Glossary

A security principle which mandates that users should be granted the least amount of permissions necessary to perform their job.

The GDPR mandates that data controllers must demonstrate a legal basis for data processing. The six legal bases for processing listed in the law are: consent, necessity, contract requirement, legal obligation, protection of data subject, public interest, or legitimate interest of the controller.

A deliberate configuration change within a system by a malicious actor, typically to create back-door access or exfiltrate information. While the original change in configuration might involve a compromised account or other vulnerability, a malconfiguration has the benefit of offering long term access using legitimate tools, without further need of a password or after a vulnerability is closed.

A term that represents a number of different types of malicious software that is intended to infiltrate computers or computer network.

A database with storage, data, and compute services that is managed and maintained by a third-party provider instead of by an organization's IT staff.

Sensitive information swapped with arbitrary data intended to resemble true production data, rendering it useless to bad actors. It's most frequently used in test or development environments, where realistic data is needed to build and test software, but where there is no need for developers to see the real data.

Data that describes other data. For databases, metadata describes properties of the data store itself, as well as the definition of the schema.

An acronym for Multifactor Authentication. This represents an authentication process that requires more than one factor of verification. An example would be a login that requires a username and password combination, as well as an SMS-code verification, or the use of a physical security key.

What is Microsoft 365?

A dangerous or unapproved configuration of an account that could potentially lead to a compromise typically done by a well-intentioned user attempting to solve an immediate business problem. While there is no malicious intent, misconfiguration is actually the leading cause of data loss or compromise.

Misplaced data occurs when any data moves from an approved environment to an unapproved environment.

In data security or privacy terms, this is the breach of a legal duty to protect personal information.

An acronym for the National Institute of Standards and Technology. NIST is a unit of the US Commerce Department tasked with promoting and maintaining measurement standards. NIST leads the development and issuance of security standards and guidelines for the federal government.

Notice at Collection, is a transparency requirement that compels businesses to inform consumers, at or before the point of collection, about the category of personal information (PI) that they collect.

An acronym for nonpublic personal information.

NYDFS is an acronym for the New York Department of Financial Services.

Sensitive information swapped with arbitrary data intended to resemble true production data, rendering it useless to bad actors. It's most frequently used in test or development environments, where realistic data is needed to build and test software, but where there is no need for developers to see the real data.

When an individual makes an active indication of choice, such as checking a box indicating willingness to share information with third parties.

Either an explicit request for a user to no longer share information or receive updates from an organization, or a lack of action that implies that the choice has been made, such as when a person does not uncheck a box indicating willingness to share information with third parties.

Any data collection technique that gathers information automatically, with or without the end user’s knowledge.

An acronym for the Payment Card Industry Data Security Standard. This is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.

Protected health information (PHI) is a distinct category of sensitive data that is intimately linked to an individual's health and healthcare services.

Personally identifiable information (PII) refers to any information that can be used to identify an individual directly or indirectly.

Learn what PSD2 compliance is, why it matters, and how businesses can meet regulatory requirements for secure online payments and open banking

Purpose limitation or data use limitations requires that businesses ensure that they limit the use of personal information (PI) to the purposes for which it was collected.The GDPR provides more leeway when it comes to purpose limitation.

A type of malware that encrypts the files on an endpoint device using a mechanism for which only the attacker has the keys. While the attacker will offer the key in exchange for payment, fewer than half of victims that do pay actually recover their files.

The idea that organizations should only retain information as long as it is pertinent.

An individual’s right to request and receive their personal data from a business or other organization.

An individual’s right to have their personal data deleted by a business or other organization possessing or controlling that data.

The “right to be informed,” is a transparency requirement that compels businesses to inform data subjects, at the time of collection, about the personal data collected, purpose for processing the personal data, period of the personal data, and who the personal data will be shared with.

The right for individuals to correct or amend information about themselves that is inaccurate.

An individual’s right to have their personal data deleted by a business or other organization possessing or controlling that data.

In cybersecurity, a risk assessment is a comprehensive analysis of an organization to identify vulnerabilities and threats. The goal of a risk assessment is to identify an organization’s risks and make recommendations for mitigating those risks.

The Sarbanes-Oxley Act (SOX) is a federal law designed to improve financial transparency and responsibility for U.S. public companies. It’s enactment in 2002 was prompted by several well-publicized accounting scandals established a number of standards for public companies to follow.

The Sarbanes-Oxley Act (SOX) establishes auditing and financial accounting standards for publicly traded companies.

Any information that is protected against unwarranted disclosures, for reasons either legal, ethical, privacy, financial, or otherwise. This can include, but is not limited to: health data, personal information, confidential data such as trade secrets, etc...

Sensitive data discovery and classification is a process used to identify and categorize sensitive or confidential information within an organization's digital assets.

Data that must be protected from unauthorized access to safeguard the privacy or security of an individual or organization. According to NIST, this represents information, the loss, misuse, or unauthorized access to or modification of, that could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act), but that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.GDPR refers to this as sensitive personal data that represents a mixture of private opinions and health information that falls into specialized, legally protected categories. Businesses must treat this data with the highest security.

Sensitive personally identifiable information (SPII) is a subset of PII, but with heightened significance and risks.

Any unapproved cloud-based account or solution implemented by an employee for business use. It might also include the use of an unknown account with an approved provider, but administered by the user rather than corporate IT.

An unapproved cloud application that is connected in some way (typically by API) to that organization's SaaS or IaaS with access to corporate data but without permission from the organization.

Stale data is data collected that is no longer needed by an organization for daily operations. Sometimes the data collected was never needed at all. Most organizations store a significant amount of stale data.

Data in a standardized format, with a well-defined structure that is easily readable by humans and programs. Most structured data is typically stored in a database. Though structured data only comprises 20 percent of data stored worldwide, its ease of accessibility and accuracy of outcomes makes it the foundation of current big data research and applications.

Tokenization entails the substitution of sensitive data with a non-sensitive equivalent, known as a token. This token then maps back to the original sensitive data through a tokenization system that makes tokens practically impossible to reverse without them. Many such systems leverage random numbers to produce secure tokens. Tokenization is often used to secure financial records, bank accounts, medical records and many other forms of personally identifiable information (PII).

Understand UK GDPR and the Data Protection Act 2018, key obligations, data rights, and how to ensure compliance in the UK post-Brexit

Unmanaged data stores are deployments that must be completely supported by development or infrastructure teams, without the assistance of the cloud service provider. This additonal logistical burden may be undertaken by teams aiming to comply with data sovereignty requirements, abide by private network or firewall requirements for security purposes, or resource requirements beyond the provider's (database as a service) DBaaS size or IOPS

Data lacking a pre-defined model of organization or that does not follow one. Such data is often text-heavy, but can also include facts, figures and time and date information. The resulting irregularities and ambiguities make unstructured data much harder for programs to understand than data stored in databases with fields or documents with annotations. Many estimates claim unstructured data comprises the vast majority of global data, and that this category of data is growing rapidly.

A vulnerability is a weakness that could be exploited or triggered by a threat source in internal controls, procedures for systems security, an information system, or implementation. A weakness is synonymous with deficiency and may result in security or privacy risks or both.

AI governance defines the policies, frameworks, and accountability structures that guide how AI systems are built, used, and monitored across the enterprise. It connects risk management, compliance, and AI Data Security into a single operating model that teams can apply consistently, even as AI tools and use cases change.

Learn what AI security compliance means in 2025. Discover key frameworks like EU AI Act, NIST AI RMF, implementation strategies, and enforcement risks

As AI becomes a bigger part of how companies operate, it also brings new risks. Sensitive data, complex models, and automated decision systems can all create blind spots that traditional security tools are not designed to catch.

Learn what AI threat detection is and how it identifies prompt injection, model poisoning, and data extraction attacks targeting AI systems

Learn what AI TRiSM is, Gartner's framework for AI trust, risk, and security management, its four pillars, and how to implement it for responsible AI adoption.

Learn what prompt injection is, how attackers exploit LLMs through direct and indirect attacks, real-world examples, and enterprise defense strategies.

Shadow AI is the unauthorized use of AI tools within a work environment, and this unauthorized use has a large price tag. According to IBM’s latest data, organizations with high levels of shadow AI exposure face an average of $670,000 in breach costs.‍

Misplaced data occurs when any data moves from an approved environment to an unapproved environment.

In data security or privacy terms, this is the breach of a legal duty to protect personal information.

An acronym for the National Institute of Standards and Technology. NIST is a unit of the US Commerce Department tasked with promoting and maintaining measurement standards. NIST leads the development and issuance of security standards and guidelines for the federal government.

Notice at Collection, is a transparency requirement that compels businesses to inform consumers, at or before the point of collection, about the category of personal information (PI) that they collect.

An acronym for nonpublic personal information.

NYDFS is an acronym for the New York Department of Financial Services.

Sensitive information swapped with arbitrary data intended to resemble true production data, rendering it useless to bad actors. It's most frequently used in test or development environments, where realistic data is needed to build and test software, but where there is no need for developers to see the real data.

When an individual makes an active indication of choice, such as checking a box indicating willingness to share information with third parties.

Either an explicit request for a user to no longer share information or receive updates from an organization, or a lack of action that implies that the choice has been made, such as when a person does not uncheck a box indicating willingness to share information with third parties.

Any data collection technique that gathers information automatically, with or without the end user’s knowledge.

An acronym for the Payment Card Industry Data Security Standard. This is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.

Protected health information (PHI) is a distinct category of sensitive data that is intimately linked to an individual's health and healthcare services.

Personally identifiable information (PII) refers to any information that can be used to identify an individual directly or indirectly.

Learn what PSD2 compliance is, why it matters, and how businesses can meet regulatory requirements for secure online payments and open banking

Purpose limitation or data use limitations requires that businesses ensure that they limit the use of personal information (PI) to the purposes for which it was collected.The GDPR provides more leeway when it comes to purpose limitation.

A type of malware that encrypts the files on an endpoint device using a mechanism for which only the attacker has the keys. While the attacker will offer the key in exchange for payment, fewer than half of victims that do pay actually recover their files.

The idea that organizations should only retain information as long as it is pertinent.

An individual’s right to request and receive their personal data from a business or other organization.

An individual’s right to have their personal data deleted by a business or other organization possessing or controlling that data.

The “right to be informed,” is a transparency requirement that compels businesses to inform data subjects, at the time of collection, about the personal data collected, purpose for processing the personal data, period of the personal data, and who the personal data will be shared with.

The right for individuals to correct or amend information about themselves that is inaccurate.

An individual’s right to have their personal data deleted by a business or other organization possessing or controlling that data.

In cybersecurity, a risk assessment is a comprehensive analysis of an organization to identify vulnerabilities and threats. The goal of a risk assessment is to identify an organization’s risks and make recommendations for mitigating those risks.

The Sarbanes-Oxley Act (SOX) is a federal law designed to improve financial transparency and responsibility for U.S. public companies. It’s enactment in 2002 was prompted by several well-publicized accounting scandals established a number of standards for public companies to follow.

The Sarbanes-Oxley Act (SOX) establishes auditing and financial accounting standards for publicly traded companies.

Any information that is protected against unwarranted disclosures, for reasons either legal, ethical, privacy, financial, or otherwise. This can include, but is not limited to: health data, personal information, confidential data such as trade secrets, etc...

Sensitive data discovery and classification is a process used to identify and categorize sensitive or confidential information within an organization's digital assets.

Data that must be protected from unauthorized access to safeguard the privacy or security of an individual or organization. According to NIST, this represents information, the loss, misuse, or unauthorized access to or modification of, that could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act), but that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.GDPR refers to this as sensitive personal data that represents a mixture of private opinions and health information that falls into specialized, legally protected categories. Businesses must treat this data with the highest security.

Sensitive personally identifiable information (SPII) is a subset of PII, but with heightened significance and risks.

Any unapproved cloud-based account or solution implemented by an employee for business use. It might also include the use of an unknown account with an approved provider, but administered by the user rather than corporate IT.

An unapproved cloud application that is connected in some way (typically by API) to that organization's SaaS or IaaS with access to corporate data but without permission from the organization.

Stale data is data collected that is no longer needed by an organization for daily operations. Sometimes the data collected was never needed at all. Most organizations store a significant amount of stale data.

Data in a standardized format, with a well-defined structure that is easily readable by humans and programs. Most structured data is typically stored in a database. Though structured data only comprises 20 percent of data stored worldwide, its ease of accessibility and accuracy of outcomes makes it the foundation of current big data research and applications.

Tokenization entails the substitution of sensitive data with a non-sensitive equivalent, known as a token. This token then maps back to the original sensitive data through a tokenization system that makes tokens practically impossible to reverse without them. Many such systems leverage random numbers to produce secure tokens. Tokenization is often used to secure financial records, bank accounts, medical records and many other forms of personally identifiable information (PII).

Understand UK GDPR and the Data Protection Act 2018, key obligations, data rights, and how to ensure compliance in the UK post-Brexit

Unmanaged data stores are deployments that must be completely supported by development or infrastructure teams, without the assistance of the cloud service provider. This additonal logistical burden may be undertaken by teams aiming to comply with data sovereignty requirements, abide by private network or firewall requirements for security purposes, or resource requirements beyond the provider's (database as a service) DBaaS size or IOPS

Data lacking a pre-defined model of organization or that does not follow one. Such data is often text-heavy, but can also include facts, figures and time and date information. The resulting irregularities and ambiguities make unstructured data much harder for programs to understand than data stored in databases with fields or documents with annotations. Many estimates claim unstructured data comprises the vast majority of global data, and that this category of data is growing rapidly.

A vulnerability is a weakness that could be exploited or triggered by a threat source in internal controls, procedures for systems security, an information system, or implementation. A weakness is synonymous with deficiency and may result in security or privacy risks or both.

AI governance defines the policies, frameworks, and accountability structures that guide how AI systems are built, used, and monitored across the enterprise. It connects risk management, compliance, and AI Data Security into a single operating model that teams can apply consistently, even as AI tools and use cases change.

Learn what AI security compliance means in 2025. Discover key frameworks like EU AI Act, NIST AI RMF, implementation strategies, and enforcement risks

As AI becomes a bigger part of how companies operate, it also brings new risks. Sensitive data, complex models, and automated decision systems can all create blind spots that traditional security tools are not designed to catch.

Learn what AI threat detection is and how it identifies prompt injection, model poisoning, and data extraction attacks targeting AI systems

Learn what AI TRiSM is, Gartner's framework for AI trust, risk, and security management, its four pillars, and how to implement it for responsible AI adoption.

Learn what prompt injection is, how attackers exploit LLMs through direct and indirect attacks, real-world examples, and enterprise defense strategies.

Shadow AI is the unauthorized use of AI tools within a work environment, and this unauthorized use has a large price tag. According to IBM’s latest data, organizations with high levels of shadow AI exposure face an average of $670,000 in breach costs.‍