Glossary

Compliance Program Structure

How a compliance program is organized when built, its scope, framework mappings, control set, evidence processes, tooling, team, and audit cadence, assembled into a coherent program rather than scattered, ad-hoc efforts.

Compliance Roadmap

A forward-looking plan that sequences a compliance program's goals over time, which frameworks to pursue, gaps to close, and milestones to hit, so the program advances deliberately rather than reactively.

Compliance Team Structure

How the people responsible for compliance are organized, roles, reporting lines, and the split between dedicated compliance staff and control owners across the business, so accountability is clear and the workload is sustainable.

Compliance Tool Selection

The process of evaluating and choosing compliance and GRC tooling when building a program, weighing framework coverage, evidence automation, integrations, usability, and cost against the organization's actual needs.

Compliance Tooling

The software a GRC analyst uses day to day to run a compliance program, GRC and evidence-management platforms that track controls, store evidence, manage tasks, and report status. This entry focuses on using such tooling in daily GRC work.

Compliance Value Quantification

Compliance value quantification estimates how a capability supports a specific legal, contractual, standard, or assurance requirement and reduces the cost or risk of satisfying it.

Compliance and B2B Sales

The role compliance plays in winning business-to-business deals, where customers require proof of security, such as a SOC 2 report or ISO 27001 certificate, before buying. Compliance becomes a sales enabler, not just a risk function.

Compliance as Code

Expressing compliance requirements as machine-readable, version-controlled policy that is automatically evaluated against cloud infrastructure, so compliance checks run continuously and consistently like software tests rather than as manual reviews.

Compliance vs Security

The distinction between meeting a framework's requirements (compliance) and actually being protected against attack (security). An organization can be fully compliant yet insecure, and secure yet not formally compliant; the two overlap but are not the same.

Comprehensive Identification

A thorough approach to finding risks that combines multiple techniques, asset-based, scenario-based, threat-based, and external sources, so the organization surfaces a complete picture of its risks rather than missing whole categories.

Compromised Cloud Identity Playbook

A compromised cloud identity playbook branches containment and investigation by principal and credential type, such as a long-term key, federated session, role credential, user token, service principal, managed identity, or workload federation.

Compromised IAM Credentials Playbook

A cloud incident-response playbook for when cloud access keys or identity credentials are stolen, covering how to confirm the compromise, scope what the attacker did, revoke and rotate credentials, and recover, using cloud-native tools.

Compute Metadata Security Assessment

Compute metadata security assessment reviews whether workloads need instance metadata and how session protocols, hop limits, network boundaries, tag exposure, attached identity, defaults, and enforcement protect it.

Compute Security Assessment

Evaluating the security of cloud compute resources, virtual machines, instances, and the services running on them, checking for public exposure, missing patches, weak access, and insecure configurations during a cloud assessment.

Concurrency and Idempotency Testing

Concurrency and idempotency testing checks whether simultaneous, duplicated, delayed, or retried operations preserve one-time and atomic business invariants.

Conditional Access

An access-control approach that grants, challenges, or blocks authentication based on conditions like user risk, device health, location, and the sensitivity of what is being accessed, so access decisions adapt to context rather than being all-or-nothing.

Conditional Access (Cloud)

Conditional access as implemented and operated by a cloud security engineer, the policies in a cloud identity platform that gate access to cloud resources based on risk, device, location, and identity signals.

Conditional Access Configuration

The detailed setup of conditional access policies in a directory service like Microsoft Entra ID, defining the conditions, signals, and controls that govern sign-ins, with attention to avoiding gaps, lockouts, and misconfigurations attackers exploit.

Conditional Access Failure Detection

Conditional Access failure detection identifies blocked or unsatisfied sign-ins and evaluates whether they represent hostile attempts, broken client or device state, policy rollout problems, or user support needs.

Confidence Assessment

Judging and clearly stating how much trust to place in a piece of intelligence, based on source reliability and corroboration. It lets a SOC act on intelligence proportionately rather than treating every claim as equally certain.

Confidentiality

Confidentiality means information is only accessible to people, systems, or services that are authorized to see it.

Configuration Assessment

Checking cloud resource configurations against secure-configuration standards and benchmarks to find misconfigurations, such as public exposure, disabled logging, or weak settings, that create risk. It is the core function behind cloud posture management.

Configuration Baseline

An approved, versioned set of required configuration values, permitted deviations, scope, ownership, validation methods, and change controls for a technology population.

Configuration Baselines

Defined sets of secure configuration settings that systems must conform to, serving as the known-good reference for hardening. Deviations from the baseline indicate drift or misconfiguration to correct.

Configuration Evidence

Compliance evidence drawn from how systems are configured, such as exports or screenshots showing encryption is on, ports are restricted, or logging is enabled, proving a technical control is actually implemented as required.

Configuration as Code

Defining system and security configurations in version-controlled code that is applied automatically, so hardened settings are consistent, repeatable, and auditable across many systems rather than configured by hand.

Connection State

Whether and how a network connection is established and tracked, such as the stages of a TCP connection, which lets firewalls and analysts reason about traffic as conversations rather than isolated packets.

Connector Onboarding

Connector onboarding maps target identity and entitlement semantics, supported operations, failure behavior, credentials, limits, evidence, tests, reconciliation, and accountable ownership into IGA.

Consent

In identity systems, the user's explicit permission for an application to access their identity information or act on their behalf, captured during authorization flows like OAuth so access is granted with the user's awareness and agreement.

Consent Purpose and Withdrawal

Consent purpose and withdrawal keep each consent specific, informed, freely given, unambiguous, granular, and as easy to withdraw as to grant when consent is the approved lawful basis.

Consent Record Integrity

Consent record integrity preserves the subject, controller, purpose, data, recipient description, notice and consent version, language, affirmative action, time, context, and withdrawal without unauthorized alteration.