Glossary

GDPR

The European Union's General Data Protection Regulation, a comprehensive privacy law governing how organizations collect, process, and protect the personal data of people in the EU, with strict obligations and significant penalties for non-compliance.

GDPR Cloud

Applying GDPR requirements specifically to cloud environments, ensuring personal data in cloud services meets obligations for lawful processing, data residency, transfers, breach notification, and shared responsibility with the provider.

GDPR Compliance Posture

An organization's overall state of GDPR readiness within a security program, how well its policies, controls, data handling, and evidence actually satisfy GDPR, assessed and improved as part of building the program.

GDPR Data Mapping

Building the inventory of personal data flows required for GDPR, what personal data the organization holds, where it comes from, how it is used, and where it goes, as a foundation for the program's GDPR compliance.

GDPR Transfer Mechanisms

The legal tools that permit moving personal data out of the EU under GDPR, such as adequacy decisions, standard contractual clauses, and binding corporate rules, used to keep international transfers lawful.

GRC Analyst

A practitioner who carries out governance, risk, and compliance work, running risk assessments, mapping and testing controls, maintaining evidence, supporting audits, and tracking findings, to keep an organization's GRC program functioning.

GRC Audit Support

The GRC analyst's work of supporting audits, coordinating with auditors, gathering and presenting requested evidence, answering questions, and managing the resulting findings, so audits run smoothly and produce actionable outcomes.

GRC Career Path

The progression of roles within governance, risk, and compliance, from analyst through senior analyst and manager to GRC leadership, with branches into specializations like privacy, risk, or cloud GRC.

GRC Certifications

Professional certifications relevant to governance, risk, and compliance work, such as those in audit, risk, privacy, and information security management, that validate a GRC practitioner's knowledge and support career progression.

GRC Community

The professional community of GRC practitioners, through forums, associations, conferences, and peer networks, where people share practices, frameworks knowledge, and career guidance, helping members stay current and grow.

GRC Deliverables

The concrete outputs a GRC analyst produces, risk assessments and registers, control matrices, compliance reports, evidence packages, policies, and findings reports, that make the program's work visible and actionable to stakeholders.

GRC Leadership

The senior level of the GRC field, roles like GRC manager, director, or head of risk and compliance, that set strategy, build and run the program, manage teams, and represent GRC to executives and the board.

GRC Maturity

How developed and effective an organization's governance, risk, and compliance program is, from ad-hoc and reactive to integrated, proactive, and continuously improving, used to assess where a program stands and what to improve next.

GRC Program

The organized set of governance, risk, and compliance activities, policies, risk management, controls, compliance, audit support, and reporting, run as a coherent program with ownership, processes, and tooling rather than scattered tasks.

GRC Skills Development

Building the competencies a GRC practitioner needs, knowledge of frameworks and regulations, risk analysis, control testing, communication, and tooling, through study, practice, certifications, and experience over a career.

GRC Specializations

The focused subfields a GRC practitioner can develop expertise in, such as privacy, risk quantification, audit, third-party risk, or cloud GRC, allowing deeper specialization beyond generalist governance-risk-compliance work.

GRC Stakeholders

The people and groups a GRC program serves and works with, executives and the board, business and operations teams, auditors, regulators, IT and security, whose differing needs the GRC analyst must understand and balance.

GRC to Adjacent Roles

The career moves available from GRC into related fields, such as security operations, privacy, audit, security architecture, or management, leveraging GRC's broad exposure to frameworks, risk, and the business as a springboard.

GRC vs Operations

The distinction between GRC's oversight-and-assurance role and the operational teams that actually run controls, GRC sets policy, assesses risk, and verifies, while operations owns and performs the day-to-day security work.

GTFOBins

A curated catalog of legitimate Unix/Linux binaries that can be abused to bypass security controls or escalate privilege, such as a normally-benign tool that can run shell commands. Defenders use it to anticipate living-off-the-land abuse.

Gap Analysis from Metrics

Using measured data about a policy's performance, awareness scores, incident trends, compliance rates, to identify where it is falling short, so revisions target real, evidenced gaps rather than guesses.

Ghidra Workflow

The process of using Ghidra, a free reverse-engineering tool, to analyze a malware binary, loading the sample, navigating its disassembly and decompiled code, and annotating findings to understand how the malware works.

GitOps

An operational model where the desired state of infrastructure and applications is declared in Git and automatically reconciled to the live environment, making Git the single source of truth for deployments and changes.

GitOps Security

Securing the GitOps pipeline and its trust relationships, protecting the Git repository, signing commits and images, controlling what the reconciler can deploy, so the 'Git as source of truth' model cannot be subverted by an attacker.

Global Privacy Regulatory Landscape

The worldwide patchwork of privacy laws beyond the GDPR, such as US state laws, and regimes in other regions, that organizations operating across borders must track and reconcile, since requirements differ by jurisdiction.

Golden Image

A pre-configured, hardened base image, of a VM or container, that is built once to a secure standard and reused as the trusted starting point for new workloads, so every instance inherits a known-good, consistent configuration.

Government Intelligence

Threat intelligence produced or shared by government bodies, such as national cybersecurity agencies, providing advisories, indicators, and threat assessments that a SOC can use, often authoritative but sometimes broad or delayed.

GraphQL Security Testing

Testing GraphQL APIs for security weaknesses during a penetration test, probing for issues like overly permissive queries, missing authorization, injection, and abuse of GraphQL features such as introspection and nested queries.

Group Policy Hardening

Using Active Directory Group Policy to enforce secure configuration across many Windows systems at once, applying hardened settings, restrictions, and security baselines centrally rather than configuring each machine individually.

Groups

Collections of users (or other identities) managed together in identity systems, so access can be granted to a group once rather than to each member individually, simplifying access management and enabling role-based access.

GuardDuty Defender SCC

The native threat-detection services of the major clouds, AWS GuardDuty, Microsoft Defender for Cloud, and Google Security Command Center, which analyze cloud telemetry to detect threats and misconfigurations across an environment.