Abbreviated terms

What this part of the catalogue does

Clause 3.2 lists the abbreviations used, covering access control models (ABAC, DAC, MAC, RBAC, ACL), continuity terms (BIA, RPO, RTO), identity and authentication (IAM, ID, PIN, PKI, SSO, CAPTCHA), network and infrastructure terms (DNS, IP, NTP, PTP, SDN, SD-WAN, VPN, WiFi, USB, SD, UPS, CPU, VM, IoT, ICT, IT), security operations terms (IDS, IPS, SIEM, UEBA, SAST, SWID), privacy terms (PII, PIA), and others such as BYOD, GPS, IDE, ISMS, SMS, SQL and URL.

What it means when you fill the register

The clause lists the abbreviations used in the catalogue. It is short, but two of them matter to the attribute view: the confidentiality, integrity and availability shorthand, and the cybersecurity concepts that the attribute values reuse from ISO/IEC TS 27110. A reader who does not know that the five concept values come from that framework will read them as a local taxonomy. The page states the link and leaves the definitions to the standard. It is a navigational page, not a requirement, and it carries no evidence duty of its own. Its value is that it stops a team inventing a sixth concept because the acronym looked local. A useful test before a register goes to an auditor is to filter it by each value and see whether the rows that return are the ones a practitioner would expect. If a filter returns nothing, or returns controls that plainly do not belong, the abbreviation or the value has drifted. The test takes a minute and catches the kind of error a long justification hides.

Abbreviations are where a cross-team register drifts. One team writes CIA, another writes the three words, a third uses a tool's acronym, and the column stops being filterable. The published values are short and stable, and the register should use them as written. Local shorthand can live in a note column. The small discipline pays off when an auditor filters the register by property and expects every row to answer to the same three terms.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method