Security and GRC Operations Glossary: Part B

Consent management is the process of capturing, recording and acting on people's consent choices about their personal data. Under GDPR Article 7, controllers must be able to demonstrate consent, and withdrawing it must be as easy as giving it.

Source: Article 7. Note: India's DPDP Act, 2023 separately defines a registered "Consent Manager" in section 2(g) and refers to it in section 6(7): egazette.gov.in.

Continuous control monitoring (CCM) is the use of technology to check, near-continuously or at high frequency, whether controls are operating effectively. An ISACA Journal article (2015) describes it as a subset of continuous assurance that may reduce the need for annual detailed control testing.

Source: ISACA Journal, 1 March 2015. Note: The source is a professional-body journal article, not a standard.

Control mapping is the practice of showing how a control in one standard, framework or regulation relates to a control in another. NIST says a mapping is more useful when it states whether the controls are equivalent, overlap, or one helps achieve the other.

Source: NIST IR 8477, February 2024, Introduction.

Data breach notification is the duty to report a personal data breach to a regulator and sometimes to affected people. Under GDPR Article 33, controllers must notify the supervisory authority within 72 hours of becoming aware, where feasible, unless risk to people is unlikely.

Source: Articles 33 and 34. Note: India's DPDP Act, 2023, section 8(6), separately requires a Data Fiduciary to give the Data Protection Board and each affected Data Principal intimation of a breach "in such form and manner as may be prescribed": egazette.gov.in.

A DPIA is an assessment of how using personal data could affect people's rights and what will reduce the risks. GDPR Article 35 requires one before high-risk processing; India's DPDP Act, 2023 will require periodic DPIAs of Significant Data Fiduciaries from May 2027.

Sources: Article 35; DPDP Act, 2023, section 10(2)(c)(i); G.S.R. 843(E): section 10 commences eighteen months after publication, 13 November 2025. Note: The Act says "periodic" and allows further matters to be prescribed.

A gap assessment compares an organization's current practices with a target, such as a framework or regulation, to identify the differences. NIST CSF 2.0 describes this as a gap analysis between Current and Target Profiles, followed by a prioritized action plan.

Source: NIST Cybersecurity Framework 2.0, February 26, 2024, section 3.1, step 4. Note: CSF 2.0 uses the phrase "gap analysis"; NIST does not define "gap assessment".

GRC is the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity. The Open Compliance and Ethics Group (OCEG) originated the term in 2002.

Source: oceg.org. Note: OCEG is the body that coined the term; the NIST glossary lists GRC as an abbreviation only, without a definition.

Identity and access management (IAM) is the administration of individual identities within a system, including the roles and access privileges of each user. Its purpose is to let only permitted users perform actions on a given resource.

Sources: NIST SP 800-175A; NIST SP 1800-21B.

Incident response is the remediation or mitigation of violations of security policies and recommended practices. NIST describes it as a critical part of cybersecurity risk management that should be integrated across organizational operations.

Sources: csrc.nist.gov; NIST SP 800-61r3, April 2025, Executive Summary.

An MSSP (managed security service provider) is a managed service provider that carries out or assists with cybersecurity risk-management activities, as defined in the EU's NIS2 Directive. A managed service provider runs, manages or maintains customers' ICT systems, on their premises or remotely.

Source: Directive (EU) 2022/2555, Article 6, points 39 and 40. Note: This is the EU legal definition; it is not a global one.

Multi-factor authentication (MFA) is an authentication system that requires more than one distinct type of authentication factor to succeed. The three factor types are something you know, something you have and something you are.

Source: NIST SP 800-63-4; NIST SP 800-53 Rev. 5.

OT security is the protection of operational technology: programmable systems and devices that interact with the physical environment, such as industrial control and building automation systems. NIST says it must address the unique performance, reliability and safety requirements of OT.

Source: NIST SP 800-82r3, Guide to Operational Technology (OT) Security, September 2023, Abstract.

Penetration testing is security testing in which evaluators mimic real-world attacks to find ways to circumvent the security features of an application, system or network. It often involves real attacks on real systems and data, using the same tools and techniques as actual attackers.

Source: NIST SP 800-115.

Privileged access management (PAM) is the monitoring and control of privileged access, meaning credentials with greater permissions than standard users. The UK's NCSC describes it as an additional security measure placed in front of system administration interfaces.

Sources: NIST SP 1800-24, December 2020, sections 4.1.5.1.1 and 4.1.10; UK NCSC.

A risk register is a central record of current risks, and related information, for a given scope or organization. NIST also describes it as a repository of risk information, including what is understood about risks over time.

Source: NISTIR 8170; NIST SP 800-221; NISTIR 8286.

Role-based access control (RBAC) is a model for controlling access to resources in which permitted actions are tied to roles rather than to individual identities. A role is a collection of access authorizations, and permissions may be inherited through a role hierarchy.

Source: NIST SP 800-95; NIST SP 800-53 Rev. 5.

SIEM (security information and event management) is an application that gathers security data from information system components and presents it as actionable information through a single interface. NIST also describes SIEM software as a program providing centralized logging for many log types.

Sources: NIST SP 800-128; NIST SP 800-92.

A security operations center (SOC) is a capability that detects and responds to cyber attacks, limiting damage when attacks get past preventive security controls. The UK's NCSC notes SOCs vary widely in scope and can include activities such as vulnerability assessment.

Source: NCSC, published 23 May 2022, "Why have a Security Operations Centre?".

SOC as a Service is an arrangement in which an external provider runs security operations center functions, such as monitoring, detection and incident response, for a customer. NIST names outsourcing a SOC to a managed security services provider as one option for incident handlers.

Sources: NIST SP 800-61r3, April 2025, incident handlers; CISA listing of a US Department of Justice SOCaaS service.

Third-party risk management is the practice of identifying and managing the risks that come from relationships with external entities, such as service providers and vendors, at every stage of the relationship's life cycle. US bank regulators issued joint guidance on it in 2023.

Sources: NISTIR 8183 Rev. 1; Federal Reserve SR 23-4, interagency guidance on third-party relationships.

VAPT (vulnerability assessment and penetration testing) is a combined security test. It pairs an examination of a system to find security deficiencies with testing that actively tries to exploit vulnerabilities. India's CERT-In names VAPT as an audit type that an audit scope must define.

Source: CERT-In Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, 25 July 2025, definitions of Vulnerability Assessments and Penetration Testing, and section 13.2.3. Note: CERT-In defines the two parts separately and names VAPT only as an audit type; it gives no single definition of VAPT.

A vulnerability assessment is a systematic examination of an information system or product to determine the adequacy of security measures and identify security deficiencies. It also provides data to predict how well proposed measures will work and confirms they are adequate after implementation.

Source: CNSSI 4009-2022; NIST SP 800-30 Rev. 1; NIST SP 800-53 Rev. 5.

See also Part A: Compliance and security standards glossary.