Plain-English glossary

Security buying terms, defined once, in plain English

Every domain term our articles and guides use, defined at reading level 7. Articles link a term here on first use, then use it freely. Missing a term? Tell us and we will add it.

Response Insurance & buying Standards & regulation OT/ICS MedTech Automotive Cloud & Kubernetes Certifications

Response

Incident response (IR): The work of handling a live cyber attack: containing it, investigating what happened, removing the attacker, and recovering. An IR firm is the company you call to do this work.
DFIR: Digital forensics and incident response. Response plus the evidence work: collecting disks, memory, and logs, and proving what the attacker did.
SOC (security operations center): A team that watches security alerts around the clock. A SOC monitors. It does not usually respond to a live incident at your site.
MDR (managed detection and response): A subscription service that watches your environment and reacts to alerts. It is monitoring with some response actions. It is not the same as a full incident response engagement.
SLA (service level agreement): A promised time frame written into a contract. In incident response, the SLA is usually hours to acknowledge your call and hours to first action. If it is not in writing, it is not an SLA.
Retainer: A standing contract with a response firm. You pay in advance for guaranteed response: pre-agreed activation, contracted response times, and usually included readiness work such as exercises.
Tabletop exercise: A practice run for an incident. The team talks through a realistic attack scenario and tests decisions without touching real systems. Good tabletops expose gaps in plans before an incident does.
Threat hunting: Actively searching your environment for attackers who got in without triggering alerts. Hunting assumes the monitoring missed something and goes looking.
Breach coach: The firm (often a law firm) that coordinates the legal, insurance, and response sides of a breach. The breach coach runs the claim and keeps the response privileged.
Ransomware negotiation: Handling the conversation with an attacker who has encrypted your data and demanded payment. Some firms specialize in it. It is a distinct skill from removing the attacker.
Chain of custody: The record of who handled each piece of evidence, when, and how it was stored. A clean chain of custody is what makes evidence usable in an insurance claim, a regulatory filing, or a court.
Evidence tier: Our grading of where a firm's data comes from: registry-checked (issuer registries confirm named certificate holders), panel-confirmed (carrier-published panel pages), or research-sourced (public research with the source named).
Registry check: Verifying a certification against the issuer's own public directory. Certifications belong to people, so the check names the holder and the certificate. A claim that survives a registry check is evidence.
Documented engagement: Real incident or case work a firm has published on its own site, with a link to it. The only public record of how a firm behaves during a real incident.

Insurance & buying

Carrier: The cyber insurance company. On this site, the word carrier always means the insurer, never a phone company.
Panel (insurance panel): The list of incident response firms a carrier publishes for its policyholders. Many policies cover panel-firm costs fully and treat off-panel firms as partial reimbursement or pre-approval.
RFP (request for proposal): A structured document that asks all bidders the same questions. Our RFP templates ask every firm the same things, in the same order, so proposals can be compared line by line.
Panel adequacy: How well a carrier's panel covers the exposures the carrier insures: the right specializations, geographies, and capacity. A panel strong in cloud DFIR can be thin for OT.

Standards & regulation

NERC CIP: The mandatory cybersecurity standards for the North American electric grid. CIP-008 is the standard that governs incident reporting and response plans.
TSA security directives: Mandatory cybersecurity requirements for pipeline operators, issued by the US Transportation Security Administration. They carry reporting clocks and response requirements.
CFATS: The Chemical Facility Anti-Terrorism Standards, the program governing chemical facility security in the US, including cyber requirements.
HIPAA breach notification: The rule requiring US healthcare organizations to assess breaches of protected health information and notify affected people, the regulator, and sometimes the media, on defined timelines.
GDPR 72-hour rule: The EU requirement to notify a supervisory authority of a personal data breach within 72 hours of learning of it.
SEC Item 1.05 (8-K): The US securities rule requiring public companies to disclose material cybersecurity incidents on Form 8-K, generally within four business days of deciding the incident is material.
IEC 62443: The international standard suite for securing industrial control systems. It defines security levels, zones and conduits, and process requirements for operators, integrators, and device makers.
FDA Section 524(b): The US law requiring cybersecurity documentation in medical device marketing submissions (510(k), De Novo, PMA): a software bill of materials, threat modeling, risk management, and post-market monitoring commitments.
UN R155: The UN regulation requiring vehicle makers to operate a certified cybersecurity management system (CSMS) before vehicle types can be approved in regulated markets.
ISO/SAE 21434: The engineering standard for road vehicle cybersecurity. It defines how risks are analyzed (TARA), how requirements flow, and how evidence accumulates across the vehicle lifecycle.
MITRE ATT&CK: A public knowledge base of attacker behaviors, organized by tactic and technique. Our RFPs ask for the functional attack behaviors you need covered, in ATT&CK vocabulary.

OT/ICS

OT (operational technology): The systems that run physical processes: factories, pipelines, power grids. OT is the plant. IT is the office.
ICS (industrial control system): The control systems inside OT environments: PLCs, SCADA systems, and the networks that connect them.
SCADA: Supervisory control and data acquisition. The systems operators use to monitor and control processes spread over a site or region.
PLC (programmable logic controller): The industrial computer that runs a machine or process directly. PLCs are where digital commands become physical actions.
Purdue model: The reference architecture that levels an industrial network from device (level 0) to enterprise IT (level 5). Response scoping uses it: levels 0 through 3 is the plant network.
SIS (safety instrumented system): The system that shuts a process down safely when limits are exceeded. Responders must validate against safety systems before acting, or containment can create the incident it was meant to prevent.

MedTech

SBOM: A software bill of materials: the full list of software components in a device, with versions. Machine-readable formats are CycloneDX and SPDX. FDA premarket submissions require one.
CVD (coordinated vulnerability disclosure): The process for handling reports of security flaws in your product: receiving them, fixing them, and disclosing them to users in a coordinated way.

Automotive

CSMS: A cybersecurity management system: the manufacturer's documented processes for managing vehicle cybersecurity across the lifecycle. UN R155 requires it to be certified by a type approval authority.
TARA: Threat analysis and risk assessment, the core method of ISO/SAE 21434. A good TARA names the asset, the damage scenario, and the attack path concretely.
Type approval authority: The national body that audits and certifies a CSMS and approves vehicle types: KBA (Germany), RDW (Netherlands), VCA (UK), MLIT (Japan).

Cloud & Kubernetes

EKS, GKE, AKS: The managed Kubernetes services of AWS, Google Cloud, and Azure. They differ enough that a firm fluent in one is not automatically fluent in all three.
RBAC (role-based access control): The permission system that decides what each identity can do. In a cluster, over-privileged RBAC is a common way attackers escalate.
Falco, Tetragon: Open-source runtime security tools that detect suspicious behavior inside containers and nodes. Fluency with them marks a cluster-experienced response firm.
Sigstore, Cosign: The open-source tooling for cryptographically signing and verifying software artifacts, so a deployed image can be proven to be the one you built.

Certifications

GIAC certifications: The certification family from SANS: GICSP (ICS security), GRID (incident response for industrial), GCFA (forensic analyst), GCFE (forensic examiner), GNFA (network forensics). They belong to named people, and the issuer's directory makes them checkable.
CKS and CKA: The Certified Kubernetes Security Specialist and Certified Kubernetes Administrator credentials. Held by named responders, they mark real cluster fluency.
CISSP and CSSLP: General security certifications (CISSP) and secure-software-development certification (CSSLP) from ISC2. Common on regulatory and development-heavy engagements.
RAC: The Regulatory Affairs Certification. It marks people who live in submission processes, which matters for medical device work where the deliverable is a filing.

Browse the responder directories →Read the buyer guides