Sharing Indicator : White Essential Cybersecurity Controls Appendices Appendix (A): Terms and Definitions Table (2) below highlights some of the terms and their definitions which were used in this document. Table (2): Terms and Definitions Terminology Advanced Persistent Threat (APT) Protection Definition Protection against advanced threats that use invisible techniques to gain unauthorized access to systems and networks and stay as long as possible through circumventing detection and protection tools. To accomplish that, viruses and zero-day malware are used in these techniques. Anything tangible or intangible that has value to the organization. There are many types of assets, and some of which include obvious things, such as: persons, machineries, Asset utilities, patents, software and services. The term could also include less obvious things, such as: information and characteristics (e.g., organization’s reputation and public image, as well as skill and knowledge). Any kind of malicious activity that attempts to achieve unauthorized access, collection, Attack disabling, prevention, destroy or sabotage of the information system resources or the information itself. Independent review and examination of records and activities to assess the effectiveness Audit of cybersecurity controls and to ensure compliance with established policies, operational procedures and relevant standard, legal and regulatory requirements. Authentication Authorization Availability Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in a system. It is the function of defining and verifying access rights/privileges to resources related to organization’s information and technical assets security in general and to access control in particular. Ensuring timely access to and use of information, data, systems and applications. Files, devices, data and procedures available for use in case of failure or loss, or in case of Backup deletion or suspension of their original copies. Bring Your Own Device (BYOD) This term refers to the policy of the organization that allows (in part or in whole) its employees to bring their personal devices (laptops, tablets and smartphones) to the premises of the organization and use such devices to access the networks, information, applications and systems of the organization which are access-restricted. It is a service management system that ensures a systematic and proactive approach Change Management using effective standard methods and procedures (e.g., change in infrastructure and networks). Change Management helps all stakeholders, including individuals and teams alike, move from their current state to the next desired state, and also helps reduce the impact of relevant incidents on service. 30 Document Classification: Unclassified