# Security and Compliance Glossary

> 60 terms from the Workplace & Collaboration book's Security and Compliance part, each defined in a line and linked to the chapter that explains it.

- **Approved channels register:** A firm's dated list of communication channels and devices approved for business, which the off-channel cases and MiFID II's device register require ([Regulated Communications & Archiving](https://www.syntaqx.com/books/workplace-and-collaboration/regulated-communications#the-off-channel-sweep)).
- **Archive connection:** An archiver's admin-approved, workspace-wide feed of messages, edits, deletions, files and recordings, the most privileged app grant in a tenant ([Regulated Communications & Archiving](https://www.syntaqx.com/books/workplace-and-collaboration/regulated-communications#capture-what-an-archive-needs-from-the-tool)).
- **Audit Logs API:** Slack's Enterprise-only, read-only API at `api.slack.com/audit/v1/` that returns organization audit events to an app the Org Owner installs with the `auditlogs:read` scope ([Audit Logs](https://www.syntaqx.com/books/workplace-and-collaboration/audit-logs#how-the-platforms-do-it)).
- **Audit (Premium):** Microsoft Purview's higher audit tier, with longer default retention, custom audit retention policies, intelligent insights such as `MailItemsAccessed` properties, and more API bandwidth ([Audit Logs](https://www.syntaqx.com/books/workplace-and-collaboration/audit-logs#how-the-platforms-do-it)).
- **Bossware:** Dedicated employee monitoring software that scores keyboard and mouse activity, times apps and sites, and takes screenshots or webcam captures ([Employee Monitoring & Privacy](https://www.syntaqx.com/books/workplace-and-collaboration/employee-monitoring-and-privacy#bossware)).
- **C5:** The German BSI's Cloud Computing Compliance Criteria Catalogue, an audited baseline that also requires disclosure of jurisdiction and data locations ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#international-programs)).
- **CAIQ:** The Cloud Security Alliance's yes-or-no questionnaire mapped to its Cloud Controls Matrix, completed for the STAR Registry ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#trust-centers-and-questionnaires)).
- **CASB:** A cloud access security broker, a service that discovers the cloud apps an organization's people use and applies data security controls to connected SaaS apps ([DLP & Information Protection](https://www.syntaqx.com/books/workplace-and-collaboration/dlp-and-information-protection#how-the-platforms-do-it)).
- **CJIS Security Addendum:** The FBI-approved agreement every private contractor processing criminal justice information signs, in place of a certification ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#programs-without-a-certificate)).
- **Client-side encryption (CSE):** Google Workspace encryption in which content is encrypted on the user's device with keys from a customer-chosen key service, so Google stores only ciphertext ([Encryption & Customer-Managed Keys](https://www.syntaqx.com/books/workplace-and-collaboration/encryption-and-customer-keys#what-client-side-and-double-key-encryption-give-up)).
- **Communication Compliance:** Microsoft Purview's supervision tool that applies policies and classifiers to Teams, email, Copilot and imported messages for designated reviewers ([Regulated Communications & Archiving](https://www.syntaqx.com/books/workplace-and-collaboration/regulated-communications#supervision-and-lexicon-review)).
- **Complementary user entity controls:** Controls a SOC 2 report says the customer must run, in workplace products mostly admin console settings ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#what-a-buyer-asks-for)).
- **Content access request:** A reasoned, approved and expiring request to reach a named person's or private container's content, the control works agreements and DPIAs ask for ([Employee Monitoring & Privacy](https://www.syntaqx.com/books/workplace-and-collaboration/employee-monitoring-and-privacy#product-patterns-that-hold-up)).
- **Crypto-shredding:** Making data unreadable by destroying the keys that encrypt it, used by customer-key products as the proof of deletion at exit ([Encryption & Customer-Managed Keys](https://www.syntaqx.com/books/workplace-and-collaboration/encryption-and-customer-keys#a-credible-exit)).
- **Custodian:** A person whose data a legal hold preserves, typically a key player in the dispute ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#scope-custodians-containers-and-queries)).
- **Customer Key:** Microsoft Purview's customer-managed root key service for Exchange, SharePoint, OneDrive, Teams and Copilot data, using two Azure Key Vault keys and a Microsoft-protected availability key ([Encryption & Customer-Managed Keys](https://www.syntaqx.com/books/workplace-and-collaboration/encryption-and-customer-keys#how-the-platforms-do-it)).
- **Customer-managed key (CMK):** A root key held in the customer's own cloud KMS that wraps the vendor's data keys, giving the customer a revocation switch and a key-use log; the name Atlassian and Zoom use for their schemes ([Encryption & Customer-Managed Keys](https://www.syntaqx.com/books/workplace-and-collaboration/encryption-and-customer-keys#what-customer-managed-keys-buy)).
- **Data loss prevention (DLP):** Policies that detect sensitive content or labels in messages, files and shares and warn, block, hide or quarantine them ([DLP & Information Protection](https://www.syntaqx.com/books/workplace-and-collaboration/dlp-and-information-protection#where-the-check-runs)).
- **Device code phishing:** Tricking a victim into entering an attacker-generated device sign-in code on a genuine sign-in page, which hands the attacker tokens ([Threats & Incidents](https://www.syntaqx.com/books/workplace-and-collaboration/threats-and-incidents#phishing-for-tokens)).
- **Discovery API:** Slack's Enterprise API for eDiscovery and DLP partners, returning messages, files, canvases and preserved edits and deletions ([eDiscovery & Export](https://www.syntaqx.com/books/workplace-and-collaboration/ediscovery-and-export#exports-and-apis)).
- **Double Key Encryption (DKE):** Microsoft encryption that needs both a customer-held key and an Azure key to open content, at the cost of search, eDiscovery, co-authoring and Copilot ([Encryption & Customer-Managed Keys](https://www.syntaqx.com/books/workplace-and-collaboration/encryption-and-customer-keys#what-client-side-and-double-key-encryption-give-up)).
- **EDRM:** The Electronic Discovery Reference Model, the industry's map of discovery stages, revised as EDRM 2.0 in September 2026 ([eDiscovery & Export](https://www.syntaqx.com/books/workplace-and-collaboration/ediscovery-and-export#the-edrm)).
- **Enterprise Key Management (EKM):** Slack's add-on that encrypts messages, files and the search index with keys in the customer's AWS KMS ([Encryption & Customer-Managed Keys](https://www.syntaqx.com/books/workplace-and-collaboration/encryption-and-customer-keys#how-the-platforms-do-it)).
- **GCC High:** Microsoft's US government environment for defense contractors and ITAR or CUI data, assessed at FIPS 199 High, with US-screened staff and federation only with itself ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#government-clouds)).
- **GovSlack:** Slack's separate US government environment, with its own SOC reports and FedRAMP High authorization ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#government-clouds)).
- **HAR file:** A browser recording of network traffic, often uploaded to support, which can contain live session tokens ([Threats & Incidents](https://www.syntaqx.com/books/workplace-and-collaboration/threats-and-incidents#phishing-for-tokens)).
- **Illicit consent grant:** An attacker's app that a user or admin is tricked into authorizing through a genuine consent screen ([Threats & Incidents](https://www.syntaqx.com/books/workplace-and-collaboration/threats-and-incidents#oauth-consent-and-app-abuse)).
- **Insider risk management:** Correlating signals such as downloads, DLP matches and HR events about one person into reviewable cases, pseudonymized by default ([DLP & Information Protection](https://www.syntaqx.com/books/workplace-and-collaboration/dlp-and-information-protection#insider-risk)).
- **IRAP:** Australia's program of ASD-endorsed assessors who assess cloud services against the Information Security Manual, up to PROTECTED ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#international-programs)).
- **ISO/IEC 42001:** The management system standard for organizations that develop, provide or use AI systems ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#the-iso-family-now-including-privacy-and-ai)).
- **Legal hold:** An instruction that suspends deletion of specified people's or places' content, overriding retention policies, until released ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#legal-hold-mechanics)).
- **Lexicon review:** Supervision that flags messages matching keyword lists and patterns for a principal's review ([Regulated Communications & Archiving](https://www.syntaqx.com/books/workplace-and-collaboration/regulated-communications#supervision-and-lexicon-review)).
- **Litigation hold notice:** The communication telling custodians what to preserve, with acknowledgments and periodic reminders ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#notices-reminders-and-release)).
- **MailItemsAccessed:** The Microsoft 365 audit event recording access to mailbox items, whose unexpected AppID revealed the 2023 Storm-0558 intrusion ([Audit Logs](https://www.syntaqx.com/books/workplace-and-collaboration/audit-logs#the-2023-lesson-logging-as-a-security-baseline)).
- **Modern attachment:** A file shared in a message by link rather than as an attached copy, which keeps changing after the message is sent ([eDiscovery & Export](https://www.syntaqx.com/books/workplace-and-collaboration/ediscovery-and-export#links-and-modern-attachments)).
- **Off-channel communications:** Business conducted on texting or messaging apps a regulated firm doesn't capture, the subject of the SEC and CFTC sweep from 2021 ([Regulated Communications & Archiving](https://www.syntaqx.com/books/workplace-and-collaboration/regulated-communications#the-off-channel-sweep)).
- **Policy tip:** The in-app notice DLP shows a user whose action matched a policy, often with an option to override with a justification ([DLP & Information Protection](https://www.syntaqx.com/books/workplace-and-collaboration/dlp-and-information-protection#false-positives-and-user-friction)).
- **Preservation Lock:** Microsoft's lock that makes a retention policy impossible to disable or weaken, even by global admins ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#preservation-lock)).
- **Principles of retention:** Microsoft's published precedence rules: retention over deletion, longest retention, explicit over implicit, shortest deletion ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#which-rule-wins)).
- **Privilege log:** The description of withheld privileged material that Rule 26(b)(5)(A) requires, detailed enough for the other side to assess the claim ([eDiscovery & Export](https://www.syntaqx.com/books/workplace-and-collaboration/ediscovery-and-export#privilege-and-clawback)).
- **Retention label:** A Purview label applied to an individual item that sets how long it is kept, traveling with the item, unlike a location-wide retention policy ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#which-rule-wins)).
- **Retention policy:** A customer rule for how long content in a location is kept and what happens when the time ends ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#how-the-platforms-do-it)).
- **Review set:** A Purview eDiscovery (Premium) collection of search results copied for review, threading, analytics and export ([eDiscovery & Export](https://www.syntaqx.com/books/workplace-and-collaboration/ediscovery-and-export#how-the-platforms-do-it)).
- **RSMF:** The Relativity Short Message Format, an email-wrapped zip with a JSON manifest that carries chat conversations into review platforms ([eDiscovery & Export](https://www.syntaqx.com/books/workplace-and-collaboration/ediscovery-and-export#threading-chat-for-review-rsmf)).
- **Rule 17a-4:** The SEC rule requiring broker-dealers to keep business communications three years, on an audit-trail or non-rewriteable system ([Regulated Communications & Archiving](https://www.syntaqx.com/books/workplace-and-collaboration/regulated-communications#the-us-recordkeeping-rules)).
- **Rule 37(e):** The federal civil rule on lost electronically stored information: measures to cure prejudice, and adverse inferences or dismissal only on intent to deprive ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#rule-37-e-and-spoliation)).
- **Rule 502(d) order:** A federal court order that disclosure in the case doesn't waive privilege, binding in other proceedings ([eDiscovery & Export](https://www.syntaqx.com/books/workplace-and-collaboration/ediscovery-and-export#privilege-and-clawback)).
- **SCuBA:** CISA's secure configuration baselines for Microsoft 365 and Google Workspace, with the ScubaGear and ScubaGoggles assessment tools ([Threats & Incidents](https://www.syntaqx.com/books/workplace-and-collaboration/threats-and-incidents#detection)).
- **Sensitivity label:** A clear-text, persistent classification on a file, email, meeting or container that can trigger encryption, markings and sharing limits ([DLP & Information Protection](https://www.syntaqx.com/books/workplace-and-collaboration/dlp-and-information-protection#sensitivity-labels)).
- **Session binding:** Tying a session or token to a device or network so a copied token fails elsewhere ([Threats & Incidents](https://www.syntaqx.com/books/workplace-and-collaboration/threats-and-incidents#phishing-for-tokens)).
- **SIEM export:** Streaming or pulling a vendor's audit events into the customer's security information and event management system, the long-term record ([Audit Logs](https://www.syntaqx.com/books/workplace-and-collaboration/audit-logs#retention-and-the-customer-s-copy)).
- **Simulation mode:** Running a DLP policy without enforcing its actions so its matches can be tuned before it blocks anything ([DLP & Information Protection](https://www.syntaqx.com/books/workplace-and-collaboration/dlp-and-information-protection#false-positives-and-user-friction)).
- **Spoliation:** The destruction or loss of evidence a party had a duty to preserve ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#rule-37-e-and-spoliation)).
- **SubstrateHolds:** The hidden mailbox folder where Microsoft keeps Teams messages that are edited, deleted or expired until retention allows permanent deletion ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#deletion-is-a-pipeline)).
- **Technical device (works council):** Under German law, any tool objectively suitable to monitor behavior or performance, whose introduction needs works council agreement ([Employee Monitoring & Privacy](https://www.syntaqx.com/books/workplace-and-collaboration/employee-monitoring-and-privacy#works-councils-and-microsoft-365)).
- **Token theft:** Replaying a session or refresh token issued to a user who already passed MFA ([Threats & Incidents](https://www.syntaqx.com/books/workplace-and-collaboration/threats-and-incidents#phishing-for-tokens)).
- **Tombstone:** A placeholder that hides a message or file flagged by DLP until an admin reviews it ([DLP & Information Protection](https://www.syntaqx.com/books/workplace-and-collaboration/dlp-and-information-protection#where-the-check-runs)).
- **Trust center:** A vendor's page for certifications, policies and subprocessors, with gated reports released under NDA ([Certifications & Procurement Assurance](https://www.syntaqx.com/books/workplace-and-collaboration/compliance-certifications#trust-centers-and-questionnaires)).
- **Undertaking (17a-4):** A broker-dealer's filing, signed by a designated executive officer or third party, promising to furnish records to the SEC ([Regulated Communications & Archiving](https://www.syntaqx.com/books/workplace-and-collaboration/regulated-communications#how-the-records-must-be-kept)).
- **Vault:** Google Workspace's retention, hold, search and export tool ([Retention & Legal Hold](https://www.syntaqx.com/books/workplace-and-collaboration/retention-and-legal-hold#how-the-platforms-do-it)).

---

Canonical URL: https://www.syntaqx.com/books/workplace-and-collaboration/glossary/security-and-compliance