Glossary
The terms, in plain words
The vocabulary of cloud posture, remediation and evidence, defined once. Where ACSE uses a term in a specific way, the definition says so.
One meaning per word
Security, engineering, risk and audit read the same definition.
Grouped by stage
Terms follow the loop: finding risk, fixing it, deciding, proving.
Linked to the guides
Each group points you to the guide that explains it in depth.
Posture and risk
Finding what’s exposed
Explained in depth in What is CSPM? and Attack path analysis.
- CSPM
- Cloud security posture management: continuously checking cloud configuration against a baseline such as a benchmark or framework.
- Misconfiguration
- A setting that leaves a resource more exposed than intended, such as public storage or a plain-HTTP listener.
- Attack path
- A route through connected resources from an entry point, through weaknesses and permissions, to a valuable target.
- Trust chain
- The links on a path that carry access forward, such as a load balancer targeting a function or a function assuming a role.
- Blast radius
- Everything a change, or a compromise, can affect beyond the resource itself.
- NOT_EVALUATED / unknown
- A result where a fact couldn’t be established, or a check was turned off. In ACSE it counts against the score, never as a pass.
Fixing
Changing it safely
Explained in depth in Automated remediation.
- Remediation directive
- Data that describes a fix: the resource type, the setting to change, the result to expect, and the CLI equivalent. Applied by a deterministic patch engine.
- Draft pull request
- A fix opened as a draft in your repository at an exact commit, for your team to review. ACSE never merges it.
- Change set
- An ordered set of pull requests, one per repository, that together fix one finding across layered modules. A single pull request is a change set of one.
Deciding
Who approves, and how
- Step-up MFA
- A fresh multi-factor check at the moment of a decision, even within a signed-in session.
- Separation of duties
- The rule that the person approving a change is not the one who wrote or requested it.
- Exception
- An approved acceptance of a risk for a limited time, with an owner, reviewed again before it lapses.
- Exclusion
- Taking a control out of scope with a justification and a second person’s approval. It leaves the governed score’s total.
- Attestation
- A person’s signed statement that a control is met, used where a check can’t see. Approved by a second person.
Evidence
Proving it happened
Explained in depth in Compliance evidence.
- Evidence chain
- The ordered records of one case, from finding to verification, each linked to the one before.
- Hash chain
- A sequence where each record contains the hash of the previous one, so any change, removal or reordering is detectable.
- Object Lock / WORM
- Write once, read many: storage retention that stops records being overwritten or deleted during the retention period. ACSE uses S3 Object Lock in your account.
- Observation window
- The period after a fix is verified during which the resource is watched for regression. Seven days by default in ACSE.
- Seal
- A signed closure of a case’s chain once its loop is complete, so nothing can be appended unnoticed.
Scores and frameworks
Reporting honestly
- Raw score
- Passes divided by passes, failures and unknowns, straight from the evidence. Never adjusted.
- Governed score
- The score counting what your team has handled: attested controls and approved exceptions count as handled, and exclusions leave the total. Always shown beside the raw score.
- Framework pack
- Signed, versioned content that maps a framework’s controls to checks. Adopting a new version takes two people.
Architecture
How ACSE is built
Explained in depth in the trust center.
- Workload identity federation
- Letting one identity exchange a short-lived token for access in another cloud or account, with no long-lived key.
- Control plane
- The part ACSE hosts: the portal, cases and approvals. It receives shapes and counts and never reads your cloud.
- Customer runtime
- The part that runs in your account: scans, checks, the risk graph, fixes and evidence. It opens every connection outward.
- Egress registry
- A central, deny-by-default list of what may leave your boundary. An unregistered message is refused.
Questions
What people ask us
Is a term missing?
Tell us through the contact page and we will add it.
Why do raw and governed scores differ?
The governed score counts approved acceptances as handled and leaves exclusions out. The raw score never changes for either. See Compliance evidence.
What is the difference between an exception and an exclusion?
An exception accepts a risk on a control that is still in scope, for a time. An exclusion takes the control out of scope altogether, with a justification.
Keep reading
Related
Learn
Plain guides to cloud security posture, attack paths, automated remediation, policy as code and compliance evidence, with a glossary of the terms.
ReadACSETrust center
How ACSE keeps your data in your account, connects read-only with no keys, keeps people in charge of every change and leaves proof you can check yourself.
ReadPlatformEvidence
ACSE records every step of every fix in a signed, hash-chained, append-only record in your own account, which an auditor can verify offline.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.