Cybersecurity Acronym Glossary

The acronyms that appear in incident reports, assessments and regulatory correspondence, expanded and explained. Adapted from the original evestigate.com library; selected definitions clarified October 7, 2026. For the larger current reference, see Cybersecurity & Forensics Glossary.

Primary references: ISACA Certified Information Systems Auditor (opens in a new tab); U.S. government CISA agency information (opens in a new tab); HHS HIPAA covered-entity guidance (opens in a new tab); IETF deprecation of SSL 3.0 (opens in a new tab); and IETF deprecation of older TLS versions (opens in a new tab). Legal applicability is a matter for the responsible organization and counsel.

APT

Advanced Persistent Threat - A sophisticated cyber attack normally used to target large companies and government agencies who deal with high value data (manufacturing plans, designs, intellectual property, defense projects, etc.). APT’s are ongoing in nature and are designed to give the attacker prolonged access to exfiltrate data and/or deliver malicious software at will without being detected.

CISA

The abbreviation has two common meanings. ISACA’s Certified Information Systems Auditor is a professional credential. The U.S. Cybersecurity and Infrastructure Security Agency is a federal agency. Determine which is intended from the document and context.

CISSP

Certified Information Systems Security Professional (CISSP) is a widely recognized independent information security certification granted by the International Information System Security Certification Consortium. It is awarded to individuals who have demonstrated proficiency in the security of the design, architecture, controls and management of highly secure digital environments.

CISO

A Chief Information Security Officer (CISO) is the senior high-level executive ultimately responsible for the security of an organization’s data and digital assets.

DFARS

The Defense Federal Acquisition Regulation Supplement adds Department of Defense acquisition requirements to the FAR. Requirements applicable to a supplier depend on the solicitation, contract clauses and work involved; the acronym alone does not establish every obligation.

DLP

Data Loss Prevention describes policies and tools that detect or restrict specified use or transfer of sensitive data. Coverage depends on configured sources, rules and supported channels; DLP does not ensure that all misuse or loss is prevented.

HIPAA

The Health Insurance Portability and Accountability Act is a U.S. law. Its implementing Privacy, Security and Breach Notification Rules apply according to defined covered-entity and business-associate roles; not every business holding health-related information has the same obligations.

ICS (Security)

ICS is the acronym for Industrial Control System (ICS). ICS security refers to the safeguarding of industrial control systems, the integrated hardware and software designed to monitor and control the operation of machinery and associated devices in industrial environments.

IoT

Internet of Things refers to connected physical devices with sensing, processing or actuation capabilities. Connectivity may be direct or through a gateway and does not require every individual device to have its own Internet-routable IP address.

EDR

Endpoint Detection and Response collects supported endpoint telemetry and supports detection, investigation and response. Coverage depends on the product, agent, platform and configuration; a router, printer or other network-connected device is not automatically covered.

NIST

The National Institute of Standards and Technology publishes technical standards and guidance, including the Cybersecurity Framework. Framework use can support risk management; it does not itself certify an organization or guarantee security.

PCI-DSS

The Payment Card Industry Data Security Standard addresses environments that store, process or transmit payment-card data and systems that can affect their security. Applicable scope and validation are determined through the relevant payment relationships and current PCI SSC documents.

SCADA

Supervisory Control and Data Acquisition (SCADA) refers to a computer system used for monitoring and/or controlling a plant or equipment in infrastructure industries like telecommunications, water and waste control, energy, oil and gas refining and transportation. SCADA systems also allow for data to be gathered and analyzed in real time.

SIEM

Security Information and Event Management (SIEM) describes software used to monitor, log, provide alerts and analyze security events to support threat detection and incident response.

SOX

The Sarbanes-Oxley Act of 2002 includes public-company financial reporting, governance and internal-control requirements. Applicability and required certifications depend on the entity and provision. It is not a blanket certification that every company can prevent fraud.

SSL

Secure Sockets Layer is a predecessor to Transport Layer Security. SSL 3.0 is deprecated, as are TLS 1.0 and 1.1. Current secure communication depends on supported protocol versions, configuration and certificate validation; SSL is not the current standard name.

TCP/IP

Transmission Control Protocol/Internet Protocol (TCP/IP) is a set of protocols governing communications between all devices connected to the Internet. It dictates how information should be packaged, sent, and received, as well as how to get to its destination.