- The IT security industry loves acronyms — this article explains over 80 of them pragmatically and with a touch of humor.
- In the end, it always comes back to the CIA triad: confidentiality, integrity, availability. Everything else is marketing.
- You don't need every tool from every category. A 100-employee company needs MFA, EDR, backups, and an ISMS — not necessarily a CNAPP.
- The ultimate bullshit bingo sentence for your next meeting is at the end of the article.
You're Sitting in the Meeting and All You Hear Is Letters
Sound familiar? You're sitting in a security meeting, the external consultant tosses around EDR, XDR, SIEM, and SOAR, the vendor's sales rep piles on CSPM, CNAPP, and ZTNA, and you nod politely while your inner monologue is just screaming "What the hell?" Welcome to the club. You're not alone.
The IT security industry has an acronym problem. Actually, it has a marketing problem disguised as an acronym problem. Every year, some analyst group invents a new category, every vendor happily fits themselves in, and at conferences, letter combinations fly through the air like confetti at a carnival party. What was called EDR in 2020 became XDR in 2023 and will probably be something else again by 2026. The technology behind it? Often the same. But the new name needs a new slide.
Yet in the end, it always comes down to the same thing: the CIA triad. Confidentiality, integrity, availability. Three words that have been the foundation of information security for decades. Everything else — every single one of the 80+ acronyms in this article — is ultimately a tool, a process, or a framework serving one of these three goals. Or marketing.
This article is your cheat sheet, your dictionary, your lifeline for the next meeting. We'll go through over 80 terms, explain them pragmatically, put them in context, and give you a tangible real-world example for each. Without bullshit. Well, with a little bullshit. It is bullshit bingo, after all.
I. The "Detection & Response" Family
From antivirus to the alphabet soup of detection. Soon there'll probably be ABCDR.
Remember the simple times. You had an antivirus scanner, it scanned files, and if it found something, a red popup appeared. Done. Then attackers got smarter, attacks more sophisticated, and suddenly a simple signature scan wasn't enough. The industry needed new concepts. And new abbreviations.
EDR - Endpoint Detection and Response
The successor to classic antivirus. EDR monitors not just files but the entire behavior on an endpoint: which processes start, which network connections are established, which registry entries are changed. If it detects something suspicious, it can automatically isolate the process.
In practice: Your sales rep opens an email attachment. It launches a PowerShell script that tries to exfiltrate data. A classic antivirus scanner might not know the file, but EDR sees the unusual behavior and stops the process before damage occurs. Microsoft Defender for Endpoint is the EDR that most mid-market companies already have licensed without knowing it.
XDR - Extended Detection and Response
EDR looks at the endpoint. XDR looks at everything: endpoints, emails, cloud services, identities, and network traffic. The idea: if you correlate telemetry from all these sources, you detect attacks that would be inconspicuous in any single source.
In practice: An attacker logs in at night with stolen credentials (identity), redirects emails (email), installs a tool on a server (endpoint), and exfiltrates data through a cloud app (cloud). Viewed individually, these are four inconspicuous events. XDR connects the dots and says: "Wait a minute, this is a coordinated attack." The truth? Many "XDR" products are polished EDR solutions with a few additional data sources. Ask the vendor exactly which sources are actually correlated.
MDR - Managed Detection and Response
You have an EDR or XDR, but nobody looks at the alerts? Then MDR is your friend. An external service provider monitors your systems around the clock, analyzes alerts, and intervenes in emergencies.
In practice: Your 100-employee company has no chance of affording a 24/7 security team. MDR gives you exactly that as a service: professionals who evaluate the alarm at three in the morning and isolate the compromised machine in an emergency. Costs a fraction of an in-house SOC team and is the most realistic option for most SMEs.
NDR - Network Detection and Response
Like EDR, but for network traffic instead of endpoints. NDR analyzes data flow between systems and detects anomalies: unusual connections, lateral movement in the network, data exfiltration.
In practice: A compromised machine in production suddenly communicates with a server in Eastern Europe. The machine itself has no EDR (it's an old control system), but NDR sees the suspicious network traffic and raises the alarm. Particularly relevant for companies with OT environments where you can't install an agent on every machine.
CDR - Content Disarm and Reconstruction
Not to be confused with the other xDRs. CDR takes incoming files (email attachments, downloads), disassembles them into components, removes anything suspicious (macros, embedded scripts, active content), and reassembles the file cleanly.
In practice: Your accounting department receives 50 invoices as PDFs daily. CDR checks every single one, removes hidden JavaScript elements, and delivers a cleaned version. The recipient notices no difference, but any embedded malicious code is gone. Sounds simple but is surprisingly effective against document-based attacks.
ITDR - Identity Threat Detection and Response
The newcomer in the family, on the radar since 2023. ITDR detects and responds to attacks targeting identities: stolen credentials, privilege escalation, manipulation of directory services.
In practice: Someone creates a new admin account in Active Directory at two in the morning, adds it to the Domain Admin group, and deletes the audit logs. A classic EDR sees none of this because it happens on the endpoint and is technically "permitted." ITDR recognizes the pattern and alerts immediately.
II. The Microsoft Engine Room
The stuff in the Defender portal that makes admins break a sweat.
If you're a Microsoft 365 shop — and most mid-market companies are — you practically live in the Microsoft Security Portal. And there are enough abbreviations for its own bingo game.
ASR - Attack Surface Reduction
Rules in Microsoft Defender that preemptively block certain risky behaviors on endpoints. Instead of detecting attacks, ASR prevents them.
In practice: The ASR rule "Block Office applications from creating executable content" prevents a Word macro from writing an .exe file to disk. The most common ransomware entry point nailed shut with one click. If you do just one thing after reading this article: activate the ASR rules in your Defender.
TVM - Threat and Vulnerability Management
Microsoft's integrated vulnerability management in Defender for Endpoint. Continuously scans your devices for known vulnerabilities and outdated software, prioritized by actual risk.
In practice: TVM shows you Monday morning: "Chrome 118 is running on 43 machines, and there's been an exploit in the wild since Friday. Here's the link to the update." Considerably more useful than an Excel sheet you fill in manually once a quarter.
CVE - Common Vulnerabilities and Exposures
The global database of known vulnerabilities. Each vulnerability gets a unique number (e.g., CVE-2024-12345) so everyone is talking about the same problem.
In practice: When Microsoft says on Patch Tuesday "We've fixed CVE-2026-1234," you can look up in any vulnerability database in the world what exactly the issue was. CVE numbers are the ID card numbers of the security world.
CVSS - Common Vulnerability Scoring System
A scale from 0 to 10 indicating how critical a vulnerability is. 0 is harmless, 10 is "drop everything."
In practice: Your scanner reports 200 vulnerabilities. Instead of panic, you see: 3 have CVSS 9.8 (critical, patch immediately), 15 have CVSS 7.0 (high, this week), 182 have CVSS 4.0 or below (plan it, but not an emergency). Warning: CVSS measures technical risk, not your specific business risk. A CVSS 9.8 vulnerability in a system not reachable from the internet and holding no critical data may only be a 6 in your context.
KBE - Knowledge Base Entry
Microsoft update KB numbers. Each patch has a unique KB number.
In practice: When something breaks after Patch Tuesday, you google "KB5035845 problems" and immediately find experience reports from other admins. KB numbers are also important for documentation: you can prove which patches were installed when on which systems. Your auditor loves that.
NVD - National Vulnerability Database
The database maintained by the US agency NIST of all CVEs, enriched with CVSS scores and references. Essentially the phone book of vulnerabilities. Your scanner gets its data from there. You never need to visit the NVD directly, but good to know where the info comes from.
PUA - Potentially Unwanted Application
Software that isn't directly malware but has no business on corporate machines: adware, browser toolbars, crypto miners. An employee installs a "free PDF converter" and gets three toolbars and a crypto mining module as a bonus. PUA detection in Defender would have blocked that.
III. Security Operations & Intelligence
The command center. Who reads the logs, and what happens then?
SOC - Security Operations Center
The room (physical or virtual) with the big screens where security analysts monitor alerts and respond to incidents. Like a fire department dispatch center, but for cyberattacks.
In practice: Your own SOC needs at least 8-12 analysts for 24/7 operations, plus tool costs. Completely unrealistic for a 100-employee company. That's why MDR and MSSP exist (see below). But you should know the term so you understand what the consultant is talking about.
SIEM - Security Information and Event Management
The software that collects logs from all possible sources (firewall, servers, endpoints, cloud, applications), normalizes them, and searches for suspicious patterns. The nervous system of the SOC.
In practice: Your file server logs a failed login. Your firewall logs a connection attempt from abroad. Your VPN logs a successful login. Viewed individually: inconspicuous. SIEM correlates the three events and recognizes: someone tried credentials from the outside and got in on the third attempt. Microsoft Sentinel is the SIEM that integrates most naturally for M365 customers, but there are dozens of alternatives.
SOAR - Security Orchestration, Automation and Response
The automation layer on top of SIEM. SOAR takes an alert and automatically executes predefined responses without human intervention.
In practice: SIEM reports "Brute force attack on Max Mueller's account." SOAR automatically locks the account, resets the password, notifies Max via Teams, and creates a ticket for IT. All in 30 seconds without a human lifting a finger. Sounds great, but setting up the playbooks is demanding. For most SMEs, this topic only becomes relevant once the SIEM is up and running smoothly.
MSSP - Managed Security Service Provider
An external service provider that runs security services for you. Broader than MDR: an MSSP can handle firewall management, SIEM operations, vulnerability scanning, and more.
In practice: Your 100-employee company has two IT staff. An MSSP handles firewall management, runs the SIEM, and delivers a monthly security report. You keep control, but the operational burden is with the service provider.
IOC - Indicator of Compromise
Technical indicators pointing to a compromise: IP addresses of known attacker servers, hash values of malware files, suspicious domain names.
In practice: After an incident at an industry peer, you receive a list of IOCs: "These three IP addresses and these two file hashes are associated with the attacker." You feed the IOCs into your SIEM or firewall and immediately see whether you're also affected. IOCs are the wanted posters of IT security.
IOA - Indicator of Attack
While IOCs point to an already-completed compromise, IOAs show suspicious behavior indicating an ongoing attack. The difference: an IOC is the shell casing at the crime scene; an IOA is the guy creeping around the house wearing a ski mask.
In practice: A user suddenly runs reconnaissance commands (net user, net group, whoami /priv) they've never used before. No malware hash, no suspicious IP, but a clear attack pattern. IOA-based detection catches exactly that.
TTPs - Tactics, Techniques and Procedures
Attacker methodologies, from the strategic level (tactic: "I want to steal credentials") through the technical method (technique: "I'll use Kerberoasting") to the concrete implementation (procedure: "I'll use Rubeus with these parameters").
In practice: If you know that the ransomware group currently targeting your industry always gets in through phishing (tactic) and then uses RDP connections for lateral movement (technique), you can reinforce exactly those paths. TTPs are longer-lived than IOCs: IP addresses change daily, but methodologies remain consistent for months or years.
MITRE ATT&CK
A freely available knowledge model that systematically catalogs TTPs of real attacker groups. Organized in a matrix with 14 tactics (columns) and hundreds of techniques (rows).
In practice: You want to check how well you're protected against ransomware. You look up the TTPs of known ransomware groups in MITRE ATT&CK and check for each technique: "Can we detect this? Can we prevent this?" The result is an honest assessment instead of a gut feeling. The ATT&CK matrix is free and belongs in every IT security manager's bookmarks.
IV. Identity & Access
Passwords are out. Acronyms are in.
Identity is the new perimeter, they say. The firewall used to be the castle wall; today it's the question: "Who are you, and what are you allowed to do?" The list of abbreviations in this area is correspondingly long.
MFA - Multi-Factor Authentication
Authentication with at least two different factors: something you know (password), something you have (smartphone, hardware token), or something you are (fingerprint). If you implement only one measure from this article, make it MFA.
In practice: Attackers steal your CEO's password via phishing. Without MFA, they're in. With MFA, they also need the smartphone and fail. Microsoft says: MFA prevents 99.9% of automated attacks on accounts. Discussion over.
IAM - Identity and Access Management
The umbrella term for everything related to digital identities and their access rights. User management, permission assignment, authentication, provisioning, deprovisioning.
In practice: IAM answers three questions: Who has access to what? Why does this person have this access? And who approved it? If you can answer these three questions for every system in your company, your IAM is in good shape. Spoiler: few can.
PAM - Privileged Access Management
Control and monitoring of accounts with elevated rights. Admin accounts, service accounts, root access — everything that is particularly critical because misuse causes particularly high damage. Our article on Privileged Access Management goes deeper.
In practice: Your domain admin account has the password "Summer2024!" and is shared by three people? PAM ends this madness. Individual admin accounts, password rotation, session recording, and time-limited rights. Sounds demanding but is one of the most effective protection measures available.
PIM - Privileged Identity Management
Microsoft's implementation of time-limited admin rights in Entra ID (formerly Azure AD). Instead of permanent admin rights, you get them only on request and only for a defined period.
In practice: Your IT administrator needs Global Admin rights to configure a new domain. Instead of being a permanent Global Admin, she activates the role via PIM for 4 hours, provides a reason, and after expiry the rights are automatically revoked. Who needs the master key 24/7 when you only use it twice a month for an hour?
JIT - Just-in-Time Access
The principle behind PIM, but vendor-agnostic: access is granted only at the moment of need and automatically revoked afterward. No standing access, no permanent privileges.
In practice: A database administrator needs root access to the production server. They request JIT access, their supervisor approves, and they have root rights for 2 hours. After that: gone. If something goes wrong during those 2 hours, you know exactly who it was. Looks great in the audit log.
JEA - Just Enough Administration
Alongside JIT, the second "Just" principle: give the admin only exactly the rights they need for their specific task. No more, no less. Implemented in PowerShell as JEA endpoints.
In practice: The helpdesk employee should be able to reset passwords but not delete users or change groups. JEA creates a restricted PowerShell endpoint that allows exactly this one action. The helpdesk gets no full admin access even though password reset technically requires admin rights.
SSO - Single Sign-On
Sign in once, access everywhere. The user authenticates once (e.g., at Windows login) and can then access all connected applications without signing in again. More in our SSO introduction guide.
In practice: Without SSO, your employee has 15 different logins and uses the same password everywhere (or variations). With SSO, they have one login protected with MFA and can access all applications through it. Fewer passwords = less phishing attack surface = fewer helpdesk tickets "I forgot my password."
RBAC - Role-Based Access Control
Permissions are assigned not to individual users but to roles. A user gets a role, and with it all permissions belonging to that role. The foundation of every access control concept.
In practice: Instead of giving Max Mueller individual access to 12 systems, he gets the "Inside Sales" role. This role has exactly the permissions an inside sales person needs. When Max transfers to accounting, you swap the role and all rights adjust automatically.
ABAC - Attribute-Based Access Control
The evolution of RBAC: access controlled via arbitrary attributes. "Access to financial data only from managed devices, during working hours, from the corporate network." That's ABAC. In practice, you implement this through Conditional Access Policies, even if Microsoft doesn't call it that.
V. Governance, Risk & Compliance
So the auditor is happy. And management can sleep at night.
ISMS - Information Security Management System
The heart of the whole operation. An ISMS is not a tool but a systematic approach to managing information security in an organization. It encompasses policies, processes, responsibilities, risk assessments, and controls. Anyone wanting to build an ISMS doesn't need software costing 50,000 euros per year. ISMS Lite does it for ab 500 Euro pro Jahr oder als Einmalkauf für 2.500 Euro. No consultant-speak, no enterprise overhead.
In practice: Your ISMS documents: "We have 200 identified risks, 15 of which require urgent action. Each risk has an owner and an action plan. We review quarterly whether the controls are effective." That's the core. Everything else is decoration.
ISO 27001
The international standard for information security management systems. Defines requirements that an ISMS must meet to be certified. The current version is ISO 27001:2022.
In practice: ISO 27001 is the language that customers, partners, and auditors understand. When you're certified, you're essentially saying: "An independent third party has verified that we systematically manage information security." This opens doors, especially in tenders and B2B business.
NIS2 - Network and Information Security Directive 2
The EU directive for cybersecurity, being transposed into national law since 2024/2025. Affects significantly more companies than the predecessor NIS1, including many SMEs with 50+ employees in certain sectors. Everything important about NIS2 for mid-market companies is covered separately.
In practice: Are you a machine manufacturer with 80 employees that makes parts for the food industry? Surprise: you're probably NIS2-relevant. Reporting obligations, risk management, director liability. Fines can be up to 10 million euros or 2% of global annual turnover. That focuses the mind considerably.
SoA - Statement of Applicability
The statement of applicability. A document in which you determine for each of the 93 controls in Annex A of ISO 27001: applicable or not applicable, and why in each case.
In practice: Control A.7.4 "Physical security monitoring": if you're a pure cloud service provider with no own data center, that's not applicable, and you justify it in your SoA. That's not cheating — it's exactly how it's intended. The SoA is one of the most important documents for certification.
TOM - Technical and Organizational Measures
The concrete protection measures you implement. "Technical" means things like encryption, firewalls, access controls. "Organizational" means things like policies, training, processes.
In practice: Your data protection officer asks: "What TOMs do we have for processing customer data?" You answer: "Encryption in transit and at rest (technical), access control concept with annual recertification (organizational), confidentiality agreement for all employees (organizational)." Anyone who has their TOMs cleanly documented sleeps better.
BIA - Business Impact Analysis
The systematic assessment of what happens when a business process fails. What financial, operational, and legal damages arise after one hour, one day, one week? Detailed in our BIA guide.
In practice: Your ERP system goes down. After one hour, orders can no longer be processed (operational damage). After one day, delivery deadlines are at risk (contractual penalties). After one week, customers leave (reputational damage). The BIA quantifies this and determines the priority for recovery.
BCM - Business Continuity Management
The superstructure over BIA and emergency planning. Ensures your company remains capable of acting even during severe disruptions. Not just IT, also production, supply chains, personnel. Who is the crisis team? Where do we meet if the office is unreachable? How do we communicate without email?
PDCA - Plan-Do-Check-Act
The Deming cycle behind ISO 27001: plan, implement, check effectiveness, improve. And start over. Introduce MFA (Plan), roll it out (Do), check after three months (Check), refine (Act). Sounds simple but is the most powerful tool for continuous improvement.
GRC - Governance, Risk and Compliance
The umbrella term for the disciplines of corporate governance (Governance), risk management (Risk), and regulatory compliance (Compliance). GRC tools bundle these topics in one platform.
In practice: Enterprise GRC platforms happily cost six figures per year and need three consultants for implementation. Completely oversized for a 100-employee company. You don't need a GRC tool — you need a lean ISMS tool like ISMS Lite that brings together risks, controls, and audit evidence. 500 Euro pro Jahr instead of 50,000 euros.
VI. Cloud-Native & Infrastructure
Everything that used to be a firewall and now floats somewhere in the cloud.
CSPM - Cloud Security Posture Management
Monitors your cloud configuration (Azure, AWS, GCP) and finds misconfigurations: open storage buckets, overly broad permissions, missing encryption.
In practice: Someone creates an Azure Storage Account and forgets to disable public access. CSPM finds it within minutes and alerts. Sounds trivial, but cloud misconfigurations are the number one cause of data breaches. If you're in the cloud, you need CSPM. Good news: Microsoft Defender for Cloud includes CSPM capabilities.
CWPP - Cloud Workload Protection Platform
Protection for running cloud workloads: VMs, containers, serverless functions. While CSPM checks configuration, CWPP protects applications at runtime. CSPM says "misconfigured," CWPP says "currently under attack."
CNAPP - Cloud-Native Application Protection Platform
The combination of CSPM and CWPP plus securing the entire CI/CD pipeline. The idea: one tool for everything related to cloud security.
In practice: CNAPP is what Gartner analysts wish for: a single platform that finds misconfigurations (CSPM), protects workloads (CWPP), scans container images, and secures the build pipeline. For a 100-employee company with three Azure subscriptions and no Kubernetes cluster, it's like a Ferrari for the trip to the bakery. Nice, but oversized.
SASE - Secure Access Service Edge
Merging network and security in a cloud service. Instead of VPN + firewall + proxy + CASB as separate boxes, you get everything from one platform. Your remote employee connects directly through the SASE provider, which checks identity, device health, and location. Zscaler and Netskope are the known names. Interesting for SMEs with significant remote work.
ZTNA - Zero Trust Network Access
The successor to the classic VPN. Instead of "once connected, everything accessible," ZTNA grants access to individual applications based on identity, device health, and context.
In practice: With VPN, the remote employee connects to the entire corporate network. If their laptop is compromised, the attacker has access to everything. With ZTNA, they connect only to the ERP system and the file server — not the printer, the SCADA system in production, or the executive file share.
CASB - Cloud Access Security Broker
Security layer between users and cloud services. Controls which cloud apps are used and what data is uploaded. An employee uses personal Dropbox for customer data? CASB detects it, blocks the upload, and shows you: "15 people are using unauthorized cloud storage."
DLP - Data Loss Prevention
Prevents sensitive data from leaving the company uncontrolled. Scans emails, cloud uploads, and USB copy operations for data patterns.
In practice: An employee wants to email an Excel spreadsheet with 500 credit card numbers to their personal address. DLP recognizes the pattern, blocks the email, and notifies the supervisor. Not every data leak is malicious — sometimes it's convenience — but DLP prevents both.
WAF - Web Application Firewall
Analyzes HTTP/HTTPS traffic to web applications and blocks attacks like SQL injection and cross-site scripting. Your web shop is being attacked? The WAF blocks before the request reaches the application. Not a replacement for secure code, but an important additional layer of protection.
CDN - Content Delivery Network
Globally distributed server network that delivers content closer to the user. Security-relevant because of DDoS protection: your web shop gets flooded, but Cloudflare or Akamai absorb the attack at their distributed nodes. Your server notices nothing.
DMZ - Demilitarized Zone
A network segment that sits between the internal network and the internet. Systems that must be reachable from the internet (web server, mail server) reside in the DMZ and have restricted access to the internal network.
In practice: Your mail server sits in the DMZ and accepts emails from the internet. If it's compromised, the attacker has access to the mail server but not to the internal network with ERP, file server, and Active Directory. The principle: sacrifice the outpost, protect the fortress.
VII. Network & Cryptography
The basics that have had the same names for 20 years. Thankfully.
TLS - Transport Layer Security
The protocol that secures all encrypted web traffic. The green lock in the browser. Currently version 1.3. Our article on encryption in business explains the fundamentals.
In practice: Every HTTPS connection uses TLS. If your internal web portal still uses HTTP (without the S), passwords and data fly through your network in plaintext. There is no reason in 2026 not to use TLS. Not a single one.
mTLS - mutual TLS
Regular TLS: the server proves its identity to the client. mTLS: both sides prove their identity to each other. Particularly relevant for machine-to-machine communication.
In practice: Your ERP system communicates with a supplier's system via API. With mTLS, not only does the supplier verify they're really talking to your system, but you also verify the other side is really the supplier. Mutual distrust, professionally implemented.
PKI - Public Key Infrastructure
The entirety of systems and processes for operating certificates: issuing, distributing, verifying, revoking. If you run an internal CA, you run a PKI.
In practice: Your internal CA issues certificates for WLAN authentication and internal servers. A poorly maintained PKI (expired certificates, no revocation of compromised certificates) is a serious security risk. Automation is your friend here.
CA - Certificate Authority
The entity that issues digital certificates. Let's Encrypt for your website, your internal AD CS for employee certificates. If the CA is compromised, trust in all its certificates is gone.
HSM - Hardware Security Module
Specialized hardware that securely stores cryptographic keys. The key never leaves the HSM, even if the server is compromised. For most SMEs, relevant as a cloud service (Azure Key Vault, AWS CloudHSM).
IPsec - Internet Protocol Security
Protocol suite for encrypting IP network traffic, typically for site-to-site VPN between locations. Your headquarters and branch office exchange data encrypted over the public internet. The classic, proven solution.
WPA3 - Wi-Fi Protected Access 3
The current standard for WLAN encryption. Stronger than WPA2 through individualized encryption and protection against offline brute-force attacks.
In practice: With WPA2, an attacker could capture the encrypted WLAN handshake and try passwords offline at leisure. WPA3 prevents this through SAE (Simultaneous Authentication of Equals). If your access points support WPA3, enable it.
802.1X
An authentication standard for network access. Before a device is allowed on the network, it must authenticate — typically via certificates or username/password against a RADIUS server.
In practice: A visitor plugs their notebook into a network port in your meeting room. Without 802.1X, they're immediately on the corporate network. With 802.1X, their device isn't recognized, gets no IP address, and at best lands in an isolated guest VLAN. The difference between "come right in" and "who are you?"
DNSSEC - DNS Security Extensions
Cryptographic protection of DNS against manipulation. Without DNSSEC, an attacker could forge DNS responses and redirect your employees to a fake banking site even though they typed the correct URL. DNSSEC ensures the response is authentic.
DMARC, SPF, DKIM
The trio of email authentication. SPF defines which servers may send emails for your domain. DKIM cryptographically signs emails. DMARC combines both and defines what happens with emails that fail the check. Everything on this in our article on email security.
In practice: Without DMARC, SPF, and DKIM, anyone can send emails that look like they come from your domain. Customers get phishing emails from "invoice@yourcompany.de" and you get angry calls. With DMARC set to "reject," forged emails are rejected by recipient servers before delivery.
VIII. Audit & Compliance
When the auditor in the gray suit sits across from you and says "Show me the evidence."
Here it becomes less technical and more process-oriented. But no less important — without clean audit documentation, the best technology is worthless.
Evidence
Proof that a security measure actually exists and works. Not a claim, but proof. Screenshots, configuration exports, log files, minutes, decisions.
In practice: You tell the auditor: "We have MFA for all users." The auditor says: "Show me the evidence." You show: an export from Entra ID showing 100% of users have registered MFA, plus the Conditional Access policy enforcing MFA. That is evidence.
Control
A security measure or mechanism that addresses a specific risk. ISO 27001 Annex A contains 93 controls. A control can be technical (firewall rule), organizational (policy), or procedural (review process).
In practice: Control A.8.5 "Secure authentication": your implementation is MFA for all cloud services, password policy with minimum length 12 characters, account lockout after 5 failed attempts. That's one control with three concrete measures.
Effectiveness Review
Not "did we set it up?" but "does it work?" You have a password policy (minimum length 12 characters). Effectiveness review shows: technically enforced, but 40% of users use dictionary passwords. Measure: introduce a blacklist. The difference between "exists" and "works."
Non-Conformity (Major/Minor)
An audit finding that a requirement of the standard is not met. Major Non-Conformity: a core requirement is systematically not met, jeopardizes certification. Minor Non-Conformity: a partial requirement is not fully met, must be corrected, but does not immediately jeopardize certification.
In practice: Major: you have not conducted a risk assessment (core process completely missing). Minor: you have a risk assessment, but the last update was 14 months ago instead of the required 12 months. Both must be remediated, but a major NC must be resolved before certification.
OFI - Opportunity for Improvement
An auditor observation that is not a defect but shows improvement potential. No obligation to implement, but an invitation to improve.
In practice: The auditor says: "Your awareness training takes place once a year. That meets the standard. But quarterly short sessions would be more effective." No deficiency, but a good pointer. OFIs are the gold nuggets of a good audit.
Management Review
Regular evaluation of the ISMS by top management. ISO 27001 requires that top management evaluates the ISMS at least annually: results, metrics, incidents, improvement needs. Our management review guide shows how to do this efficiently.
In practice: Once a year (better quarterly), management sits down with the ISM and discusses: what went well, what went poorly, what risks are new, what needs to change? The minutes of this meeting are an important audit document.
Internal Audit
Internal review of the ISMS by your own or commissioned auditors. Are the policies being followed? Are risk assessments current? The internal audit is your dress rehearsal before the certification audit. Find the problems yourself before the external auditor finds them.
SoD - Segregation of Duties
Separation of tasks so that no single person controls a critical process alone. Whoever creates the transfer may not approve it. Whoever configures the firewall may not evaluate the logs. Four-eyes principle, systematically applied.
Audit Trail
The unbroken, chronological record of all relevant activities. Who did what, when? Traceable, immutable, revision-proof. More on this in the Logging & Monitoring article.
In practice: Your auditor asks: "Who changed the firewall rule on January 15 that allows access to the production server?" Your audit trail shows: "Max Mueller, 01/15/2026, 2:32 PM, approved by Lisa Schmidt, ticket no. CHG-2026-42." That is traceability.
Recertification
Regular confirmation that existing permissions are still needed. Once a year, managers review: "Does Max really still need access to the HR system? He's been in sales for six months." Rights that are not confirmed are revoked. Prevents the creeping accumulation of rights.
IX. Risk Management
The art of assessing dangers without going insane.
Asset
Everything in your organization whose loss or compromise causes damage. ERP system, file server, customer database, email system, VPN gateway. But also: the knowledge carrier who has been doing production planning for 20 years and keeps everything in their head. That is also an asset.
Probability of Occurrence
How likely is it that a risk materializes? Typically assessed on a scale from 1 (unlikely) to 5 (almost certain). Honest assessment is difficult for many.
In practice: "How likely is a ransomware attack?" The honest answer for a 100-employee company without significant security measures: 4-5 (high to almost certain). With EDR, MFA, segmentation, and awareness training: 2-3 (low to possible). The risk assessment only becomes honest when you stop fooling yourself.
Impact
How high is the damage if the risk materializes? Ransomware attack: impact 5 (catastrophic). One week of business standstill, 200,000+ euros for forensics and recovery, reputational damage, potential GDPR fines. The product of probability and impact yields the risk level.
Risk Appetite
The risk level that management consciously accepts. "Score under 6: accept. 6-15: treat. Over 15: address immediately." Must be documented and approved by management. Without a defined risk appetite, every risk assessment is an exercise without a result.
Risk Treatment
The four options for dealing with an identified risk. More in our article on risk treatment options.
Mitigate (reduce): Take measures to reduce probability or impact. Introduce MFA, improve backups, train employees.
Transfer: Transfer the risk to a third party, typically through a cyber insurance or outsourcing.
Avoid: Cease the risky activity. If the old, insecure web application poses too high a risk, take it offline.
Accept: Consciously accept the risk because the cost of treatment exceeds the potential damage or the risk is below the risk appetite. Must be documented and approved by management.
Residual Risk
The risk remaining after all treatment measures. There is no zero risk. You've introduced MFA, but MFA fatigue attacks and real-time proxy phishing remain possible. That is your residual risk. It must be documented and accepted. Anyone who claims their residual risk is zero has not understood risk management.
X. Regulations & Frameworks
The legal code. Or rather: the legal codes. Plural. Unfortunately.
IT-Grundschutz
The framework from the BSI (Federal Office for Information Security) for information security. More extensive and detailed than ISO 27001, with concrete implementation recommendations for specific systems. Our article on BSI IT-Grundschutz compares the approaches.
In practice: While ISO 27001 says "ensure network traffic is protected," IT-Grundschutz says: "configure the firewall as follows, segment the network into these zones, and test quarterly." More detailed but also significantly more effort. Often mandatory for public administration and critical infrastructure operators in Germany.
TISAX - Trusted Information Security Assessment Exchange
The information security standard for the automotive industry, based on a questionnaire (VDA ISA) that builds on ISO 27001 and adds industry-specific requirements. Detailed in the TISAX certification article.
In practice: You're a supplier for BMW? Then you'll probably need TISAX before receiving design data. TISAX results are shared via a central platform (ENX), so you don't need to do the assessment separately for each OEM. The effort is similar to ISO 27001, but prototype protection and data privacy requirements go further in some areas.
SOC 2 - Service Organization Control 2
US audit standard for service providers. Covers security, availability, integrity, confidentiality, and privacy. When your US SaaS provider presents a SOC 2 report, an independent auditor has confirmed their controls. If you offer SaaS to US customers yourself, you'll be asked about it.
CRA - Cyber Resilience Act
The EU regulation establishing cybersecurity requirements for products with digital elements. Affects manufacturers of hardware and software sold in the EU. Our CRA article explains the requirements.
In practice: You develop an IoT controller for industrial systems? From 2027, you must prove the product is secure by design, that you operate vulnerability management, and that you provide security updates. The CRA is for product manufacturers what NIS2 is for operators.
DORA - Digital Operational Resilience Act
The EU regulation for the financial sector, in effect since January 2025. Defines requirements for IT risk management, incident reporting, resilience testing, and management of ICT third-party risks. All details in the DORA article.
In practice: Are you an IT service provider for banks or insurance companies? DORA also affects you as a "critical ICT third-party provider." Your financial sector customers will pass DORA requirements through to you. Contracts, audits, exit strategies — everything becomes more formal.
AI Act
EU regulation for the regulation of artificial intelligence. Classifies AI systems by risk. Do you use AI for applicant screening or credit decisions? High risk, full requirements: risk management, training data documentation, human oversight. Standard chatbots face less stringent rules.
DIN SPEC 27076
IT security check for SMEs. 27 requirements, six topic areas, half a day of effort. You get a score and recommended actions. For 30-employee companies for whom ISO 27001 is (still) too complex. Bonus: there are funding programs that subsidize the check.
KRITIS - Critical Infrastructure
Organizations of particular importance to the public good: energy, water, food, health, transport, finance, IT and telecommunications. If you belong to this category: heightened requirements, BSI audits, reporting obligations. IT security is not optional here but legally mandated.
XI. The "Worst Case" Acronyms
When things have already gone sideways. You hopefully never need these terms in practice, but you should know them.
IRP - Incident Response Plan
The documented plan that defines who does what during a security incident. Roles, escalation levels, communication channels, immediate technical measures. Our IRP guide shows how to create a practical plan.
In practice: Friday evening, 6 PM, ransomware. Who gets called first? Which phone if the IP phone system is encrypted? Who informs management? Who informs the data protection officer? Who calls the police? The IRP answers all of this before panic sets in.
RTO - Recovery Time Objective
The maximum tolerable downtime of a system. How long can the system be down before damage becomes unacceptable? Together with RPO, RTO defines the requirements for your backup and recovery concept. Details in the RTO/RPO article.
In practice: RTO for the ERP system: 4 hours. This means: within 4 hours of an outage, the ERP must be running again. From this follows: you need a recovery procedure achievable in 4 hours. A daily tape backup in the vault isn't sufficient for that.
RPO - Recovery Point Objective
How much data loss is acceptable? If the RPO is 1 hour, at most the last hour's work may be lost. From this follows: you need at least hourly backups or replication.
In practice: RPO for the customer database: 15 minutes. This means: you need real-time replication or at minimum an incremental backup every 15 minutes. A nightly full backup would have an RPO of 24 hours — usually too much for critical systems.
CSIRT/CERT - Computer Security Incident Response Team / Computer Emergency Response Team
Specialized team for security incidents. CSIRT and CERT are essentially synonymous. Your 100-employee company doesn't have one? No problem, but you need to know who to call: MSSP, BSI (for critical infrastructure), state data protection authority. Phone numbers belong in the IRP, printed out.
IR - Incident Response
The entire process of responding to a security incident in six phases: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned. Phase 6 is skipped most often and is the most important.
DR - Disaster Recovery
Restoring IT systems after a severe outage. Broader than backup-restore: where do systems continue running when the data center burns down? Our disaster recovery guide goes into detail. Cloud-based DR (Azure Site Recovery) makes this affordable even for SMEs.
BCP - Business Continuity Plan
The concrete plan for how the company continues operating during a disruption. Broader than DR because it also considers non-IT aspects. The ERP is down? BCP says: "Record orders manually on paper forms; form is in folder X." Sounds old-fashioned, works.
MTPD - Maximum Tolerable Period of Disruption
Maximum tolerable disruption period for a business process before it becomes existentially threatening. Longer than RTO because MTPD considers the overall process. The ERP has RTO 4 hours, but order processing has MTPD of 2 days because it can run manually in an emergency.
MTO - Minimum Business Continuity Objective
The minimum level at which a business process must run after a disruption. Normally 200 orders per day? MTO says: at least 50 must be possible to avoid contractual penalties. From there, scale up.
XII. Bonus: The Latest Buzzwords 2025/2026
The marketing departments of security vendors never sleep. Here are the freshest acronyms that will probably fly around at the next conference.
CTEM - Continuous Threat Exposure Management
An approach coined by Gartner: instead of monthly scans, a continuous cycle of Scoping, Discovery, Prioritization, Validation, Mobilization. The core idea: just because a vulnerability has CVSS 9.8 doesn't mean it's exploitable in your environment. CTEM prioritizes by actual risk, not by paper rating.
ASM - Attack Surface Management
Continuous discovery, analysis, and monitoring of all attack points of an organization. External and internal, known and unknown.
In practice: Your company has 3 known public IP addresses. ASM discovers: actually it's 7, because a developer forgot three test servers in the cloud and an old marketing subdomain still points to a decommissioned server. Shadow infrastructure is real and dangerous.
EASM - External Attack Surface Management
ASM specialized for the external attack surface: everything visible from the internet. EASM scan shows: your old staging environment is publicly accessible, a subdomain points to an abandoned AWS bucket, and a TLS certificate expires in 3 days. Three problems you wouldn't have seen without EASM.
BAS - Breach and Attack Simulation
Automated simulation of real attacks in your environment, without damage. Tests whether SIEM generates the alert, whether EDR detects the payload, whether the firewall blocks C2 communication. Like an automated pentest that runs continuously. Answers the most important question: "Would we detect a real attack?"
DSPM - Data Security Posture Management
Detects and classifies sensitive data in your environment and shows whether it's adequately protected. DSPM scans SharePoint and finds: 2,000 documents with personal data, 300 of them in folders with "Everyone" access. Without DSPM you don't know that. With DSPM you can clean up systematically.
The Ultimate Bullshit Bingo Sentence
You made it. 80+ acronyms, and your head is probably spinning. As a reward, here's the ultimate sentence you can drop in the next security meeting. It's grammatically correct, technically accurate, and maximally intimidating:
"To avoid the non-conformities in the next ISO 27001 audit, we've hardened our IAM through PIM and JIT. We use TVM to identify CVEs with high CVSS scores, correlate the telemetry in our XDR, and document the evidence for our TOMs directly in ISMS Lite to push the residual risk below management's risk appetite."
If silence follows: congratulations. You've won.
(And if anyone asks: you can now explain every single term in that sentence.)
Conclusion: In the End, It's Always About CIA
80+ acronyms, 12 chapters, and what remains? Three letters: CIA. Confidentiality, integrity, availability. Every tool, every framework, every standard ultimately revolves around these. EDR protects the integrity of your endpoints. MFA protects the confidentiality of your credentials. DR protects the availability of your systems. The rest is implementation detail.
You don't need to implement every acronym from this article. A 100-employee company doesn't need a CNAPP, SOAR, or its own SOC. What you need: MFA everywhere, decent EDR, tested backups, trained employees, and an ISMS that holds the whole thing together. Basics, consistently implemented, beat any acronym collection.
When the next consultant comes with a new three-letter combination, ask two questions: "Which CIA goal does this address?" and "What's the concrete risk I'm reducing with this?" If there's no clear answer, it's marketing.
Stay pragmatic, stay curious, and don't take the acronym industry too seriously. The threats are serious enough. Our ISMS glossary is the reference when you need to look up individual terms.