Draft. This page is a work in progress and will be revisited.
This glossary explains terms used across the risk and mitigation catalog that carry a specific meaning in this catalog, or that are easy to misread. It is a living document.
- Attestation
- A named, timestamped confirmation by an accountable owner that a stated condition holds — for example, that a repository is in active use. An attestation is itself an evidentiary record and is retained as governance evidence.
- Audit trail
- An attributable, timestamped record of changes — who did what, and when — sufficient to reconstruct the state of something at any past point in time. Where strict immutability is not used, a sufficient audit trail is the accepted alternative for preserving history.
- Content-addressable identity
- Identifying an artifact by a cryptographic hash of its contents, so that any change to the artifact produces a different identity and tampering is immediately detectable.
- Control chain
- A set of controls that are logically dependent on one another and linked as an ordered sequence, where one control establishes the conditions the next relies on (for example, a requirements repository feeding release-time requirements approval).
- Control phase
- The point in the software lifecycle at which a control principally applies — for example CODE, RELEASE, RUNTIME, or LIFECYCLE (spanning the whole cycle).
- Control type
- The control's mode of action, such as PREV (preventive — stops an undesirable outcome occurring). Used to classify how a control mitigates its risks.
- Deployment gating
- A policy-based check at the point of deployment that blocks an individual deployment from proceeding unless defined technical criteria are met. Distinct from version release approval, which authorises a version to be released at all.
- Document status
- The maturity of a control or risk document: Pre-Draft (initial notes), Draft (being written), First-Reading-Approved (passed first working-group reading, substantially complete but not yet final), and Working-Group-Approved (final, approved).
- Immutability
- The property that, once recorded, something cannot be changed. In this catalog, history may be preserved either by strict immutability or by a sufficient audit trail; the required property is that history cannot be altered or destroyed undetectably.
- Mitigation (Control)
- A control that reduces one or more risks. "Mitigation" and "control" are used interchangeably; each mitigation references the risks it addresses.
- Provenance
- A documented, verifiable chain of custody for a software artifact, from source commit through build and into deployment, establishing where it came from and how it was produced.
- Regulatory guidance vs. industry standard
- A reference distinction used in this catalog. Regulatory guidance is issued by regulators (for example the FFIEC IT Handbook); industry standards are voluntary, consensus-based frameworks (for example NIST, ISO/IEC, SLSA).
- Release, deployment, and promotion
- A release is a version of software made available for production; deployment is the act of placing software into an environment; promotion is moving a build forward through environments toward production. The catalog uses "released to production" for the point software goes live.
- Risk
- An undesirable outcome the catalog seeks to reduce. Each risk is addressed by one or more mitigations (controls).
- Tamper-evident history
- History that cannot be altered or destroyed without detection. It does not require that history never change — only that any change is detectable and that no data is silently lost. Authorised, logged amendments (for example, purging a committed secret) are permitted.