Glossary

Compliance Maturity

How advanced an organization's cloud compliance practice is, from manual, audit-driven, point-in-time effort toward automated, integrated, continuous compliance. It indicates where a program stands and what to improve next.

Compliance Metrics

The measurements a GRC analyst uses to track compliance health, such as control pass rates, open findings, evidence-collection completeness, and remediation timeliness, that show where the program stands and where attention is needed.

Compliance Program Operation

The ongoing, day-to-day running of a compliance program by a GRC analyst, maintaining controls and evidence, tracking the calendar, monitoring metrics, coordinating reviews, and communicating status, so compliance stays current between audits.

Compliance Program Scope

Defining what a compliance program covers, which frameworks, systems, data, and business units are in or out, set when building the program so effort is focused on what actually matters and audits have clear boundaries.

Compliance Program Structure

How a compliance program is organized when built, its scope, framework mappings, control set, evidence processes, tooling, team, and audit cadence, assembled into a coherent program rather than scattered, ad-hoc efforts.

Compliance Roadmap

A forward-looking plan that sequences a compliance program's goals over time, which frameworks to pursue, gaps to close, and milestones to hit, so the program advances deliberately rather than reactively.

Compliance Team Structure

How the people responsible for compliance are organized, roles, reporting lines, and the split between dedicated compliance staff and control owners across the business, so accountability is clear and the workload is sustainable.

Compliance Tool Selection

The process of evaluating and choosing compliance and GRC tooling when building a program, weighing framework coverage, evidence automation, integrations, usability, and cost against the organization's actual needs.

Compliance Tooling

The software a GRC analyst uses day to day to run a compliance program, GRC and evidence-management platforms that track controls, store evidence, manage tasks, and report status. This entry focuses on using such tooling in daily GRC work.

Compliance and B2B Sales

The role compliance plays in winning business-to-business deals, where customers require proof of security, such as a SOC 2 report or ISO 27001 certificate, before buying. Compliance becomes a sales enabler, not just a risk function.

Compliance as Code

Expressing compliance requirements as machine-readable, version-controlled policy that is automatically evaluated against cloud infrastructure, so compliance checks run continuously and consistently like software tests rather than as manual reviews.

Compliance vs Security

The distinction between meeting a framework's requirements (compliance) and actually being protected against attack (security). An organization can be fully compliant yet insecure, and secure yet not formally compliant; the two overlap but are not the same.

Comprehensive Identification

A thorough approach to finding risks that combines multiple techniques, asset-based, scenario-based, threat-based, and external sources, so the organization surfaces a complete picture of its risks rather than missing whole categories.

Compromised IAM Credentials Playbook

A cloud incident-response playbook for when cloud access keys or identity credentials are stolen, covering how to confirm the compromise, scope what the attacker did, revoke and rotate credentials, and recover, using cloud-native tools.

Compute Security Assessment

Evaluating the security of cloud compute resources, virtual machines, instances, and the services running on them, checking for public exposure, missing patches, weak access, and insecure configurations during a cloud assessment.

Conditional Access

An access-control approach that grants, challenges, or blocks authentication based on conditions like user risk, device health, location, and the sensitivity of what is being accessed, so access decisions adapt to context rather than being all-or-nothing.

Conditional Access (Cloud)

Conditional access as implemented and operated by a cloud security engineer, the policies in a cloud identity platform that gate access to cloud resources based on risk, device, location, and identity signals.

Conditional Access Configuration

The detailed setup of conditional access policies in a directory service like Microsoft Entra ID, defining the conditions, signals, and controls that govern sign-ins, with attention to avoiding gaps, lockouts, and misconfigurations attackers exploit.

Confidentiality

Confidentiality means information is only accessible to people, systems, or services that are authorized to see it.

Configuration Assessment

Checking cloud resource configurations against secure-configuration standards and benchmarks to find misconfigurations, such as public exposure, disabled logging, or weak settings, that create risk. It is the core function behind cloud posture management.

Configuration Baselines

Defined sets of secure configuration settings that systems must conform to, serving as the known-good reference for hardening. Deviations from the baseline indicate drift or misconfiguration to correct.

Configuration Evidence

Compliance evidence drawn from how systems are configured, such as exports or screenshots showing encryption is on, ports are restricted, or logging is enabled, proving a technical control is actually implemented as required.

Configuration as Code

Defining system and security configurations in version-controlled code that is applied automatically, so hardened settings are consistent, repeatable, and auditable across many systems rather than configured by hand.

Connection State

Whether and how a network connection is established and tracked, such as the stages of a TCP connection, which lets firewalls and analysts reason about traffic as conversations rather than isolated packets.

Consent

In identity systems, the user's explicit permission for an application to access their identity information or act on their behalf, captured during authorization flows like OAuth so access is granted with the user's awareness and agreement.

Container Cluster Assessment

Evaluating the security of a container orchestration cluster (such as Kubernetes) during a cloud assessment, checking API server exposure, RBAC, network policies, pod security, and admission controls for weaknesses.

Container Compliance

Ensuring container images and running containers meet security and configuration standards, scanned for vulnerabilities, built from approved bases, signed, and configured to benchmarks, so they satisfy both internal policy and external requirements.

Container Detection Patterns

The behavioral signals that indicate an attack on or within containers, such as a container spawning an unexpected shell, attempting to escape to the host, or making anomalous network connections, used to detect threats at runtime.

Container Escape Patterns

The techniques attackers use to break out of a container's isolation and reach the host or other containers, such as exploiting an over-privileged container, a kernel vulnerability, or a misconfigured mount. Escape turns a contained compromise into a broader one.

Container Hardening

Reducing a container's attack surface by building minimal images, running as non-root, dropping unnecessary capabilities, making filesystems read-only, and removing unneeded tools, so a compromised container offers an attacker little to work with.

Container Image Scanning

Within DevSecOps, scanning container images in the pipeline for known vulnerabilities, exposed secrets, and insecure configurations before they are deployed, so security issues are caught and fixed early in the software lifecycle.