Sharing Indicator : White Essential Cybersecurity Controls Terminology Definition Multi-tier Architecture An architecture or structure to which a client-server approach is applied, in which the functional process logic, data access, data storage and user interface are developed and maintained as separate units on separate platforms. Need-to-know and The restriction of data, which is considered sensitive unless one has a specific need to Need-to-use know; for official business duties. Offline/Offsite Backup A backup of databases, settings, systems, applications and devices in which it is offline and not accessible to update. Typically, backup tapes are utilized for offsite backup. Online Backup A method of storage in which the backup is regularly taken on a remote server over a network, (either within the organization’s network or hosted by a service provider). Organization Staff Individuals who work for the organization (including employees, temporary employees and contractors). Outsourcing Obtaining goods or services by contracting with a supplier or service provider. Patch Supporting data pack used to upgrade, fix or improve computer operating systems, software or applications. This includes fixing security vulnerabilities and other bugs, with such patches usually called fixes or bug fixes and system usability or performance improvement. Penetration Testing The practice of testing a computer system, network, web application or mobile application to find vulnerabilities that an attacker could exploit. Phishing Emails The attempt to obtain sensitive information such as usernames, passwords, or credit card details, often for malicious reasons and intentions, by disguising as a trustworthy organization in email messages. Physical Security Physical security describes security measures designed to prevent unauthorized access to the Organization›s facilities, equipment and resources, and to protect individuals and property from damage or harm (such as espionage, theft or terrorist attacks). Physical security involves the use of multiple-tier of interconnected systems, including CCTV, security guards, security limits, locks, access control systems and many other technologies. Policy A document whose statements define a general commitment, direction, or intention of an organization as formally expressed by its Authorizing Official. Cybersecurity policy is a document whose statements express management’s formal commitment to the implementation and improvement of the organization’s cybersecurity program and include the organization’s objectives regarding the cybersecurity and its controls and requirements, and the mechanisms for improving and developing it. Privacy Freedom from unauthorized interference or disclosure of personal information about an individual. Privileged Access Management The process of managing high-risk privileges on systems which need special handling to minimize risk that may arise from rights misuse. Procedure A document with a detailed description of the steps necessary to perform specific operations or activities in compliance with relevant standards and policies. Procedures can be a subset of processes. Process A set of interrelated or interactive activities that translated input into output. Such activities are influenced by the policies of the organization. Recovery A procedure or process to restore or control something that is suspended, damaged, stolen or lost. 34 Document Classification: Unclassified