# Glossary Terms used in the account access guides, from A to Z. ## A - [Agency-run client accounts](/guides/agency-accounts/what-are-agency-run-client-accounts) — What are agency-run client accounts?: Accounts a client owns that your agency's staff work in for the client. What you may do in them and how your staff get in are two separate questions. ## B - [Break-glass account](/guides/privileged-access/what-is-break-glass-account) — What is a break-glass account?: A break-glass account is a spare top-level admin account for when your normal admin accounts can't sign in. Nobody uses it day to day, and each use is reviewed. - [Business associate (HIPAA)](/guides/healthcare-access/what-is-a-hipaa-business-associate) — What is a HIPAA business associate?: A business associate is an outside person or company that creates, receives, keeps or sends patient health information for you, such as a billing company. ## D - [Data breach](/guides/incidents/what-is-data-breach) — What is a data breach under US law?: US law has no single definition. HIPAA presumes an impermissible use of health data is a breach, and state laws differ on whether access alone counts. - [Delegated access](/guides/agency-accounts/what-is-delegated-permission) — What is delegated access?: Delegated access lets an account owner allow other people to work in the account without giving out the password. Each person signs in as themselves. ## H - [HIPAA Security Rule](/guides/healthcare-access/what-is-the-hipaa-security-rule) — What is the HIPAA Security Rule?: The HIPAA Security Rule sets how health plans, providers that bill electronically, and their vendors must protect electronic patient health information. ## I - [Identity provider](/guides/access-basics/what-is-idp) — What is an identity provider (IdP)?: An identity provider (IdP) keeps staff accounts in one place, checks who is signing in, and sets who may use each connected app. Okta and Entra ID are examples. - [Insider threat](/guides/incidents/what-is-insider-threat) — What is an insider threat?: An insider threat is the chance that someone who has or had authorized access uses it, on purpose or by mistake, to harm the organization. Former staff count. - [ISO 27001](/guides/compliance/what-is-iso-27001) — What is ISO 27001?: ISO/IEC 27001 is the ISO standard that sets requirements for an information security management system. Certification bodies audit companies against it. - [IT general controls](/guides/compliance/what-is-itgc) — What are IT general controls (ITGC)?: IT general controls are controls over the systems themselves, such as who can access them and how programs change, that automated financial controls rely on. ## L - [Least privilege](/guides/access-basics/what-is-least-privilege) — What is the principle of least privilege?: Least privilege means each person, and each program acting for a person, gets only the access their assigned work needs. NIST lists it as control AC-6. ## M - [Multi-factor authentication](/guides/access-basics/what-is-mfa) — What is multi-factor authentication (MFA)?: Multi-factor authentication (MFA) checks who you are with two or more types of factor (something you know, have or are), so a password alone isn't enough. ## O - [Onboarding and offboarding (account access)](/guides/hr-access/what-is-onboarding-offboarding) — What do onboarding and offboarding mean for account access?: For accounts, onboarding gives a new person their own logins and only the access the job needs. Offboarding shuts those off and changes shared passwords. ## P - [Password manager](/guides/shared-accounts/what-is-password-manager) — What is a password manager?: A password manager keeps logins in an encrypted vault and fills them in. A shared vault means no passwords sent by chat, but everyone with access can use them. - [Passwordless sign-in](/guides/access-basics/what-is-passwordless) — What is passwordless sign-in?: Passwordless sign-in proves who you are with a key on your device, not a password. Passkeys are the main example. Fill-in tools still use a password. - [Privileged access management](/guides/privileged-access/what-is-pam) — What is privileged access management (PAM)?: Privileged access management (PAM) controls who may use admin rights, for how long and with whose approval, and records what they did. - [Privileged account](/guides/privileged-access/what-is-a-privileged-account) — What is a privileged account?: A privileged account has admin rights, so it can change how a system is set up and who may use it. Cloud and SaaS admin accounts count, not just server ones. ## R - [Reasonable security](/guides/compliance/what-is-reasonable-security) — What is reasonable security?: Reasonable security is a US legal standard of safeguards that fit your size, data and risks. Some state rules spell it out for logins and access. ## S - [Secure browser](/guides/access-basics/what-is-secure-browser) — What is a secure browser (enterprise browser)?: A secure browser, which vendors such as Island call an enterprise browser, is a browser your company manages so it can block downloads, printing and copying. - [Security questionnaire](/guides/outsourcing-access/what-is-security-questionnaire) — What is a security questionnaire?: A security questionnaire is a set of written questions you send a vendor to learn how it protects your data and systems, before signing and during the contract. - [Session recording](/guides/access-basics/what-is-session-recording) — What is session recording?: Session recording keeps what someone did between sign-in and sign-out, as video, text or events. Coverage varies by product, and some states require notice. - [Shared account](/guides/shared-accounts/what-is-shared-account) — What is a shared account?: A shared account is one login that several people use on a service. Its records show the account, not the person, so you need another way to tell who acted. - [Single sign-on](/guides/access-basics/what-is-sso) — What is single sign-on (SSO)?: Single sign-on (SSO) lets you sign in once and open all the apps you may use. It works only with apps that connect to your identity provider. - [SOC 2](/guides/compliance/what-is-soc2) — What is SOC 2?: SOC 2 is a CPA's examination of a service company's system description and controls, measured against the AICPA's trust services criteria. - [Subcontracting](/guides/outsourcing-access/what-is-subcontracting) — What is subcontracting?: Subcontracting is when your vendor passes part of your work to another firm or person. HIPAA and the CCPA make the vendor bind that party by written contract. ## T - [Two-step verification](/guides/shared-accounts/what-is-two-step-verification) — What is two-step verification?: Two-step verification adds a second check after the password, like an app code or security key. Shared by a team, it no longer ties a sign-in to one person. ## U - [Unauthorized access (CFAA)](/guides/incidents/what-is-unauthorized-access-cfaa) — What is unauthorized access under the CFAA?: Under the federal anti-hacking law, the CFAA, unauthorized access means entering a computer "without authorization" or going past the access you were given. ## V - [Vendor oversight](/guides/outsourcing-access/what-is-vendor-oversight) — What is vendor oversight?: Vendor oversight is your duty to make sure an outside firm handling your customers' data protects it: choose a capable firm, bind it by contract, and check it. ## Z - [Zero trust](/guides/access-basics/what-is-zero-trust) — What is zero trust?: In zero trust, being on the company network earns no trust. Each request is checked for who is asking and from what device, then gets only the access it needs.