Resources · Glossary
The words, defined once.
Plain-English definitions for the terms that turn up in underwriting forms, audit scopes and board packs.
FAIR
Factor Analysis of Information Risk is one such model: it expresses cyber risk as the probable frequency and probable magnitude of loss, in money. It separates how often an event happens from how much it costs, so exposure can be compared with other business risks. Risknox quantifies loss using recognised models such as FAIR, with Monte Carlo simulation.
Cyber risk quantification
The practice of expressing security exposure as a financial range rather than a severity label. It combines event frequency, loss magnitude and the controls in place to produce a figure a board can budget against. A risk register lists threats; quantification prices them.
DPDP Act
India’s Digital Personal Data Protection Act, 2023 sets the rules for handling digital personal data: notice, consent, purpose limitation, security safeguards and breach reporting. Maximum penalties run to ₹250 crore depending on the type of breach.
Data Fiduciary
The entity that alone, or with others, determines the purpose and means of processing personal data under the DPDP Act. Notice, consent, security and breach-reporting obligations fall on the fiduciary, even when a processor does the work.
Consent Manager
A person registered with the Data Protection Board that manages a data principal’s consent through an interoperable platform. A data principal can give, manage, review and withdraw consent through it, and fiduciaries must honour that record.
Data Protection Officer
The individual a Data Fiduciary appoints to represent it under the DPDP Act. They are the point of contact for data principals exercising their rights, and for the Data Protection Board.
SOC 2 Type I vs Type II
A SOC 2 report covers the Trust Services Criteria and comes in two forms. Type I assesses whether controls are suitably designed and in place at a point in time; Type II assesses whether those controls operated effectively across a period, typically three to twelve months.
ISO 27001
The international standard for an information security management system. It requires a documented risk assessment, the controls in Annex A and evidence that the system is actually operating, and certification is issued by an accredited certification body.
SEBI CSCRF
SEBI’s Cybersecurity and Cyber Resilience Framework sets baseline cyber controls for regulated entities in India’s securities market. It covers identify, protect, detect, respond and recover, with graded requirements depending on the entity’s category.
NCA ECC
The Essential Cybersecurity Controls from Saudi Arabia’s National Cybersecurity Authority set the minimum cybersecurity requirements for organisations operating in the Kingdom. They are grouped across governance, defence, resilience and third-party and cloud security.
SAMA CSF
The SAMA Cyber Security Framework is the cybersecurity rulebook for institutions supervised by the Saudi Central Bank. It prescribes controls and maturity levels covering governance, technology, operations and third-party risk.
DMARC
An email authentication policy that tells receiving mail servers what to do when a message fails SPF and DKIM alignment. A policy of p=none only reports; quarantine or reject is what actually stops someone sending email as your domain.
SIEM
Security information and event management collects and correlates log data across an estate, then raises alerts on patterns that suggest an incident. Its value depends on tuning: shipped defaults rarely match your environment.
EDR
Endpoint detection and response runs on endpoints and servers, spotting malicious behaviour and taking action on the host itself. It covers the investigation and containment that a network control cannot reach.
Shadow AI
AI tools, models and assistants in use inside an organisation without the security or compliance team knowing about them or reviewing them. Shadow AI enters through individual sign-ups, free tiers, browser extensions and team-level pilots, and company data leaves with it through prompts and file uploads.
vCISO
A virtual CISO is an outsourced security leader who sets strategy, governance and reporting without a full-time hire. The engagement usually covers policy, the risk register, board reporting and oversight of day-to-day security work.
CST CRF
The Cybersecurity Regulatory Framework of Saudi Arabia’s Communications, Space and Technology Commission (CST, formerly CITC), issued by Decision 424/1442 in 2020. It applies mainly to providers licensed or registered by CST — telecom, ICT and postal — and CST assesses compliance. It sits alongside the NCA ECC.
UAE PDPL
Federal Decree-Law No. 45 of 2021, the UAE’s federal personal data protection law, regulated by the UAE Data Office. It covers personal data of people in the UAE, including by controllers outside the country. Implementing regulations are still awaited; government data, health and banking data, and DIFC and ADGM entities sit outside it.
Oman PDPL
Oman’s Personal Data Protection Law, Royal Decree No. 6/2022, with Executive Regulations by Ministerial Decision No. 34/2024. The transition period ended on 5 February 2026, so it is fully enforceable. The regulator is MTCIT: explicit consent, written notices, rights answered in 45 days, a DPO and breach notification within 72 hours.
DIFC Data Protection Law
DIFC Law No. 5 of 2020, amended in July 2025, regulated by the DIFC Commissioner of Data Protection. It applies to controllers and processors incorporated in the DIFC wherever they process, and to processing in the DIFC by others under stable arrangements. Since the 2025 amendments individuals can claim compensation directly in the DIFC Courts.
RoPA (Record of Processing Activities)
A register of every processing activity: what personal data it touches, why, who receives it and how long it is kept. It is the record that notices, rights requests and audits are answered from.
DPIA (Data Protection Impact Assessment)
A structured assessment of a processing activity that could harm individuals: the risk, the safeguards and who signs it off. Significant Data Fiduciaries must run them under the DPDP Act.
Data Principal
The individual whose personal data is processed under the DPDP Act — the term the Act uses where GDPR says data subject. The obligations in the Act exist to protect them.
Data Principal rights
Access, correction and erasure, grievance redressal and nomination: what a person can ask a Data Fiduciary for. Each one needs a route to request it and a response inside the time the Act allows.
Significant Data Fiduciary
A Data Fiduciary the Government designates for extra obligations, based on the volume and sensitivity of the data it handles. It adds a DPIA, an independent audit and a DPO based in India.
Saudi PDPL
Saudi Arabia’s Personal Data Protection Law, issued by Royal Decree M/19 and supervised by SDAIA. It covers processing in the Kingdom and residents’ data processed from outside it, with breach notification within 72 hours.
CERT-In reporting
India’s national incident response agency requires specified cyber incidents to be reported to it within six hours of noticing them. It runs alongside the DPDP breach report to the Data Protection Board.
AIVSS
An open scoring system for AI systems, modelled on CVSS: it rates the severity of an AI vulnerability so findings can be ranked against each other. Accord scores findings on it.
Model Hub
The register of the AI models and systems in use, with owner, business context, jurisdiction and criticality. Governance starts there: you cannot review a model you have not inventoried.
Cyber insurance readiness
How well the controls underwriters ask about are in place, and evidenced, before you submit a proposal. It is preparation for underwriting, not a promise of cover or of better terms.
Missing a term? Write to info@risknox.ai