Glossary

Rebuild vs Clean

An IR decision: rebuild a compromised system from a known-good image versus try to clean the existing one, weighed by confidence in eradication, system complexity, and downtime trade-offs.

Reconciliation and Connector Health

Reconciliation and connector health compare intended governance state with successfully observed target state and prove that collection and write paths remain complete and current.

Reconnaissance

Collecting information about a target before or during an attack.

Record of Processing Activities

A Record of Processing Activities, or RoPA, is the maintained GDPR Article 30 record of controller or processor processing and required supporting details.

Recovery

The phase of the incident lifecycle that restores normal operations, returning systems and services to function safely after an incident, while preventing reinfection and confirming the threat is gone.

Recovery Decision Trees

Predefined branches that guide responders from observed conditions and evidence to authorized recovery actions, escalation, or stop points.

Recovery Event Monitoring

Recovery event monitoring correlates initiation, challenge, failure, success, contact and authenticator changes, sessions, sensitive actions, notifications, support intervention, and fraud outcomes.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time.

Recovery Process

The structured steps that move an organization from contained incident to restored operations, planning the sequence, executing restores, validating each step, and confirming safe return to business.

Recovery Readiness Decision

A recovery readiness decision uses defined evidence, service criteria, accountable approval, rollback, support coverage, and accepted residual risk before returning a capability to operation.

Recovery Time Objective

The maximum acceptable time to restore a service after disruption.

Recovery Validation

Confirming that recovery actually worked, restored systems function correctly, the threat is truly gone, and no compromise persists, before declaring the incident closed.

Recurring Findings

Audit findings that keep appearing audit after audit, signaling systemic root-cause issues rather than one-off mistakes, and demanding deeper remediation than fixing each instance.

Red Team Assessment

An authorized, objective-driven exercise that emulates relevant adversary behavior to test detection, response, and resilience under defined rules of engagement.

Red Team Exercises

Adversarial security exercises where a dedicated team simulates real attackers against the organization to test defenses end to end, surfacing realistic gaps that vulnerability scans and tabletops miss.

Reference Class Forecasting

Reference class forecasting anchors an estimate in observed outcomes from a population sufficiently similar to the scoped future event.

Referrer-Policy

An HTTP response header that controls how much referrer information browsers send when navigating from a page, used to limit information leakage to other origins.

Refresh Token

In OAuth, a long-lived token used to obtain new short-lived access tokens without prompting the user again. Refresh tokens carry significant power and must be stored and rotated carefully.

Regional Regulations

Cloud-relevant regulations specific to a country, state, or region (such as GDPR in the EU or state privacy laws in the US) that organizations must comply with where they operate or serve users.

Registration Abuse Resistance

Registration abuse resistance limits automated or deceptive account creation according to the business harm without assuming every automated client is malicious.

Registry Run Key Detection

Detecting persistence via Windows registry run keys, common autostart locations attackers abuse, by monitoring changes to those keys and writing detections (often mapped to ATT&CK) for suspicious entries.

Registry Trust Boundary

A registry trust boundary includes repositories, identities, publishing and deployment rights, tag mutation, deletion, network access, replication, scanning, attestations, audit, retention, and recovery.

Regression Testing

In detection engineering, retesting detections after changes to ensure they still work and don't break expected behavior, so improvements don't silently degrade coverage of existing threats.

Regression Testing for Security Fixes

Regression testing for security fixes confirms that the remediated weakness stays blocked while valid workflows, errors, monitoring, recovery, accessibility, and performance continue to meet requirements.

Regulations

Mandatory rules imposed by governments or regulators on how organizations must protect information, secure systems, and handle incidents. Regulations are foundational drivers of security and privacy programs.

Regulatory Notification

The legally required notification of regulators (and sometimes affected individuals) after qualifying incidents, with timelines, content, and channels that vary by jurisdiction and regulation.

Regulatory Notification Timing

The leadership-level challenge of meeting strict regulatory notification deadlines (such as GDPR's 72 hours) during an incident, balancing speed, accuracy, and legal risk under pressure.

Regulatory and Contractual Handoff

A regulatory and contractual handoff provides authorized legal, privacy, audit, contracting, or customer specialists with the source, roles, scope, facts, evidence, timeline, uncertainty, and requested determination.

Regulatory vs Voluntary

The distinction between mandatory regulatory requirements and voluntary frameworks an organization adopts, that shapes priorities, enforcement, and how the organization frames compliance versus best-practice work.

Remediation

Fixing or reducing a weakness so it no longer creates the same level of risk.

Remediation Change Safety

Remediation change safety manages the confidentiality, integrity, availability, safety, compatibility, and recovery risks introduced by a vulnerability treatment.