person controls every step of a sensitive task. For example, whoever adds a new supplier cannot also approve payments to it.
shadow IT: Cloud services or tools that staff sign up for on their own, without IT knowing, like Jo's free online spreadsheet for supplier prices. Shadow IT makes finding assets harder.
shoulder surfing: Reading someone's screen or papers over their shoulder. A clean desk policy helps defend against it.
SLE (single loss expectancy): The cost of one occurrence of a risk. For one stolen laptop it is $2,100 (the new laptop plus Alex's setup time).
social engineering: Manipulating people into giving access or information. A vulnerability disclosure policy forbids finders from trying it on staff.
solid-state drive (SSD): Flash storage that spreads writes across hidden spare areas, so simple overwriting may miss data. SSDs need purge or destroy, and degaussing does nothing to them.
SSH (Secure Shell): An encrypted remote login protocol that administrators use to manage servers such as Kettle & Crane's order server.
sshd -T: A command that makes the SSH server read its configuration file (chosen with -f) and print every effective setting. Alex used it to check the server against the baseline.
SSL (Secure Sockets Layer): The older protocol that TLS replaced. Kettle & Crane's encryption standard does not allow it.
stakeholder: Anyone affected by a decision, such as staff, managers, customers, partners or regulators.
stakeholder involvement: Bringing everyone affected by a risk decision into the process, so the decision uses their knowledge and has their support. Priya, for example, knows how long cafés will wait.
stakeholder ownership: Making sure every asset and every risk has one named person from the business who is accountable for it, rather than leaving it to "belong to IT".
standard: A mandatory, specific and measurable requirement that supports a policy and can be checked with a yes or a no, such as "AES-256 on every laptop". Standards are internal (your own) or external (from outside bodies).
standard operating procedure (SOP): A written, step-by-step instruction for a routine task, so that it is done the same correct way every time by whoever does it. KC-SOP-07 covers a staff member who leaves.
Standards Track: The RFC status, shown on an RFC's first page, for documents that define internet standards. Informational and Best Current Practice RFCs give information or advice instead.
STIG (Security Technical Implementation Guide): A set of required security settings for one product on US Department of Defense systems, published by DISA. It is a close neighbor of a benchmark.
sudo: A Linux command that runs another command with administrator rights. Alex used it in front of sshd -T.

T

tabletop exercise: A test of a plan where the team talks through a made-up disaster, used to keep continuity and recovery plans current.
threat: Anything that could cause harm, such as a criminal group or a flood.
TLS (Transport Layer Security): The protocol that encrypts web traffic, the "s" in https. Kettle & Crane allows only TLS 1.2 (RFC 5246) and 1.3 (RFC 8446), since RFC 8996 retired versions 1.0 and 1.1.
transferring: A risk treatment that moves a risk's financial impact to another party, usually through insurance or an outsourcing contract. Accountability and reputation stay with the company.

U

USB (Universal Serial Bus): The common port and drive type for plugging devices into computers. The AUP forbids connecting unknown USB drives.

V

vulnerability: A weakness a threat could use, such as an unpatched server or a shop admin login with no second factor.
vulnerability disclosure policy: A policy that tells outsiders how to report security flaws, which systems are in scope and what the organization promises, including safe harbor and a timeline for public disclosure. It is advertised through security.txt.

W

work profile: A separate, managed area on a personal device that holds work apps and data apart from personal photos and messages. Under BYOD, this is the only part the company manages and can wipe.
WPA3: The current Wi-Fi security standard. Alex turned it on for the new access point by following the vendor's implementation guide.

Z

Zero Trust: A design approach where no device or user is trusted just because of where it sits on the network. It is described in NIST SP 800-207.