Glossary
Plain-English definitions of the terms that show up in compliance programs, audits, and engineering measurement — each with the context an operator actually needs.
Agent health
Agent health is the operational reliability of an AI agent in production — whether it stays within its guardrails, succeeds at tasks, and behaves predictably.
Continuous control monitoring, defined
Continuous control monitoring defined: how CCM differs from point-in-time audits, what automation can and cannot cover, and why coverage honesty matters.
Control register
A control register is the master inventory of an organization's controls — each with an owner, frequency, risk mapping, and test procedure. Learn what it holds.
COSO (Committee of Sponsoring Organizations)
COSO is the framework most companies use to design and evaluate internal control over financial reporting. Learn its five components and seventeen principles.
Deficiency evaluation
Deficiency evaluation is how a control failure is classified as a deficiency, significant deficiency, or material weakness. Learn how severity is assessed.
Deployment frequency, defined
Deployment frequency is how often a team ships to production. Learn how it is measured, how DORA tiers teams by it, and why it is read alongside the other keys.
DORA metrics, defined
The four DORA metrics defined — deployment frequency, lead time, change failure rate, time to restore — and the measurement pitfalls that corrupt them.
Enterprise readiness, defined
Enterprise readiness defined: what a startup proves — engineering maturity, security, AI governance, and compliance evidence — to pass enterprise technology diligence.
Evidence-based compliance, defined
Evidence-based compliance proves each control with verifiable, traceable artifacts, not self-attestation. Learn how it works and why auditors rely on it.
Information produced by the entity (IPE), defined
Information produced by the entity (IPE), explained: completeness and accuracy support, why every report used in a control needs it, and how baselining works.
IT general controls (ITGC), defined
IT general controls (ITGC) explained: the four domains — access, change, development, operations — why auditors rely on them, and what happens when they fail.
Risk appetite, defined
Risk appetite is the amount and type of risk an organization is willing to pursue or retain. Learn how it differs from risk tolerance and risk capacity.
SBOM (software bill of materials)
A software bill of materials (SBOM) is a machine-readable inventory of the components in a piece of software. Learn what an SBOM contains and why it matters.
Section 302 certification, defined
SOX Section 302, explained: what the CEO and CFO certify each quarter, how sub-certification cascades work, and why the sign-off needs a durable record.
Segregation of duties (SoD), defined
Segregation of duties, explained: classic conflicts like change-maker vs approver and grantor vs reviewer, compensating controls, and how SoD is evidenced.
Statement of Applicability (SoA), defined
The Statement of Applicability is the mandatory ISO/IEC 27001 document listing every Annex A control, whether it applies, why, and its implementation status.
Technical debt, defined
Technical debt defined: Cunningham's metaphor, deliberate vs inadvertent debt, how to measure it honestly, and why it belongs in board reporting.
Technical due diligence, defined
Technical due diligence defined: what tech DD examines in M&A and investment, consultancy-led vs platform-supported approaches, and what neither can replace.
Trust center, defined
A trust center is a public page where a company publishes its security, compliance, and privacy posture — certifications, subprocessors, and security documentation.
What are complementary user entity controls (CUECs)?
Complementary user entity controls (CUECs) are controls a SOC report expects the customer to implement so the provider's controls can operate as intended.
What is a control walkthrough?
A walkthrough traces a single transaction end-to-end to confirm a control is designed as documented and actually in place. Learn how walkthroughs work and how they differ from testing.
What is an AI Bill of Materials (AI-BOM)?
An AI Bill of Materials (AI-BOM) inventories the models, datasets, and components inside an AI system. Learn what it captures, how it extends the SBOM idea, and why governance requires it.
What is change failure rate?
Change failure rate is the share of production deployments that cause a failure needing remediation. Learn how this DORA metric is calculated and why it matters.
What is code churn?
Code churn measures how much code is rewritten or deleted soon after being written. Learn how it is calculated, what high churn signals, and why it must be read as context, not a verdict.
What is CVSS (Common Vulnerability Scoring System)?
CVSS is the open standard for rating vulnerability severity from 0 to 10. Learn how the base, temporal, and environmental scores work and why severity alone should not set priority.
What is cyclomatic complexity?
Cyclomatic complexity counts the independent paths through a function. Learn how McCabe's metric is calculated, what it signals about testability and risk, and its limits.
What is DAST (Dynamic Application Security Testing)?
DAST tests a running application from the outside for security flaws. Learn how black-box testing works, what it catches that SAST misses, and where it fits in a security program.
What is EPSS (Exploit Prediction Scoring System)?
EPSS estimates the probability a vulnerability will be exploited in the next 30 days. Learn how the score works and how it complements CVSS and the CISA KEV catalog.
What is Infrastructure as Code (IaC)?
Infrastructure as Code (IaC) manages servers, networks, and cloud resources through version-controlled files instead of manual setup. Learn how it works and why it underpins modern delivery.
What is lead time for changes?
Lead time for changes is the time from a code commit to running in production. Learn how this DORA metric is measured and what drives long delivery times.
What is materiality?
Materiality is the threshold at which a misstatement could influence a financial-statement user's decisions. Learn how it scopes a SOX audit and why it drives which controls are in scope.
What is model provenance?
Model provenance is the traceable record of how an AI output was produced — which model, prompt, and context. Learn why provenance is the foundation of AI auditability and change management.
What is MTTR (mean time to restore)?
MTTR (mean time to restore) is the average time to recover service after a production failure. Learn how this DORA metric is calculated and what it signals.
What is SAST (Static Application Security Testing)?
SAST analyzes source code for security flaws without running it. Learn how static analysis works, what it catches, and how it complements DAST and software composition analysis.
What is secret scanning?
Secret scanning detects credentials, API keys, and tokens accidentally committed to code. Learn how it works, why committed secrets are so dangerous, and how remediation differs from other bugs.
What is shadow AI?
Shadow AI is the use of AI tools and models inside an organization without approval or oversight. Learn the risks it creates and how governance programs bring it into view.
What is Software Composition Analysis (SCA)?
Software Composition Analysis (SCA) identifies the open-source dependencies in an application and flags their known vulnerabilities and licenses. Learn how SCA works and where it fits.
What is the bus factor?
The bus factor is the number of people who would have to leave before a project stalls. Learn how key-person risk is measured and why technical due diligence asks about it first.
What is the CISA KEV catalog?
The CISA KEV catalog lists vulnerabilities with confirmed active exploitation. Learn what qualifies a CVE for the list and why KEV should drive remediation priority over CVSS alone.
What is the SPACE framework?
The SPACE framework measures developer productivity across five dimensions: satisfaction, performance, activity, communication, and efficiency — not raw output.
What is vulnerability management?
Vulnerability management is the continuous process of finding, prioritizing, remediating, and verifying security weaknesses. Learn the lifecycle and why prioritization is the hard part.