Security and Compliance Glossary · Workplace

Approved channels register: A firm's dated list of communication channels and devices approved for business, which the off-channel cases and MiFID II's device register require (Regulated Communications & Archiving).
Archive connection: An archiver's admin-approved, workspace-wide feed of messages, edits, deletions, files and recordings, the most privileged app grant in a tenant (Regulated Communications & Archiving).
Audit Logs API: Slack's Enterprise-only, read-only API at api.slack.com/audit/v1/ that returns organization audit events to an app the Org Owner installs with the auditlogs:read scope (Audit Logs).
Audit (Premium): Microsoft Purview's higher audit tier, with longer default retention, custom audit retention policies, intelligent insights such as MailItemsAccessed properties, and more API bandwidth (Audit Logs).
Bossware: Dedicated employee monitoring software that scores keyboard and mouse activity, times apps and sites, and takes screenshots or webcam captures (Employee Monitoring & Privacy).
C5: The German BSI's Cloud Computing Compliance Criteria Catalogue, an audited baseline that also requires disclosure of jurisdiction and data locations (Certifications & Procurement Assurance).
CAIQ: The Cloud Security Alliance's yes-or-no questionnaire mapped to its Cloud Controls Matrix, completed for the STAR Registry (Certifications & Procurement Assurance).
CASB: A cloud access security broker, a service that discovers the cloud apps an organization's people use and applies data security controls to connected SaaS apps (DLP & Information Protection).
CJIS Security Addendum: The FBI-approved agreement every private contractor processing criminal justice information signs, in place of a certification (Certifications & Procurement Assurance).
Client-side encryption (CSE): Google Workspace encryption in which content is encrypted on the user's device with keys from a customer-chosen key service, so Google stores only ciphertext (Encryption & Customer-Managed Keys).
Communication Compliance: Microsoft Purview's supervision tool that applies policies and classifiers to Teams, email, Copilot and imported messages for designated reviewers (Regulated Communications & Archiving).
Complementary user entity controls: Controls a SOC 2 report says the customer must run, in workplace products mostly admin console settings (Certifications & Procurement Assurance).
Content access request: A reasoned, approved and expiring request to reach a named person's or private container's content, the control works agreements and DPIAs ask for (Employee Monitoring & Privacy).
Crypto-shredding: Making data unreadable by destroying the keys that encrypt it, used by customer-key products as the proof of deletion at exit (Encryption & Customer-Managed Keys).
Custodian: A person whose data a legal hold preserves, typically a key player in the dispute (Retention & Legal Hold).
Customer Key: Microsoft Purview's customer-managed root key service for Exchange, SharePoint, OneDrive, Teams and Copilot data, using two Azure Key Vault keys and a Microsoft-protected availability key (Encryption & Customer-Managed Keys).
Customer-managed key (CMK): A root key held in the customer's own cloud KMS that wraps the vendor's data keys, giving the customer a revocation switch and a key-use log; the name Atlassian and Zoom use for their schemes (Encryption & Customer-Managed Keys).
Data loss prevention (DLP): Policies that detect sensitive content or labels in messages, files and shares and warn, block, hide or quarantine them (DLP & Information Protection).
Device code phishing: Tricking a victim into entering an attacker-generated device sign-in code on a genuine sign-in page, which hands the attacker tokens (Threats & Incidents).
Discovery API: Slack's Enterprise API for eDiscovery and DLP partners, returning messages, files, canvases and preserved edits and deletions (eDiscovery & Export).
Double Key Encryption (DKE): Microsoft encryption that needs both a customer-held key and an Azure key to open content, at the cost of search, eDiscovery, co-authoring and Copilot (Encryption & Customer-Managed Keys).
EDRM: The Electronic Discovery Reference Model, the industry's map of discovery stages, revised as EDRM 2.0 in September 2026 (eDiscovery & Export).
Enterprise Key Management (EKM): Slack's add-on that encrypts messages, files and the search index with keys in the customer's AWS KMS (Encryption & Customer-Managed Keys).
GCC High: Microsoft's US government environment for defense contractors and ITAR or CUI data, assessed at FIPS 199 High, with US-screened staff and federation only with itself (Certifications & Procurement Assurance).
GovSlack: Slack's separate US government environment, with its own SOC reports and FedRAMP High authorization (Certifications & Procurement Assurance).
HAR file: A browser recording of network traffic, often uploaded to support, which can contain live session tokens (Threats & Incidents).
Illicit consent grant: An attacker's app that a user or admin is tricked into authorizing through a genuine consent screen (Threats & Incidents).
Insider risk management: Correlating signals such as downloads, DLP matches and HR events about one person into reviewable cases, pseudonymized by default (DLP & Information Protection).
IRAP: Australia's program of ASD-endorsed assessors who assess cloud services against the Information Security Manual, up to PROTECTED (Certifications & Procurement Assurance).
ISO/IEC 42001: The management system standard for organizations that develop, provide or use AI systems (Certifications & Procurement Assurance).
Legal hold: An instruction that suspends deletion of specified people's or places' content, overriding retention policies, until released (Retention & Legal Hold).
Lexicon review: Supervision that flags messages matching keyword lists and patterns for a principal's review (Regulated Communications & Archiving).
Litigation hold notice: The communication telling custodians what to preserve, with acknowledgments and periodic reminders (Retention & Legal Hold).
MailItemsAccessed: The Microsoft 365 audit event recording access to mailbox items, whose unexpected AppID revealed the 2023 Storm-0558 intrusion (Audit Logs).
Modern attachment: A file shared in a message by link rather than as an attached copy, which keeps changing after the message is sent (eDiscovery & Export).
Off-channel communications: Business conducted on texting or messaging apps a regulated firm doesn't capture, the subject of the SEC and CFTC sweep from 2021 (Regulated Communications & Archiving).
Policy tip: The in-app notice DLP shows a user whose action matched a policy, often with an option to override with a justification (DLP & Information Protection).
Preservation Lock: Microsoft's lock that makes a retention policy impossible to disable or weaken, even by global admins (Retention & Legal Hold).
Principles of retention: Microsoft's published precedence rules: retention over deletion, longest retention, explicit over implicit, shortest deletion (Retention & Legal Hold).
Privilege log: The description of withheld privileged material that Rule 26(b)(5)(A) requires, detailed enough for the other side to assess the claim (eDiscovery & Export).
Retention label: A Purview label applied to an individual item that sets how long it is kept, traveling with the item, unlike a location-wide retention policy (Retention & Legal Hold).
Retention policy: A customer rule for how long content in a location is kept and what happens when the time ends (Retention & Legal Hold).
Review set: A Purview eDiscovery (Premium) collection of search results copied for review, threading, analytics and export (eDiscovery & Export).
RSMF: The Relativity Short Message Format, an email-wrapped zip with a JSON manifest that carries chat conversations into review platforms (eDiscovery & Export).
Rule 17a-4: The SEC rule requiring broker-dealers to keep business communications three years, on an audit-trail or non-rewriteable system (Regulated Communications & Archiving).
Rule 37(e): The federal civil rule on lost electronically stored information: measures to cure prejudice, and adverse inferences or dismissal only on intent to deprive (Retention & Legal Hold).
Rule 502(d) order: A federal court order that disclosure in the case doesn't waive privilege, binding in other proceedings (eDiscovery & Export).
SCuBA: CISA's secure configuration baselines for Microsoft 365 and Google Workspace, with the ScubaGear and ScubaGoggles assessment tools (Threats & Incidents).
Sensitivity label: A clear-text, persistent classification on a file, email, meeting or container that can trigger encryption, markings and sharing limits (DLP & Information Protection).
Session binding: Tying a session or token to a device or network so a copied token fails elsewhere (Threats & Incidents).
SIEM export: Streaming or pulling a vendor's audit events into the customer's security information and event management system, the long-term record (Audit Logs).
Simulation mode: Running a DLP policy without enforcing its actions so its matches can be tuned before it blocks anything (DLP & Information Protection).
Spoliation: The destruction or loss of evidence a party had a duty to preserve (Retention & Legal Hold).
SubstrateHolds: The hidden mailbox folder where Microsoft keeps Teams messages that are edited, deleted or expired until retention allows permanent deletion (Retention & Legal Hold).
Technical device (works council): Under German law, any tool objectively suitable to monitor behavior or performance, whose introduction needs works council agreement (Employee Monitoring & Privacy).
Token theft: Replaying a session or refresh token issued to a user who already passed MFA (Threats & Incidents).
Tombstone: A placeholder that hides a message or file flagged by DLP until an admin reviews it (DLP & Information Protection).
Trust center: A vendor's page for certifications, policies and subprocessors, with gated reports released under NDA (Certifications & Procurement Assurance).
Undertaking (17a-4): A broker-dealer's filing, signed by a designated executive officer or third party, promising to furnish records to the SEC (Regulated Communications & Archiving).
Vault: Google Workspace's retention, hold, search and export tool (Retention & Legal Hold).

Approved channels register: A firm's dated list of communication channels and devices approved for business, which the off-channel cases and MiFID II's device register require (Regulated Communications & Archiving).
Archive connection: An archiver's admin-approved, workspace-wide feed of messages, edits, deletions, files and recordings, the most privileged app grant in a tenant (Regulated Communications & Archiving).
Audit Logs API: Slack's Enterprise-only, read-only API at api.slack.com/audit/v1/ that returns organization audit events to an app the Org Owner installs with the auditlogs:read scope (Audit Logs).
Audit (Premium): Microsoft Purview's higher audit tier, with longer default retention, custom audit retention policies, intelligent insights such as MailItemsAccessed properties, and more API bandwidth (Audit Logs).
Bossware: Dedicated employee monitoring software that scores keyboard and mouse activity, times apps and sites, and takes screenshots or webcam captures (Employee Monitoring & Privacy).
C5: The German BSI's Cloud Computing Compliance Criteria Catalogue, an audited baseline that also requires disclosure of jurisdiction and data locations (Certifications & Procurement Assurance).
CAIQ: The Cloud Security Alliance's yes-or-no questionnaire mapped to its Cloud Controls Matrix, completed for the STAR Registry (Certifications & Procurement Assurance).
CASB: A cloud access security broker, a service that discovers the cloud apps an organization's people use and applies data security controls to connected SaaS apps (DLP & Information Protection).
CJIS Security Addendum: The FBI-approved agreement every private contractor processing criminal justice information signs, in place of a certification (Certifications & Procurement Assurance).
Client-side encryption (CSE): Google Workspace encryption in which content is encrypted on the user's device with keys from a customer-chosen key service, so Google stores only ciphertext (Encryption & Customer-Managed Keys).
Communication Compliance: Microsoft Purview's supervision tool that applies policies and classifiers to Teams, email, Copilot and imported messages for designated reviewers (Regulated Communications & Archiving).
Complementary user entity controls: Controls a SOC 2 report says the customer must run, in workplace products mostly admin console settings (Certifications & Procurement Assurance).
Content access request: A reasoned, approved and expiring request to reach a named person's or private container's content, the control works agreements and DPIAs ask for (Employee Monitoring & Privacy).
Crypto-shredding: Making data unreadable by destroying the keys that encrypt it, used by customer-key products as the proof of deletion at exit (Encryption & Customer-Managed Keys).
Custodian: A person whose data a legal hold preserves, typically a key player in the dispute (Retention & Legal Hold).
Customer Key: Microsoft Purview's customer-managed root key service for Exchange, SharePoint, OneDrive, Teams and Copilot data, using two Azure Key Vault keys and a Microsoft-protected availability key (Encryption & Customer-Managed Keys).
Customer-managed key (CMK): A root key held in the customer's own cloud KMS that wraps the vendor's data keys, giving the customer a revocation switch and a key-use log; the name Atlassian and Zoom use for their schemes (Encryption & Customer-Managed Keys).
Data loss prevention (DLP): Policies that detect sensitive content or labels in messages, files and shares and warn, block, hide or quarantine them (DLP & Information Protection).
Device code phishing: Tricking a victim into entering an attacker-generated device sign-in code on a genuine sign-in page, which hands the attacker tokens (Threats & Incidents).
Discovery API: Slack's Enterprise API for eDiscovery and DLP partners, returning messages, files, canvases and preserved edits and deletions (eDiscovery & Export).
Double Key Encryption (DKE): Microsoft encryption that needs both a customer-held key and an Azure key to open content, at the cost of search, eDiscovery, co-authoring and Copilot (Encryption & Customer-Managed Keys).
EDRM: The Electronic Discovery Reference Model, the industry's map of discovery stages, revised as EDRM 2.0 in September 2026 (eDiscovery & Export).
Enterprise Key Management (EKM): Slack's add-on that encrypts messages, files and the search index with keys in the customer's AWS KMS (Encryption & Customer-Managed Keys).
GCC High: Microsoft's US government environment for defense contractors and ITAR or CUI data, assessed at FIPS 199 High, with US-screened staff and federation only with itself (Certifications & Procurement Assurance).
GovSlack: Slack's separate US government environment, with its own SOC reports and FedRAMP High authorization (Certifications & Procurement Assurance).
HAR file: A browser recording of network traffic, often uploaded to support, which can contain live session tokens (Threats & Incidents).
Illicit consent grant: An attacker's app that a user or admin is tricked into authorizing through a genuine consent screen (Threats & Incidents).
Insider risk management: Correlating signals such as downloads, DLP matches and HR events about one person into reviewable cases, pseudonymized by default (DLP & Information Protection).
IRAP: Australia's program of ASD-endorsed assessors who assess cloud services against the Information Security Manual, up to PROTECTED (Certifications & Procurement Assurance).
ISO/IEC 42001: The management system standard for organizations that develop, provide or use AI systems (Certifications & Procurement Assurance).
Legal hold: An instruction that suspends deletion of specified people's or places' content, overriding retention policies, until released (Retention & Legal Hold).
Lexicon review: Supervision that flags messages matching keyword lists and patterns for a principal's review (Regulated Communications & Archiving).
Litigation hold notice: The communication telling custodians what to preserve, with acknowledgments and periodic reminders (Retention & Legal Hold).
MailItemsAccessed: The Microsoft 365 audit event recording access to mailbox items, whose unexpected AppID revealed the 2023 Storm-0558 intrusion (Audit Logs).
Modern attachment: A file shared in a message by link rather than as an attached copy, which keeps changing after the message is sent (eDiscovery & Export).
Off-channel communications: Business conducted on texting or messaging apps a regulated firm doesn't capture, the subject of the SEC and CFTC sweep from 2021 (Regulated Communications & Archiving).
Policy tip: The in-app notice DLP shows a user whose action matched a policy, often with an option to override with a justification (DLP & Information Protection).
Preservation Lock: Microsoft's lock that makes a retention policy impossible to disable or weaken, even by global admins (Retention & Legal Hold).
Principles of retention: Microsoft's published precedence rules: retention over deletion, longest retention, explicit over implicit, shortest deletion (Retention & Legal Hold).
Privilege log: The description of withheld privileged material that Rule 26(b)(5)(A) requires, detailed enough for the other side to assess the claim (eDiscovery & Export).
Retention label: A Purview label applied to an individual item that sets how long it is kept, traveling with the item, unlike a location-wide retention policy (Retention & Legal Hold).
Retention policy: A customer rule for how long content in a location is kept and what happens when the time ends (Retention & Legal Hold).
Review set: A Purview eDiscovery (Premium) collection of search results copied for review, threading, analytics and export (eDiscovery & Export).
RSMF: The Relativity Short Message Format, an email-wrapped zip with a JSON manifest that carries chat conversations into review platforms (eDiscovery & Export).
Rule 17a-4: The SEC rule requiring broker-dealers to keep business communications three years, on an audit-trail or non-rewriteable system (Regulated Communications & Archiving).
Rule 37(e): The federal civil rule on lost electronically stored information: measures to cure prejudice, and adverse inferences or dismissal only on intent to deprive (Retention & Legal Hold).
Rule 502(d) order: A federal court order that disclosure in the case doesn't waive privilege, binding in other proceedings (eDiscovery & Export).
SCuBA: CISA's secure configuration baselines for Microsoft 365 and Google Workspace, with the ScubaGear and ScubaGoggles assessment tools (Threats & Incidents).
Sensitivity label: A clear-text, persistent classification on a file, email, meeting or container that can trigger encryption, markings and sharing limits (DLP & Information Protection).
Session binding: Tying a session or token to a device or network so a copied token fails elsewhere (Threats & Incidents).
SIEM export: Streaming or pulling a vendor's audit events into the customer's security information and event management system, the long-term record (Audit Logs).
Simulation mode: Running a DLP policy without enforcing its actions so its matches can be tuned before it blocks anything (DLP & Information Protection).
Spoliation: The destruction or loss of evidence a party had a duty to preserve (Retention & Legal Hold).
SubstrateHolds: The hidden mailbox folder where Microsoft keeps Teams messages that are edited, deleted or expired until retention allows permanent deletion (Retention & Legal Hold).
Technical device (works council): Under German law, any tool objectively suitable to monitor behavior or performance, whose introduction needs works council agreement (Employee Monitoring & Privacy).
Token theft: Replaying a session or refresh token issued to a user who already passed MFA (Threats & Incidents).
Tombstone: A placeholder that hides a message or file flagged by DLP until an admin reviews it (DLP & Information Protection).
Trust center: A vendor's page for certifications, policies and subprocessors, with gated reports released under NDA (Certifications & Procurement Assurance).
Undertaking (17a-4): A broker-dealer's filing, signed by a designated executive officer or third party, promising to furnish records to the SEC (Regulated Communications & Archiving).
Vault: Google Workspace's retention, hold, search and export tool (Retention & Legal Hold).