Glossary

Terms used in the account access guides, from A to Z.

A

Agency-run client accounts What are agency-run client accounts?
Accounts a client owns that your agency's staff work in for the client. What you may do in them and how your staff get in are two separate questions.

Break-glass account What is a break-glass account?
A break-glass account is a spare top-level admin account for when your normal admin accounts can't sign in. Nobody uses it day to day, and each use is reviewed.
Business associate (HIPAA) What is a HIPAA business associate?
A business associate is an outside person or company that creates, receives, keeps or sends patient health information for you, such as a billing company.

Data breach What is a data breach under US law?
US law has no single definition. HIPAA presumes an impermissible use of health data is a breach, and state laws differ on whether access alone counts.
Delegated access What is delegated access?
Delegated access lets an account owner allow other people to work in the account without giving out the password. Each person signs in as themselves.

HIPAA Security Rule What is the HIPAA Security Rule?
The HIPAA Security Rule sets how health plans, providers that bill electronically, and their vendors must protect electronic patient health information.

Identity provider What is an identity provider (IdP)?
An identity provider (IdP) keeps staff accounts in one place, checks who is signing in, and sets who may use each connected app. Okta and Entra ID are examples.
Insider threat What is an insider threat?
An insider threat is the chance that someone who has or had authorized access uses it, on purpose or by mistake, to harm the organization. Former staff count.
ISO 27001 What is ISO 27001?
ISO/IEC 27001 is the ISO standard that sets requirements for an information security management system. Certification bodies audit companies against it.
IT general controls What are IT general controls (ITGC)?
IT general controls are controls over the systems themselves, such as who can access them and how programs change, that automated financial controls rely on.

Least privilege What is the principle of least privilege?
Least privilege means each person, and each program acting for a person, gets only the access their assigned work needs. NIST lists it as control AC-6.

Multi-factor authentication What is multi-factor authentication (MFA)?
Multi-factor authentication (MFA) checks who you are with two or more types of factor (something you know, have or are), so a password alone isn't enough.

Onboarding and offboarding (account access) What do onboarding and offboarding mean for account access?
For accounts, onboarding gives a new person their own logins and only the access the job needs. Offboarding shuts those off and changes shared passwords.

Password manager What is a password manager?
A password manager keeps logins in an encrypted vault and fills them in. A shared vault means no passwords sent by chat, but everyone with access can use them.
Passwordless sign-in What is passwordless sign-in?
Passwordless sign-in proves who you are with a key on your device, not a password. Passkeys are the main example. Fill-in tools still use a password.
Privileged access management What is privileged access management (PAM)?
Privileged access management (PAM) controls who may use admin rights, for how long and with whose approval, and records what they did.
Privileged account What is a privileged account?
A privileged account has admin rights, so it can change how a system is set up and who may use it. Cloud and SaaS admin accounts count, not just server ones.

Reasonable security What is reasonable security?
Reasonable security is a US legal standard of safeguards that fit your size, data and risks. Some state rules spell it out for logins and access.

Secure browser What is a secure browser (enterprise browser)?
A secure browser, which vendors such as Island call an enterprise browser, is a browser your company manages so it can block downloads, printing and copying.
Security questionnaire What is a security questionnaire?
A security questionnaire is a set of written questions you send a vendor to learn how it protects your data and systems, before signing and during the contract.
Session recording What is session recording?
Session recording keeps what someone did between sign-in and sign-out, as video, text or events. Coverage varies by product, and some states require notice.
Shared account What is a shared account?
A shared account is one login that several people use on a service. Its records show the account, not the person, so you need another way to tell who acted.
Single sign-on What is single sign-on (SSO)?
Single sign-on (SSO) lets you sign in once and open all the apps you may use. It works only with apps that connect to your identity provider.
SOC 2 What is SOC 2?
SOC 2 is a CPA's examination of a service company's system description and controls, measured against the AICPA's trust services criteria.
Subcontracting What is subcontracting?
Subcontracting is when your vendor passes part of your work to another firm or person. HIPAA and the CCPA make the vendor bind that party by written contract.

Two-step verification What is two-step verification?
Two-step verification adds a second check after the password, like an app code or security key. Shared by a team, it no longer ties a sign-in to one person.

Unauthorized access (CFAA) What is unauthorized access under the CFAA?
Under the federal anti-hacking law, the CFAA, unauthorized access means entering a computer "without authorization" or going past the access you were given.

Vendor oversight What is vendor oversight?
Vendor oversight is your duty to make sure an outside firm handling your customers' data protects it: choose a capable firm, bind it by contract, and check it.

Zero trust What is zero trust?
In zero trust, being on the company network earns no trust. Each request is checked for who is asking and from what device, then gets only the access it needs.