Glossary
Abbreviations used across the catalog — the expansion, and what the term means here. The same explanations appear when hovering a dotted-underlined term anywhere in the guide.
Internal notation (this catalog's own shorthand)
| Notation | Meaning |
|---|---|
| Tier 0–4 | The catalog's paranoia ladder: 0 hygiene → 1 standard practice → 2 hardened → 3 paranoid → 4 extreme/creative. Controls carry an absolute number (e.g. №25) that increments through the tiers in ROI order per the master table. |
| #1–#48 | Policy numbers from the 48-policy register (Google Sheet); the mapping doc links every control to one. |
| GREEN / AMBER / RED | The three-level Drive-label classification scheme (№44): public / internal / restricted. |
Google Workspace & Google-specific
| Term | Expansion | As used here |
|---|---|---|
| APP | Advanced Protection Program | Google's free strongest-protection bundle for enrolled high-risk users (Tier №23). Not to be confused with "app." |
| ASP | App-Specific Password | Legacy per-app password that bypasses interactive MFA; the UNC6293 attack vector; killed by APP enrollment (Tier №35). |
| CAA | Context-Aware Access | Conditional access by IP, geo, and device posture (Enterprise Standard+). Tiers №14, №29, №49. |
| CEL | Common Expression Language | Google's expression syntax for advanced CAA access levels (device-attested CAA, №29/№49). |
| CI (Premium) | Cloud Identity (Premium) | Google's identity-only license. Cloud Identity Free seats power the zero-cost decoy accounts (№56); Premium unlocks CAA/DLP-adjacent features without full Workspace Enterprise. |
| CSE | Client-Side Encryption | Browser-side encryption with customer-controlled keys via a KACLS, so Google cannot decrypt (Tiers №71, №50). |
| DASA | Delegated Admin Service Account | Service account authenticating with its own identity, scoped to admin roles, correctly attributed in audit logs — the safe alternative to DwD (№62, №39). |
| DBSC | Device Bound Session Credentials | Chrome mechanism binding session cookies to device hardware (TPM), killing cookie-replay. GA + default-on for Workspace since May 2026, Windows-only so far (№10). |
| DwD | Domain-wide Delegation | Service-account impersonation of any user in the tenant. This catalog's flagship anti-pattern: skeleton-key risk, and API reads under it are invisible at content level (№62, №63). |
| EV | Endpoint Verification | Google's device-posture agent (Chrome extension + helper) feeding CAA device conditions (Tier №29). |
| GAL | Global Address List | The tenant directory users can autocomplete/search; minimized for targeted staff in №41. |
| GAM | Google Apps Manager (GAM7 / GAMADV-XTD3) | The de-facto CLI for Workspace administration; the "agent multiplier" that makes sweep/seed/inventory controls (№39, №58, №11, №5) routine. |
| GCE / GCP / GCS | Google Compute Engine / Google Cloud Platform / Google Cloud Storage | GCP hosts the WORM log archive (№60); GCS Bucket Lock provides the immutability; GCE VMs with attached service accounts avoid on-disk keys. |
| GTIG | Google Threat Intelligence Group | Google's threat-intel unit; source (with Citizen Lab) for the UNC6293/ASP attack reporting. |
| GWS | Google Workspace | Used mainly in CISA SCuBA baseline IDs (e.g. GWS.GMAIL.15.1v1). |
| KACLS | Key Access Control List Service | The external key service CSE calls to wrap/unwrap encryption keys; partner-run (Tier №71) or self-hosted/HYOK (Tier №50). |
| MPA | Multi-party approval | Google's native two-person rule for sensitive admin actions (№24) — the catalog's flagship "already paid for, never enabled" control. |
| OU | Organizational Unit | Workspace's policy-scoping tree. Note: OUs scope policy, not admin-plane isolation — a super admin reaches all OUs (why multi-tenant, №70, exists). |
| SIT | Security Investigation Tool | The premium audit-and-investigation console (Enterprise Standard+); 30M-row exports vs 100k standard; content views require recorded justification (№63). |
| TAG | Threat Analysis Group | Google's nation-state-threat team; source of government-backed attack warnings (Tier №3). |
| Takeout | (not an abbreviation — Google's self-service data-export feature) | Disabled in Tier №36 as the self-service bulk-exfil brake. |
Security concepts & attack techniques
| Term | Expansion | As used here |
|---|---|---|
| 2SV | 2-Step Verification | Google's term for MFA (Tier №1). "Only security key" mode = the phishing-resistant enforcement level (Tier №7). |
| AiTM | Adversary-in-the-Middle | Reverse-proxy phishing (Evilginx-class) that relays credentials + MFA and steals the session cookie in real time; defeated by FIDO2/passkeys, not by SMS/TOTP. |
| BEC | Business Email Compromise | Payment-fraud phishing; part of the Tier 0–1 commodity threat model. |
| BCP | Business Continuity Plan(ning) | A register gap — the missing backup/recoverability policy. |
| EDR | Endpoint Detection & Response | Endpoint agent (Sophos, iVerify in the field docs); adjacent layer the Workspace catalog assumes but doesn't own. |
| FIDO2 | Fast IDentity Online v2 | The WebAuthn-based standard behind security keys and passkeys; origin-bound, hence phishing-resistant (Tier №7). |
| HYOK | Hold Your Own Key | Self-hosted KACLS so no vendor (including Google) can decrypt or be compelled (Tier №50). |
| IRM | Information Rights Management | Per-file download/print/copy restrictions; Enhanced IRM (2025) extends them to editors/owners (№44, №48). |
| ITDR | Identity Threat Detection & Response | Commercial product category productizing what Tier №68 detection engineering builds by hand. |
| JIT | Just-In-Time (access) | Privilege granted on demand with auto-expiry; no native Workspace support, hence the scripted №42. |
| MFA | Multi-Factor Authentication | Generic term; Google's implementation is 2SV. |
| MSP / MSSP | Managed (Security) Service Provider | The supply-chain compromise pattern (breach one vendor, reach every client) that the zero-standing-access pattern (№62) is designed to break. |
| PAL | Permissive Action Link | Nuclear-weapon use-control device; doctrine source for the two-person rule ports (№24, №38). |
| PAM / PIM | Privileged Access/Identity Management | The product category (Azure PIM, GCP PAM) whose Workspace absence №42 fills by script. |
| PAW | Privileged Access Workstation | Dedicated device used only for admin work (№53); the Qubes-dom0/Microsoft-ESAE port. |
| PII | Personally Identifiable Information | The classic DLP detector target (Tier №28). |
| SCIF | Sensitive Compartmented Information Facility | The "consultable inside, inert outside" room; doctrine source for the reading-room enclave (№48). |
| TOTP | Time-based One-Time Password | Authenticator-app codes; better than SMS, still AiTM-phishable — hence FIDO2-only enforcement. |
| TEE | Trusted Execution Environment | Confidential-computing isolation; register #47's SL4 weight-security suite (beyond this catalog's scope). |
| TEMPEST | (codename, not acronym) — emanations-security standard | Register #48's SL5 nation-state suite; cited as the part of the two-person-rule row that genuinely stays out of reach. |
| TPM | Trusted Platform Module | The hardware key store DBSC binds cookies to (№10); macOS equivalent is the Secure Enclave. |
| TS/SCI | Top Secret / Sensitive Compartmented Information | US clearance level; register #48 context only. |
| WORM | Write Once, Read Many | Immutable storage; the locked-bucket log archive (№60). |
| ZTNA | Zero Trust Network Access | Posture-checked access brokering (field docs' WARP/ZTNA layer); adjacent to, not part of, this catalog. |
Email authentication & mail flow
| Term | Expansion | As used here |
|---|---|---|
| DKIM | DomainKeys Identified Mail | Cryptographic signing of outbound mail; console-configured, 2048-bit, all editions (№4). Visual explainer |
| DMARC | Domain-based Message Authentication, Reporting & Conformance | Alignment policy over SPF/DKIM; rolled out p=none → quarantine → reject (№4). Visual explainer |
| MTA-STS | Mail Transfer Agent Strict Transport Security | DNS+HTTPS policy forcing TLS on inbound mail delivery, blocking downgrade (№30). |
| MX | Mail eXchanger (DNS record) | Mail routing; MX-interception gateways are the Tier №51 anti-pattern for this client profile. |
| RUA | Reporting URI for Aggregate data | The DMARC aggregate-report mailbox; raw XML, no native Google parser — keep it client-owned (№4). |
| SPF | Sender Policy Framework | DNS record listing authorized senders; mind the 10-DNS-lookup limit (№4). Visual explainer |
| SMTP | Simple Mail Transfer Protocol | Mail transport; "per-user outbound gateways" = user-controlled external SMTP, kept disabled (№61's routing watch). |
| TLS-RPT | TLS Reporting | Companion reports on MTA-STS/TLS delivery failures (№30). |
Standards, frameworks & organizations
| Term | Expansion | As used here |
|---|---|---|
| BOD | Binding Operational Directive (CISA) | BOD 25-01 drives SCuBA adoption; GWS baselines still draft as of mid-2026. |
| CE / CE+ | Cyber Essentials (Plus) | UK certification scheme; v3.3 "Danzell" (Apr 2026) makes cloud MFA an auto-fail — register crosswalk column. |
| CIS (IG1–IG3) | Center for Internet Security (Implementation Groups 1–3) | Control framework used by the field-doc CSV; IG = maturity sizing. |
| CISA | Cybersecurity and Infrastructure Security Agency (US) | Publishes SCuBA baselines and ScubaGoggles. |
| CSF | Cybersecurity Framework (NIST) | v2.0; register crosswalk column (Govern/Identify/Protect/Detect/Respond/Recover functions). |
| CT | Certificate Transparency | Append-only public CA logs; doctrine source for the WORM archive (№60). |
| ISO/IEC 27001 | International Organization for Standardization / International Electrotechnical Commission standard 27001 | 2022 edition; register crosswalk (Annex A controls). |
| NIST | National Institute of Standards and Technology (US) | Publisher of the AI RMF, CSF, and SP 800-53 used in the register. |
| OC1–OC5 | Operational Capacity 1–5 (RAND attacker tiers) | Amateur → professional → syndicate/insider → ordinary state → top nation-state; register threat-linkage column. |
| RAND / RRA2849-1 | RAND Corporation / report "Securing AI Model Weights" | The threat source the client's register is scaled down from. |
| RMF | (AI) Risk Management Framework | NIST AI 100-1; the register's organizing framework (GOVERN/MAP/MEASURE/MANAGE). |
| SCuBA | Secure Cloud Business Applications | CISA's cloud-config baseline program; GWS set = 11 baseline documents as of v0.6.0. |
| ScubaGoggles | (tool name) | CISA's free assessment tool checking a Workspace tenant against SCuBA (№69, №61). |
| SL1–SL5 | Security Level 1–5 (RAND) | The register's control ladder, analogous to this catalog's tiers. |
| SOC 2 | System and Organization Controls 2 | Attestation framework in the register's crosswalk. |
| SOX | Sarbanes-Oxley Act | Source of the user-access-review discipline ported in №43. |
| UAR | User Access Review | The SOX-shop quarterly recertification ritual (№43). |
| UNC6293 | (Mandiant/GTIG uncategorized-threat-actor designation, not an acronym) | The 2025 ASP-phishing campaign against Russia-focused academics (low-confidence APT29 link); evidence base for Tiers №35 and №49. |
General IT
| Term | Expansion | As used here |
|---|---|---|
| API | Application Programming Interface | — |
| ASN | Autonomous System Number | Network-owner identifier; hosting/VPS/residential-proxy ASNs are detection features (Tier №68). |
| AWS | Amazon Web Services | The honeytoken key type (№55) — fires when used against AWS's API. |
| CLI | Command-Line Interface | GAM et al.; the automation layer. |
| CRM | Customer Relationship Management | Example of the forgotten legitimate sender DMARC observation surfaces (№4). |
| DEK | Data Encryption Key | The per-object key CSE wraps via the KACLS. |
| DNS | Domain Name System | Where SPF/DMARC/MTA-STS live, and the recovery-path dependency (air-gapped kit). |
| HSM | Hardware Security Module | Tamper-resistant key hardware; "HSM-backed super admin" debunked as folklore in the original catalog. |
| IdP | Identity Provider | External SSO authority (Okta, Entra…); Tier №22. |
| IMAP / POP | Internet Message Access Protocol / Post Office Protocol | Legacy mail protocols disabled in Tier №35. |
| KMS | Key Management Service | Generic managed-key infrastructure behind a self-hosted KACLS. |
| KSK | Key Signing Key | The DNSSEC root key whose ICANN ceremony №37 ports. |
| LLM | Large Language Model | The agent class the AI-canary (№66) and Apps Script governance (№67) govern. |
| MCP | Model Context Protocol | Agent-to-tool connector standard; example integration risk in №66. |
| MDM | Mobile Device Management | Device-management tooling (Jamf etc.); required for Tier №29, deliberately not required for №10. |
| ML | Machine Learning | E.g. the ML-based anomalous-download alert (№48). |
| NGO | Non-Governmental Organization | Half the client profile; drives the nation-state and compelled-access threat models. |
| OIDC | OpenID Connect | OAuth-based federation protocol, alternative to SAML (Tier №22). |
| OAuth | Open Authorization | Token-based third-party access; the catalog's dominant exfil surface (Tiers №8, №39). |
| ROI | Return On Investment | This catalog's ranking quotient: security gain ÷ resource investment. |
| SaaS | Software as a Service | — |
| SAML | Security Assertion Markup Language | Federation protocol for SSO (Tier №22); SAML apps evaluate CAA at sign-in only. |
| SDK | Software Development Kit | "Drive SDK" toggle = third-party API access to Drive files (№48 data-copy minimization). |
| SIEM | Security Information and Event Management | Log aggregation/detection platform (Tier №33). |
| SMS | Short Message Service | Text-message 2SV; deprecated factor (AiTM- and SIM-swap-phishable). |
| SSO | Single Sign-On | Federated login (Tier №22). |
| TLS / SSL | Transport Layer Security / Secure Sockets Layer | Transport encryption; SSL is the legacy name (№10's SSL-override policy). |
| VM | Virtual Machine | Sandbox detonation (Tier №25) and the Qubes isolation model (№27). |
| VPN | Virtual Private Network | Field-doc adjacent layer (WARP); not a catalog control. |
| VPS | Virtual Private Server | Attacker infrastructure class (DigitalOcean in the UNC6293 case); detection feature. |
| WebAuthn | Web Authentication (W3C standard) | The browser API underlying FIDO2/passkeys. |