Glossary

Assumption and Limitation Register

An assumption and limitation register tracks unresolved facts, unavailable evidence, exclusions, scope constraints, validation owners, due dates, and consequences if an assumption is wrong.

Assurance Content Governance

Assurance content governance keeps customer-facing security and compliance material accurate, scoped, approved, classified, current, and withdrawable.

Assurance Limitation Statement

An assurance limitation statement identifies the criteria, scope, period, methods, sampling, exclusions, reliance, evidence constraints, changes, and uncertainty that bound a conclusion.

Asymmetric Encryption

Encryption that uses a public key and a private key instead of one shared key.

Atomic Red Team

An open library of small, focused tests that each reproduce a single attacker technique mapped to MITRE ATT&CK, letting defenders safely check whether their detections catch that specific behavior.

Atomic Test

A small, controlled test that executes or simulates one defined behavior to validate a telemetry or detection expectation without claiming full attack-chain coverage.

Atomic Tests

Small, single-technique tests that reproduce one specific attacker behavior so a detection engineer can confirm whether a rule detects it and what telemetry it produces.

Attack Chain Construction

Assembly of supported events and capabilities into a time-ordered or dependency-based intrusion narrative while distinguishing evidence from inference and missing links.

Attack Path Modeling

Representation of the identities, permissions, vulnerabilities, trust relationships, network reachability, and actions that could connect an initial condition to a harmful objective.

Attack Pattern

A recurring adversary approach that links objectives, preconditions, techniques, actions, and expected evidence without claiming every intrusion follows the same sequence.

Attack Patterns

Recurring sequences of attacker behavior that show up across many intrusions, such as phishing for initial access followed by persistence and data theft. Recognizing them helps defenders anticipate an attacker's next move.

Attack Surface

Attack surface is the set of places where an attacker could try to enter, influence, or abuse a system.

Attack Surface Reduction

Shrinking the number of ways an attacker could get in by removing or disabling unnecessary services, features, accounts, and exposure, so there is simply less to attack and defend.

Attack Tree Analysis

Attack tree analysis decomposes an adverse goal into alternative OR branches and combined AND steps or conditions that could achieve it.

Attorney-Client Privilege in IR

The legal protection that can keep certain incident-response work confidential when it is done under the direction of legal counsel. It shapes how investigations are structured, communicated, and documented during major incidents.

Attribute

A named property of an identity, resource, session, device, or environment that may inform correlation, authentication, authorization, provisioning, or policy decisions.

Attribute-Based Access Control (ABAC)

Attribute-based access control evaluates attributes of the subject, resource, action, and current context to make an access decision.

Attributes

In identity and access management, the pieces of information describing a user or entity, such as department, role, location, or clearance. Attributes drive modern authorization decisions and must be kept accurate to be trusted.

Attribution

The effort to determine who is behind an attack, such as a specific group or nation-state, based on tools, infrastructure, and behavior. It is useful for context but notoriously uncertain and easy to spoof.

Audience Analysis

Considering who will read and must follow a security policy, so the wording, detail, and tone fit them. A policy written for engineers differs from one for all staff, and matching the audience is what makes it usable.

Audience-Specific Messaging

Audience-specific messaging presents one verified incident fact base at the level of detail and with the actions each authorized audience needs.

Audit Automation

Using tools and scripts to perform audit work that was traditionally manual, such as pulling evidence, testing controls across all records instead of a sample, and tracking findings. It lets auditors cover more ground with less repetitive effort.

Audit Career Paths

The routes a professional can take within auditing, from staff auditor through senior, manager, and leadership roles, or into specializations like IT or cybersecurity audit. It maps how experience and certifications open new roles.

Audit Career Transitions

The shifts auditors make between roles, specialties, or industries, such as moving from external to internal audit, into IT or security audit, or out of audit into risk or compliance. Each transition draws on transferable audit skills.

Audit Categories

The major kinds of audit, such as financial, operational, compliance, and IT or cybersecurity audits, each with a different objective and scope. Knowing the category sets expectations for what an audit will and will not cover.

Audit Certifications

Professional credentials that validate audit expertise, such as CISA for IT audit, CIA for internal audit, or CPA for financial audit. They signal competence to employers and are often required for advancement.

Audit Coordination

From a GRC perspective, managing the logistics and relationships of an audit on the organization's side: scheduling, gathering evidence, routing auditor requests to the right owners, and keeping the engagement running smoothly.

Audit Cycle

The end-to-end sequence of an audit: preparation, fieldwork or execution, findings, reporting, and follow-up. Understanding the cycle helps an organization know what each phase requires and prepare for it.

Audit Discipline

The body of professional rigor that defines good auditing: systematic methodology, evidence-based conclusions, objectivity, and adherence to standards. It is what makes audit results credible and repeatable.

Audit Engagement Management

Running an external audit engagement well from the company's side: selecting the firm, scoping the work, coordinating evidence and timelines, and managing distribution of the resulting report, so the audit is efficient and the outcome is usable.

Audit Ethics

The ethical obligations that govern auditors, including objectivity, integrity, confidentiality, and avoiding conflicts of interest. Because others rely on audit conclusions, ethical lapses undermine the entire value of the work.