CISO Glossary: Cybersecurity and Governance Terms, Defined

TL;DR: This glossary defines 37 terms a security leader is expected to use precisely: the core threat and defense vocabulary from CISA's NICCS glossary, the six NIST Cybersecurity Framework Functions, and the SEC's materiality test for cybersecurity incident disclosure. Each definition traces to the government document that states it, not a vendor blog.

Risk and threats

Risk is the potential for an unwanted or adverse outcome resulting from an incident, event or occurrence, considered together with the likelihood that a threat exploits a vulnerability and the consequences if it does.

Threat is a circumstance or event with the potential to exploit a vulnerability; it can also be the person, group, organization or nation carrying out or intending to carry out harmful activity. A threat actor (or threat agent) is that individual, group, organization or government itself.

Threat assessment is the process of identifying or evaluating events or actors that could harm life, information, operations or property, used to prioritize where a security program spends effort.

Vulnerability is a characteristic or specific weakness that leaves an organization or asset open to exploitation by a given threat, or susceptible to a given hazard.

An adversary is any individual, group, organization or government that carries out, or intends to carry out, harmful activities against a system or organization. An advanced persistent threat (APT) is an adversary with sophisticated expertise and significant resources, able to sustain long-running, targeted operations rather than a single opportunistic attack.

An insider threat is a person or group within an organization who poses a potential risk by violating security policies, whether through malice, negligence or compromise.

Social engineering is the use of deception to manipulate individuals into revealing confidential or personal information, or into taking an action, that can be used for fraud or further compromise. Phishing is its most common digital form: messages designed to deceive a recipient into handing over sensitive information or credentials.

Malware is software that compromises a system's operation by performing an unauthorized function or process; the term covers viruses, worms, trojans and the rest of what used to be called malicious code. Ransomware is a specific kind of malware built to deny a user or organization access to their own files, typically by encrypting them, until a demand is met.

Detection and defense

Access control is the process of granting or denying specific requests to obtain and use information or a related resource, and to enter a facility or system. Authentication is the mechanism underneath it: verifying the identity of a user, device or system, and separately, verifying the source and integrity of data, typically through a password, a biometric factor or a token.

Encryption is the process of transforming readable data (plaintext) into a form unauthorized people cannot easily read (ciphertext). A firewall limits network traffic between networks or systems according to a set of access rules, in hardware or software. Antivirus software is a program designed to detect, prevent and remove malicious software. An allowlist is a defense built the other way around: it explicitly permits specific, trusted entities and denies everything else by default.

An air gap physically separates or isolates a system from other systems or networks, so nothing crosses between them without a deliberate, manual step.

Zero Trust is a security model that requires strict identity verification for every user and device seeking access to a resource and does not trust anything by default, regardless of whether the request originates inside or outside a traditional network perimeter.

Penetration testing is an evaluation method in which assessors actively search for vulnerabilities and attempt to circumvent a system's security features, to find what a real attacker would find first. A red team is a group authorized to emulate a potential adversary's attack capabilities against an organization, so defenders can measure their own detection and response; a blue team is the group that defends against that mock attack, including the vulnerability evaluation and mitigation recommendations that follow it.

A security operations center (SOC) is an organization's central hub for security monitoring: it collects data from networks, servers, endpoints and other assets and uses that data, often with automation, to identify, prioritize and respond to potential threats. An alert is a notification that a specific attack has been detected or directed at an organization's systems. An indicator of compromise (IoC) is a piece of forensic data, such as a file hash, IP address or log pattern, that serves as a clue or evidence that a breach has occurred.

Incidents and supply chain

An incident is an occurrence that actually or potentially results in adverse effects on an information system or the information it processes, stores or transmits, and that may require a response to limit the damage. A data breach is a specific kind of incident: the unauthorized movement or disclosure of sensitive information to a party not authorized to see it, usually outside the organization.

Supply chain risk management is the process of identifying, analyzing and assessing the risk a vendor, supplier or partner introduces, then accepting, avoiding, transferring or controlling that risk to an acceptable level, weighing the cost of each option against the benefit.

Governance: the NIST CSF Functions

The NIST Cybersecurity Framework 2.0, published February 26, 2024, organizes cybersecurity outcomes into six Functions. They are not a sequence; an organization works all six at once.

Govern establishes, communicates and monitors an organization's cybersecurity risk management strategy, expectations and policy. It covers organizational context, cybersecurity and supply chain strategy, roles and authorities, and oversight, and it informs what the other five Functions should prioritize.

Identify builds the organization's understanding of its own assets, suppliers and related cybersecurity risks, so it can prioritize effort consistent with its risk strategy.

Protect covers the safeguards used to manage cybersecurity risk once assets and priorities are known, limiting how far an adverse event can spread or how much harm it can cause.

Detect covers the activities that find a cybersecurity event has occurred, so it can be found in a timely way rather than discovered weeks later.

Respond covers the activities taken once an incident is detected, aimed at containing the damage it could otherwise cause.

Recover covers maintaining plans for resilience and restoring any capability or service an incident disrupted, so operations return to normal.

Our own first-90-days plan for a new CISO is organized around these same six Functions; our AI governance guide applies Govern, Map, Measure and Manage from a separate NIST framework built for AI risk specifically.

Governance: securities disclosure

Materiality is a securities-law test, not a severity rating. Information is material if there is a substantial likelihood a reasonable investor would consider it important to an investment decision, or if it would significantly alter the total mix of information already available. For a cybersecurity incident, the SEC's own compliance guide directs registrants to assess materiality "through the lens of the reasonable investor," weighing quantitative and qualitative factors together, not a dollar threshold alone.

A material cybersecurity incident, under Item 1.05 of Form 8-K, is one a registrant has determined, without unreasonable delay, meets that materiality test. The filing is due within four business days of that determination, not of discovery, and must describe the material aspects of the incident's nature, scope and timing, plus its material or reasonably likely material impact, without technical detail that would impede the registrant's own response. Our SEC Item 1.05 materiality decision guide and SEC cybersecurity disclosure rules guide both walk through this test with real filings.

How we define terms here

Every definition above traces to the government document that states it: CISA's NICCS glossary for the general security vocabulary, NIST's own Cybersecurity Framework 2.0 publication for the six Functions, and the SEC's small entity compliance guide for the disclosure terms. Where a source uses several sentences, we have kept the operative one and written the rest in our own words; nothing here is a vendor's marketing definition of its own product category.

This list grows as our coverage does. If a term shows up often in our Wire records or analysis and is not here yet, tell us.