An acronym is useful only when it reconnects you to the decision behind it. Use this reference when unfamiliar initials interrupt a study guide, practice question, architecture discussion, risk calculation, or incident scenario. Then return to the surrounding context and use the concept rather than stopping at the expansion.
This reference covers 160 common CISSP acronyms and terms useful across the current CISSP exam outline and the Cert Happens domain guides. The stable CISSP address keeps the lookup in one place rather than tying the reference to a single outline revision.
Context decides the meaning. MAC can mean Mandatory Access Control, Media Access Control, or Message Authentication Code. In a quantitative-risk calculation, AV means Asset Value. Read the surrounding domain and scenario before choosing an expansion.
Search the reference
Search by acronym, expansion, plain-English meaning, related term, or CISSP domain.
Showing all 160 entries.
0-9
- 2FA
- Two-Factor Authentication Authentication that requires two different factor types, such as a password and a hardware token.
A
- AAA
- Authentication, authorization, and accounting A framework that verifies identity, decides permitted actions, and records activity.
- ABAC
- Attribute-based access control An access-control model that evaluates attributes such as user, device, resource, location, sensitivity, and risk when making a decision.
- ACL
- Access control list A set of rules that permits or denies access to a resource, network path, or object.
- AES
- Advanced Encryption Standard A widely used symmetric encryption standard for protecting data at rest and in transit.
- AI
- Artificial Intelligence Computer systems that perform tasks such as analysis, recommendation, generation, or decision support. CISSP also considers the security, governance, and assurance implications of AI-enabled systems.
- ALE
- Annualized Loss Expectancy The estimated yearly financial loss from a risk scenario, commonly calculated as Single Loss Expectancy multiplied by Annualized Rate of Occurrence.
- API
- Application programming interface A defined way for software components or services to exchange requests and data.
- ARO
- Annualized Rate of Occurrence The estimated number of times a risk event is expected to occur in one year.
- AV
- Asset Value The business value assigned to an asset when estimating the financial effect of a loss.
B
- BAS
- Breach and Attack Simulation Automated security testing that emulates attacker techniques to measure whether controls detect or stop expected behavior.
- BC
- Business Continuity Planning and capability used to keep critical business activities operating at an acceptable level during and after disruption.
- BCP
- Business Continuity Plan A documented plan for sustaining or restoring critical business activities during disruption.
- BIA
- Business Impact Analysis A process that identifies critical functions and evaluates the consequences of disruption.
- BYOD
- Bring your own device A model that permits personally owned devices to access organizational resources.
C
- CA
- Certificate Authority A trusted organization or system that issues and signs digital certificates.
- CASB
- Cloud access security broker Helps an organization see and control how people use cloud services.
- CAT
- Computerized Adaptive Testing An exam-delivery method that selects later questions partly from a candidate’s earlier responses while estimating ability.
- CBK
- Common Body of Knowledge The broad body of professional knowledge associated with ISC2 certifications and security practice.
- CCPA
- California Consumer Privacy Act A California privacy law that gives covered consumers rights concerning certain personal information held by covered businesses.
- CD
- Continuous Delivery A development practice that keeps approved software changes ready for release through a repeatable pipeline. Some organizations use CD for continuous deployment, so context matters.
- CDN
- Content Delivery Network A distributed group of servers that places content closer to users to reduce latency and origin-server load.
- CI
- Continuous Integration A development practice that frequently combines code changes and automatically builds and tests the shared codebase.
- CI/CD
- Continuous Integration / Continuous Delivery A pipeline approach that integrates, builds, tests, and prepares software changes for controlled release.
- CIA
- Confidentiality, Integrity, and Availability Three foundational security objectives: prevent unauthorized disclosure, preserve correctness and trustworthiness, and keep authorized access available.
- CISSP
- Certified Information Systems Security Professional The ISC2 certification covering eight security domains across governance, architecture, engineering, operations, assessment, identity, networks, assets, and software development.
- CMM
- Capability Maturity Model A maturity model describing progression from inconsistent practices toward defined, measured, and continually improved processes.
- COBIT
- Control Objectives for Information and Related Technologies An ISACA governance framework used to align enterprise information and technology practices with business goals and control objectives.
- COTS
- Commercial Off-the-Shelf Commercially available software or hardware acquired as a product rather than developed specifically for one customer.
- CPE
- Continuing Professional Education Ongoing professional learning credits used to maintain certifications such as CISSP.
- CXL
- Compute Express Link A high-speed interconnect standard used to connect processors with memory and accelerator devices in modern computing architectures.
D
- DAC
- Discretionary Access Control An access model in which an object's owner can decide who receives access.
- DAST
- Dynamic Application Security Testing Testing that examines a running application from the outside by sending inputs and observing behavior.
- DLP
- Data loss prevention Controls that identify sensitive information and restrict unauthorized transfer or exposure.
- DNS
- Domain Name System The distributed service that maps names to records such as IP addresses and mail servers.
- DR
- Disaster Recovery Planning and technical capability used to restore technology, data, infrastructure, and supporting services after serious disruption.
- DRM
- Digital Rights Management Controls that restrict how protected digital content may be accessed, copied, printed, or redistributed.
- DRP
- Disaster Recovery Plan A documented plan for restoring technology, data, infrastructure, and supporting services after a disruptive event.
E
- EDR
- Endpoint detection and response Endpoint security that collects activity, detects suspicious behavior, and supports investigation and response.
- EF
- Exposure Factor The percentage of an asset’s value expected to be lost from one event in quantitative risk analysis.
- EOL
- End of Life The point when a product reaches the end of its planned life cycle. Availability, updates, and replacement planning may change.
- EOS
- End of Support The point when a vendor stops providing some or all support, fixes, or updates for a product or release.
F
- FedRAMP
- Federal Risk and Authorization Management Program A U.S. federal program that standardizes security assessment, authorization, and continuous monitoring for cloud services used by federal agencies.
- FIM
- File integrity monitoring A control that detects unexpected changes to important files or configurations.
- FIPS
- Federal Information Processing Standards U.S. federal standards published for information processing, including selected cryptographic requirements.
G
- GDPR
- General Data Protection Regulation European Union data-protection law governing the processing of personal data and the rights of individuals.
- GRC
- Governance, Risk, and Compliance A coordinated approach for directing security, managing uncertainty, and meeting legal, regulatory, contractual, and policy obligations.
H
- HA
- High Availability Design practices that reduce downtime through redundancy, failover, and removal of single points of failure.
- HMAC
- Hash-based message authentication code A keyed hash that provides integrity and source authentication between parties that share a secret.
- HSM
- Hardware security module A dedicated device that generates, protects, and uses cryptographic keys within a controlled boundary.
- HTTP
- Hypertext Transfer Protocol The application protocol used for web requests and responses without built-in transport encryption.
- HTTPS
- Hypertext Transfer Protocol Secure HTTP protected by TLS to provide encrypted and authenticated transport.
- HVAC
- Heating, ventilation, and air conditioning Environmental systems that maintain safe temperature, humidity, and airflow for facilities and equipment.
I
- IaaS
- Infrastructure as a service A cloud model in which the provider supplies infrastructure while the customer manages operating systems, applications, and much of the configuration.
- IAM
- Identity and access management Processes and technologies for creating identities, authenticating users, and controlling access.
- IAST
- Interactive Application Security Testing Application testing that observes a running application from inside or alongside the application while test traffic exercises it.
- ICS
- Industrial control system Technology used to monitor and control industrial processes and physical equipment.
- IDE
- Integrated Development Environment A software workspace that combines code editing, building, debugging, and related development tools.
- IdP
- Identity Provider A service that authenticates a user and issues identity assertions or tokens to relying applications.
- IDS
- Intrusion detection system A control that identifies suspicious activity and generates alerts without necessarily blocking traffic.
- IETF
- Internet Engineering Task Force The open standards organization that develops and publishes many Internet protocol specifications through the RFC series.
- IKE
- Internet Key Exchange A protocol used to negotiate security associations and keys for IPsec.
- IoT
- Internet of Things Network-connected devices that sense, process, or control physical environments, often with limited resources and long lifecycles.
- IP
- Internet Protocol The network-layer protocol used to address and route packets between systems.
- IPS
- Intrusion prevention system A control placed inline to detect and block suspicious traffic.
- IPsec
- Internet Protocol Security A suite of protocols that protects IP traffic through authentication, integrity, and optional encryption.
- IPT
- Integrated Product Team A cross-functional team that brings different disciplines together to plan, build, acquire, assess, or operate a product or capability.
- IPv4
- Internet Protocol version 4 The 32-bit Internet Protocol address format written as four decimal octets, such as 192.0.2.10.
- IPv6
- Internet Protocol version 6 The 128-bit Internet Protocol address format designed for a much larger address space and modern autoconfiguration behavior.
- ISC2
- ISC2 The nonprofit professional organization that administers CISSP and other cybersecurity certifications.
- iSCSI
- Internet Small Computer Systems Interface A protocol that carries SCSI storage commands over IP networks so block storage can be accessed across a network.
- ISO/IEC
- International Organization for Standardization / International Electrotechnical Commission International standards organizations that jointly publish many information-security and technology standards.
J
- JIT
- Just-in-Time An access approach that grants elevated or sensitive permissions only when needed and for a limited period.
K
- KPI
- Key Performance Indicator A measure used to track whether a process, program, or service is meeting an intended performance objective.
- KRI
- Key Risk Indicator A measure used to signal changing risk exposure or conditions that may require attention.
L
- LDAP
- Lightweight Directory Access Protocol A protocol used to query and manage directory services.
M
- MAC
- Mandatory Access Control An access model in which centrally assigned labels and rules determine access rather than individual owners.
- MAC
- Media Access Control The data-link layer function and hardware addressing used on local networks.
- MAC
- Message Authentication Code A short cryptographic value created with a secret key to verify message integrity and authenticity.
- MFA
- Multifactor Authentication Authentication that requires evidence from at least two different factor categories.
- MITM
- Man-in-the-Middle An attack in which an adversary positions itself between communicating parties to observe, alter, or impersonate traffic.
- MSSP
- Managed security service provider A third party that delivers managed security monitoring, protection, or response services.
- MTBF
- Mean time between failures The average operating time between repairable failures, often used as a reliability measure.
- MTD
- Maximum Tolerable Downtime The longest disruption a business process can tolerate before the consequences become unacceptable.
- MTTR
- Mean Time to Repair The average time required to repair a failed system or component and return it to operation. Some organizations use the same initials for mean time to recover, so read the surrounding definition.
N
- NAC
- Network Access Control Technology that evaluates users or devices before and during network access, then permits, restricts, or isolates them.
- NDR
- Network Detection and Response Security technology that analyzes network activity to identify suspicious behavior and support investigation and response.
- NFV
- Network Functions Virtualization Running network functions such as routing, firewalling, or load balancing as software rather than only on dedicated appliances.
- NIST
- National Institute of Standards and Technology A United States agency that publishes widely used cybersecurity standards, frameworks, and guidance.
O
- OAuth
- Open Authorization A framework that lets a user grant an application limited access to a resource without sharing the user's password.
- OIDC
- OpenID Connect An identity layer built on OAuth 2.0 that lets an application verify a user's identity and receive basic profile claims.
- OSI
- Open Systems Interconnection A seven-layer reference model used to organize networking functions and structure troubleshooting reasoning.
- OWASP
- Open Worldwide Application Security Project A nonprofit project that publishes practical application-security guidance and testing resources.
P
- PaaS
- Platform as a service A cloud model in which the provider manages the underlying platform while the customer deploys applications and data.
- PAM
- Privileged Access Management Controls for issuing, monitoring, limiting, and reviewing highly privileged access.
- PAP
- Policy Administration Point The component or function where authorized administrators create and manage access-control policy.
- PCI DSS
- Payment Card Industry Data Security Standard An industry security standard for organizations that store, process, or transmit payment-card account data.
- PDP
- Policy Decision Point The component that evaluates access policy and decides whether a request should be allowed.
- PEP
- Policy Enforcement Point The component that enforces an access decision by permitting, blocking, redirecting, or limiting the requested action.
- PHI
- Protected Health Information Individually identifiable health information protected under applicable healthcare privacy rules such as HIPAA in the United States.
- PII
- Personally Identifiable Information Information that can identify, contact, distinguish, or be linked to an individual, depending on the governing definition and context.
- PIP
- Policy Information Point The component that supplies attributes or context used when an access-control decision is evaluated.
- PKI
- Public-key infrastructure The people, policies, services, keys, and certificates used to establish and manage public-key trust.
Q
- QKD
- Quantum Key Distribution A method that uses quantum properties to establish shared keying material and reveal certain forms of interception.
- QoS
- Quality of Service Classification, marking, queuing, shaping, and related policies used to manage delay, loss, and priority for different traffic.
R
- RADIUS
- Remote Authentication Dial-In User Service A protocol that centralizes authentication, authorization, and accounting for network access.
- RBAC
- Role-Based Access Control An access model that assigns permissions to job roles and then assigns users to those roles.
- RFC
- Request for Comments A numbered publication in the Internet standards and engineering series. Some RFCs define standards, while others are informational.
- RMF
- Risk Management Framework A structured process for categorizing systems, selecting and implementing controls, assessing them, authorizing operation, and monitoring risk over time.
- RP
- Relying Party A service or application that relies on an identity provider or other authority to make an identity or authentication assertion.
- RPO
- Recovery Point Objective The maximum acceptable amount of data loss measured backward in time from a disruption.
- RTO
- Recovery Time Objective The targeted maximum time for restoring a service or capability after disruption.
S
- SaaS
- Software as a service A cloud model in which the provider operates the application while the customer manages users, data, and selected configuration.
- SABSA
- Sherwood Applied Business Security Architecture A business-driven security architecture framework that connects organizational requirements to layered security design.
- SAML
- Security Assertion Markup Language An XML-based standard used to exchange authentication and authorization assertions, commonly for federation and single sign-on.
- SAMM
- Software Assurance Maturity Model An OWASP model for assessing and improving an organization’s software-security practices.
- SASE
- Secure access service edge Delivers networking and security controls through cloud services so users and branch locations receive consistent protection wherever they connect.
- SAST
- Static Application Security Testing Testing that analyzes source code, bytecode, or binaries without executing the application to identify possible weaknesses.
- SBOM
- Software Bill of Materials An inventory of software components and dependencies used to understand composition, licensing, and supply-chain exposure.
- SCA
- Software Composition Analysis Tooling that identifies third-party and open-source components, versions, licenses, and known dependency risks.
- SCIM
- System for Cross-domain Identity Management A standard protocol and schema for automating identity provisioning and deprovisioning between systems.
- SCRM
- Supply Chain Risk Management The process of identifying, assessing, treating, and monitoring risks introduced through suppliers, products, services, and dependencies.
- SD-WAN
- Software-defined Wide Area Network A centrally managed WAN architecture that selects paths and applies policy across multiple links.
- SDLC
- Software development life cycle A structured process for planning, building, testing, deploying, and maintaining software.
- SDN
- Software-defined Networking A network architecture that separates centralized control logic from packet forwarding.
- SIEM
- Security information and event management A platform that collects, correlates, searches, and alerts on logs and security events.
- SLA
- Service-level agreement A contract or commitment that defines measurable service expectations such as uptime and response times.
- SLE
- Single loss expectancy The estimated financial loss from one occurrence of a risk event.
- SMTP
- Simple Mail Transfer Protocol The standard protocol for sending and relaying email.
- SOAR
- Security orchestration, automation, and response Technology that connects security tools and automates repeatable investigation and response workflows.
- SOC
- Security Operations Center A team or function that monitors, investigates, and responds to security events.
- SoD
- Separation of Duties A control principle that divides sensitive tasks or authority so one person cannot complete a high-impact process alone.
- SQL
- Structured Query Language A language used to create, query, and manage relational databases.
- SSH
- Secure Shell A protocol for encrypted remote administration, command execution, tunneling, and file transfer.
- SSL
- Secure Sockets Layer A retired predecessor to TLS. Modern secure services should use supported TLS versions.
- SSO
- Single sign-on An identity arrangement that lets a user authenticate once and access multiple connected services.
- STRIDE
- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege A threat-modeling mnemonic used to identify common categories of software and system threats.
T
- TACACS+
- Terminal Access Controller Access-Control System Plus A protocol commonly used for centralized administration access to network devices, with separate authentication, authorization, and accounting functions.
- TCB
- Trusted Computing Base The hardware, software, firmware, and controls that must work correctly for a system’s security policy to hold.
- TCP
- Transmission Control Protocol A connection-oriented transport protocol that provides ordered, reliable delivery with retransmission and flow control.
- TCP/IP
- Transmission Control Protocol/Internet Protocol The practical protocol suite built around IP addressing and transports such as TCP and UDP, rather than a single protocol.
- TEE
- Trusted Execution Environment A protected execution area designed to isolate sensitive code and data from less trusted parts of a system.
- TLS
- Transport Layer Security A protocol that protects network communication with encryption, integrity, and certificate-based authentication.
- TPM
- Trusted Platform Module A protected hardware component that stores cryptographic keys and records how a device started.
U
- UDP
- User Datagram Protocol A connectionless transport protocol with low overhead and no built-in delivery guarantee.
- UEBA
- User and Entity Behavior Analytics Analytics that identify unusual behavior by users, accounts, devices, or other entities.
- UPS
- Uninterruptible power supply A battery-backed device that supplies short-term power and conditions electricity during an outage or fluctuation.
- URL
- Uniform Resource Locator A URI that identifies a resource by location and access method.
V
- VEX
- Vulnerability Exploitability eXchange A machine-readable statement that communicates whether a known vulnerability affects or is exploitable in a specific product context.
- VLAN
- Virtual Local Area Network A logical Layer 2 network segment created on switching infrastructure.
- VM
- Virtual machine A software-defined computer that runs an operating system on virtualized hardware.
- VoIP
- Voice over IP Voice and related signaling carried over IP networks, with quality affected by latency, jitter, loss, and prioritization.
- VPC
- Virtual Private Cloud A logically isolated cloud network in which customers define subnets, routes, and security controls.
- VPN
- Virtual Private Network An encrypted tunnel that protects traffic across an untrusted network.
- VRF
- Virtual Routing and Forwarding A network function that maintains separate routing tables on the same device to isolate Layer 3 forwarding contexts.
W
- W3C
- World Wide Web Consortium A standards organization that develops specifications and guidance for web technologies.
- WAF
- Web application firewall A control that inspects and filters HTTP traffic to protect web applications.
- WAN
- Wide Area Network A network that connects systems across large geographic areas or multiple sites.
- WRT
- Work Recovery Time The time needed after technology restoration to validate data, reconcile work, clear backlogs, and resume normal business operations.
Z
- ZTA
- Zero Trust Architecture An architecture that removes implicit trust based on network location and bases access decisions on verified identity, device, policy, resource, and context.
No matching terms were found. Try the full phrase, a related concept, or a broader word.
Use the expansion to recover the decision
Recovery initials are a good example. Maximum Tolerable Downtime (MTD) sets the business's outer downtime limit. Recovery Time Objective (RTO) targets restoration time, Recovery Point Objective (RPO) limits acceptable data loss, and Work Recovery Time (WRT) covers the work needed after technology returns. The letters matter because each one answers a different question.
Identity and risk terms work the same way. A Policy Decision Point (PDP) makes an access decision, while a Policy Enforcement Point (PEP) carries it out. In quantitative risk analysis, Single Loss Expectancy (SLE), Annualized Rate of Occurrence (ARO), and Annualized Loss Expectancy (ALE) describe different parts of the estimate. Expand the acronym, then ask what role that term plays in the scenario.
Official reference
ISC2 publishes the current domain scope in the official CISSP Certification Exam Outline. Use the ISC2 outline as the final scope check for the exam you are preparing to take. This Cert Happens page is an independent study reference, not an official ISC2 glossary.