Glossary · SY0-801
Security+ acronyms list for 2026, explained in plain English
180 acronyms you’ll meet while studying for CompTIA Security+® SY0-801. Each one is expanded, explained in a line and linked to the objective where it matters. Search it, filter it, then test yourself.
Security+ acronym lists at a glance
- 106Acronyms on CompTIA’s official SY0-801 list, inside the exam objectives.
- ~320Acronyms on the SY0-701 list, so the new one is about a third of the size.
- 34Acronyms on the SY0-801 list that weren’t on SY0-701’s, by our count.
- 180Terms in this glossary, written in our own words.
This isn’t CompTIA’s list. The official one is at the end of CompTIA’s SY0-801 exam objectives (PDF); use it as the final word on what the exam’s list contains.
The acronym list
Search 180 Security+ acronyms
Type an acronym or a word from its meaning. Filter by topic, by exam domain, or to the terms that are new in SY0-801. The number on each entry is the objective it belongs to.
Topic
Domain
Showing all 180 acronyms
A
- AAA
- Authentication, Authorization and Accounting
- Proving who someone is, deciding what they may do, and recording what they did.
- ACL
- Access Control List
- An ordered list of allow and deny rules on a firewall, router or resource.
- AES
- Advanced Encryption Standard
- The standard symmetric block cipher, with 128-, 192- or 256-bit keys.
- AI
- Artificial Intelligence
- Systems that do tasks needing human-like judgment; objective 2.6 covers the risks of using them.
- ALE
- Annualized Loss Expectancy
- Expected loss per year: SLE × ARO.
- AML/CTF
- Anti-Money Laundering / Counter-Terrorism Financing
- Laws and staff training that stop the financial system being used for crime or terrorism.
- API
- Application Programming Interface
- A defined way for software to talk to software; APIs need authentication and rate limits.
- APT
- Advanced Persistent Threat
- A well-resourced attacker that gets quiet, long-term access and moves slowly.
- ARO
- Annualized Rate of Occurrence
- How many times a year a risk is expected to happen.
- ATT&CK
- Adversarial Tactics, Techniques, and Common Knowledge
- MITRE's knowledge base of attacker tactics and techniques, used to map detections.
- AUP
- Acceptable Use Policy
- Rules for how people may use the organization's systems and data.
B
- BEC
- Business Email Compromise
- Fraud from a hijacked or spoofed business mailbox, often to redirect a payment.
- BIA
- Business Impact Analysis
- Works out which business functions matter most and what disruption to each would cost.
- BIMI
- Brand Indicators for Message Identification
- Shows a verified brand logo beside authenticated mail; it needs DMARC at enforcement.
- BYOD
- Bring Your Own Device
- Staff using personal devices for work, under a BYOD policy.
C
- CA
- Certificate Authority
- A trusted party that checks identities and signs digital certificates.
- CAB
- Change Advisory Board
- The group that reviews and approves significant changes.
- CAPTCHA
- Completely Automated Public Turing test to tell Computers and Humans Apart
- A “prove you're human” check; fake ones trick people into running pasted commands.
- CASB
- Cloud Access Security Broker
- Sits between users and cloud apps to enforce policy and spot risky use.
- CERT
- Computer Emergency Response Team
- An incident response team; national CERTs publish external advisories.
- CI/CD
- Continuous Integration / Continuous Delivery (or Deployment)
- Automated pipelines that build, test and ship code, with security checks built in.
- CRL
- Certificate Revocation List
- A list a CA publishes of certificates it has revoked before they expire.
- CSPM
- Cloud Security Posture Management
- Continuously checks cloud settings against policy, such as public storage or open ports.
- CSR
- Certificate Signing Request
- What you send a CA to get a certificate: your public key and identity details, never the private key.
- CSRF
- Cross-Site Request Forgery
- Tricking a signed-in user's browser into sending a request they didn't mean to.
- CVE
- Common Vulnerabilities and Exposures
- The public ID system for known vulnerabilities, written like CVE-2024-12345.
- CVSS
- Common Vulnerability Scoring System
- FIRST's 0 to 10 score for how severe a vulnerability is.
- CWE
- Common Weakness Enumeration
- A catalog of the underlying kinds of software weakness, such as improper input validation.
D
- DAC
- Discretionary Access Control
- The owner of a file or resource decides who may use it.
- DDoS
- Distributed Denial of Service
- A denial-of-service flood from many sources at once, such as a botnet.
- DH
- Diffie-Hellman
- A key exchange that lets two parties agree a shared secret over an untrusted network.
- DHCP
- Dynamic Host Configuration Protocol
- Hands out IP addresses and network settings automatically; a rogue DHCP server can redirect traffic.
- DKIM
- DomainKeys Identified Mail
- Signs outgoing mail so receivers can check it came from the domain and wasn't altered.
- DLP
- Data Loss Prevention
- Detects or blocks sensitive data leaving by email, web, USB or cloud.
- DMARC
- Domain-based Message Authentication, Reporting and Conformance
- Tells receivers what to do with mail that fails SPF or DKIM, and sends reports back.
- DMZ
- Demilitarized Zone
- A segment for public-facing servers between the internet and the internal network; also called a screened subnet.
- DNS
- Domain Name System
- Turns names like example.com into IP addresses; port 53.
- DNSSEC
- Domain Name System Security Extensions
- Signs DNS records so resolvers can spot forged answers. It doesn't encrypt them.
E
- E2EE
- End-to-End Encryption
- Only the two endpoints can read the messages, not the service in between.
- EAP
- Extensible Authentication Protocol
- The framework of sign-in methods used with 802.1X on wired and wireless networks.
- ECC
- Elliptic-Curve Cryptography
- Asymmetric cryptography that gives strong security with much shorter keys than RSA.
- EDR
- Endpoint Detection and Response
- Records activity on endpoints, detects threats and helps responders contain them.
- EOI
- Expression of Interest
- An early call to see which vendors are interested, used to build a shortlist.
F
- FDE
- Full Disk Encryption
- Encrypting a whole drive, so a lost or stolen device's data is unreadable without the key.
- FTP
- File Transfer Protocol
- Unencrypted file transfer on ports 20 and 21.
- FTPS
- FTP Secure
- FTP with TLS: port 990 for implicit TLS, or 21 when TLS is negotiated.
G
- GBIC
- Gigabit Interface Converter
- An older, larger hot-swappable network transceiver, since replaced by SFP.
- GDPR
- General Data Protection Regulation
- The EU law on personal data, with rights such as erasure and correction.
- gMSA
- Group Managed Service Account
- A Windows service account whose password the directory rotates automatically.
- GRC
- Governance, Risk and Compliance
- How an organization sets direction, manages risk and meets its obligations, as one program.
H
- HIPAA
- Health Insurance Portability and Accountability Act
- The US law that protects health information.
- HMAC
- Hash-based Message Authentication Code
- A hash mixed with a secret key, proving a message is unchanged and came from a key holder.
- HR
- Human Resources
- The team to involve when an investigation concerns an employee.
- HSM
- Hardware Security Module
- A tamper-resistant device that generates, stores and uses cryptographic keys.
- HTTP
- Hypertext Transfer Protocol
- The web's protocol, unencrypted; port 80.
- HTTPS
- HTTP Secure
- HTTP inside TLS; port 443.
I
- IaaS
- Infrastructure as a Service
- The provider supplies servers, storage and networks; you secure the OS and everything above it.
- IaC
- Infrastructure as Code
- Infrastructure defined in version-controlled templates instead of built by hand.
- IAM
- Identity and Access Management
- The processes and tools that create identities, grant access and take it away.
- IdP
- Identity Provider
- The central sign-in service that vouches for users to other apps, which makes it a high-value target.
- IDS
- Intrusion Detection System
- Watches network traffic or a host and alerts on suspicious activity.
- IMAP
- Internet Message Access Protocol
- Reads and syncs email kept on the server; port 143, or 993 over TLS.
- IoC
- Indicator of Compromise
- Evidence of a possible breach, such as a malicious file hash, IP address or domain.
- IoT
- Internet of Things
- Connected cameras, sensors, printers and the like, often hard to patch.
- IPAM
- IP Address Management
- Tracking IP address use, which helps find live hosts missing from inventory and scans.
- IPFIX
- IP Flow Information Export
- The standard format for flow records: who talked to whom, when and how much, without contents.
- IPS
- Intrusion Prevention System
- Like an IDS, but sits inline and can block what it detects.
- IPsec
- Internet Protocol Security
- Authenticates and encrypts IP packets; common for site-to-site VPNs.
- IR
- Incident Response
- Preparing for, handling and learning from security incidents.
- ISAC
- Information Sharing and Analysis Center
- A sector group where organizations share threat intelligence.
J
- JIT
- Just-in-Time (access)
- Elevated rights granted on request for a limited time, then removed automatically.
K
- KEV
- Known Exploited Vulnerabilities (catalog)
- CISA's list of vulnerabilities seen exploited in the wild, useful for deciding what to patch first.
L
- LDAP
- Lightweight Directory Access Protocol
- Queries and updates directories such as Active Directory; port 389.
- LDAPS
- LDAP over SSL/TLS
- Encrypted LDAP, on port 636.
- LLM
- Large Language Model
- An AI model trained on huge amounts of text that generates language, and an attack surface in its own right.
- LMS
- Learning Management System
- The platform that delivers and tracks security awareness training.
M
- MAC
- Mandatory Access Control
- Access is decided centrally by labels and clearances, not by the data's owner. (Also: media access control address.)
- MD5
- Message Digest 5
- An old 128-bit hash that is broken for security use because collisions are easy to make.
- MDM
- Mobile Device Management
- Central control of phones and tablets: policies, apps, encryption and remote wipe.
- MFA
- Multifactor Authentication
- Signing in with two or more different kinds of factor, such as a password plus an app prompt.
- MITM
- Man-in-the-Middle
- The older name for an on-path attack, where someone secretly sits between two parties.
- ML
- Machine Learning
- AI that learns patterns from data instead of following hand-written rules.
- MOU
- Memorandum of Understanding
- A written statement of shared intent, usually less formal than a contract.
- MSA
- Master Service Agreement
- The umbrella contract whose terms apply to each later piece of work.
- MTBF
- Mean Time Between Failures
- The average time a system runs before it fails.
- MTTR
- Mean Time to Repair (or Recover)
- The average time it takes to fix a failure and restore service.
N
- NAC
- Network Access Control
- Checks a device's identity and health before letting it onto the network.
- NAT
- Network Address Translation
- Rewrites private addresses to public ones at the edge; NAT logs link the two in investigations.
- NDA
- Non-Disclosure Agreement
- A contract that obliges the parties to keep shared information confidential.
- NIC
- Network Interface Card
- The hardware that connects a device to a network.
- NIST
- National Institute of Standards and Technology
- The US agency behind widely used security frameworks and guidance.
- NTP
- Network Time Protocol
- Keeps clocks in sync, which log timelines depend on; UDP 123.
- NVD
- National Vulnerability Database
- NIST's database that adds scores and details to CVE records.
O
- OAuth
- Open Authorization
- Lets an app act for a user with limited, delegated access, without seeing the password.
- OCSP
- Online Certificate Status Protocol
- A real-time check of whether one certificate has been revoked.
- OIDC
- OpenID Connect
- An identity layer on top of OAuth that adds user authentication.
- OSINT
- Open-Source Intelligence
- Intelligence gathered from public sources such as websites, social media and records.
- OT
- Operational Technology
- Systems that control physical processes, where safety and uptime come first.
- OTP
- One-Time Password
- A code that works only once, sent by text or generated by an app or token.
P
- PaaS
- Platform as a Service
- The provider runs the platform; you secure your code, data and access.
- PAM
- Privileged Access Management
- Tools and processes that control, monitor and limit the use of admin accounts.
- PCAP
- Packet Capture
- A recording of network packets, and the common file format for one.
- PCI DSS
- Payment Card Industry Data Security Standard
- The security standard for anyone who stores, processes or sends card payments.
- Portable Document Format
- A document format that can carry malicious links or code as an attachment.
- PHI
- Protected Health Information
- Health information linked to a person, protected by laws such as HIPAA.
- PII
- Personally Identifiable Information
- Data that can identify a person, such as a name together with a date of birth.
- PIR
- Post-Incident Report
- The written record of an incident: timeline, impact, root cause and agreed fixes.
- PKI
- Public Key Infrastructure
- The certificate authorities, certificates and rules that bind public keys to identities.
- POP3
- Post Office Protocol version 3
- Downloads email from a server; port 110, or 995 over TLS.
Q
- QR
- Quick Response (code)
- A 2D barcode that hides a link; quishing uses one to lure people to a malicious page.
R
- RADIUS
- Remote Authentication Dial-In User Service
- Central authentication for network access such as Wi-Fi and VPN; UDP 1812 and 1813.
- RAG
- Retrieval-Augmented Generation
- An LLM that pulls documents from a knowledge base into its prompt; poison the base and you poison the answers.
- RAID
- Redundant Array of Independent Disks
- Spreads data across disks for speed, redundancy or both. It isn't a backup.
- RAT
- Remote Access Trojan
- Malware that gives an attacker hidden remote control of a machine.
- RBAC
- Role-Based Access Control
- Permissions are given to roles, and people get access through their role.
- RCA
- Root Cause Analysis
- Finding the underlying reason an incident happened so it doesn't happen again.
- RCS
- Rich Communication Services
- The richer successor to SMS texting, and another channel for phishing lures.
- RDP
- Remote Desktop Protocol
- Microsoft's remote desktop protocol on port 3389; a frequent target when exposed to the internet.
- RF
- Radio Frequency
- Wireless signals such as Wi-Fi, Bluetooth and NFC, which can be sniffed, spoofed or jammed.
- RFC
- Request for Comments
- The document series that defines internet protocols and practices.
- RFI
- Request for Information
- Gathers facts about what vendors can offer.
- RFP
- Request for Proposal
- Asks vendors for a full proposed solution and approach.
- RFQ
- Request for Quotation
- Asks vendors to price a clearly defined product or service.
- RPO
- Recovery Point Objective
- How much data, measured in time, you can afford to lose.
- RPS
- Redundant Power Supply
- A second power supply that keeps a device running if the first one fails.
- RSA
- Rivest–Shamir–Adleman
- An asymmetric algorithm used for digital signatures and protecting keys.
- RTF
- Rich Text Format
- A document format abused to deliver exploits inside attachments.
- RTO
- Recovery Time Objective
- How quickly a service must be back after a disruption.
S
- SaaS
- Software as a Service
- Ready-made apps run by the provider; you still own users, data and settings.
- SAML
- Security Assertion Markup Language
- An XML standard that carries sign-in assertions from an identity provider to an application.
- SASE
- Secure Access Service Edge
- SSE combined with SD-WAN networking as one cloud service.
- SCAP
- Security Content Automation Protocol
- Standards for automated configuration and vulnerability checks against a baseline.
- SD-WAN
- Software-Defined Wide Area Network
- Software that steers traffic between sites across several kinds of link.
- SELinux
- Security-Enhanced Linux
- A Linux kernel feature that enforces mandatory access control policies.
- SFP
- Small Form-factor Pluggable
- A hot-swappable network transceiver module for fiber or copper.
- SFTP
- SSH File Transfer Protocol
- File transfer inside an SSH connection, on port 22.
- SHA
- Secure Hash Algorithm
- A family of hash functions: SHA-2 and SHA-3 are current, SHA-1 is deprecated.
- SIEM
- Security Information and Event Management
- Collects logs in one place and correlates them to raise alerts.
- SIM
- Subscriber Identity Module
- The chip that links a phone to an account; SIM swapping lets attackers take over text-message codes.
- SIP
- Session Initiation Protocol
- Sets up voice and video calls; port 5060, or 5061 with TLS.
- SLA
- Service Level Agreement
- A contractual promise about service levels, often with penalties if missed.
- SLE
- Single Loss Expectancy
- The expected cost of one occurrence of a risk.
- SLO
- Service Level Objective
- The measurable target behind an SLA, such as 99.9% uptime.
- SMB
- Server Message Block
- Windows file and printer sharing on TCP 445; never expose it to the internet.
- S/MIME
- Secure/Multipurpose Internet Mail Extensions
- Signs and encrypts email using certificates.
- SMS
- Short Message Service
- Text messaging: the channel for smishing, and a weak way to deliver one-time codes.
- SMTP
- Simple Mail Transfer Protocol
- Sends and relays email: port 25 between servers, 587 or 465 for sending from a client.
- SNMP
- Simple Network Management Protocol
- Monitors and manages network devices on UDP 161, with traps on 162; only version 3 encrypts.
- SOAR
- Security Orchestration, Automation and Response
- Playbook-driven automation that links security tools and speeds up response.
- SOC
- Security Operations Center
- The team, and often the room, that monitors for and responds to threats.
- SOP
- Standard Operating Procedure
- Written steps for routine work; a standard change that follows an approved SOP can be pre-approved.
- SOW
- Statement of Work
- Defines the deliverables, timeline and price for one piece of work.
- SPF
- Sender Policy Framework
- A DNS record listing the servers allowed to send mail for a domain.
- SQLi
- SQL Injection
- Slipping database commands into input so the application runs them.
- SSE
- Security Service Edge
- Cloud-delivered security for users anywhere: secure web gateway, CASB and zero trust access in one service.
- SSH
- Secure Shell
- Encrypted remote command line, file copy and tunneling; port 22.
- SSO
- Single Sign-On
- Signing in once to reach many applications.
- SWG
- Secure Web Gateway
- Filters users' web traffic for policy and malware, often from the cloud.
T
- TCP
- Transmission Control Protocol
- Connection-based transport with a handshake and guaranteed, ordered delivery.
- TFTP
- Trivial File Transfer Protocol
- Bare-bones file transfer with no authentication; UDP 69.
- TLS
- Transport Layer Security
- The protocol that encrypts data in transit for HTTPS, email and many other services.
- TOCTOU
- Time-of-Check to Time-of-Use
- A race condition where something changes between being checked and being used.
- TOTP
- Time-based One-Time Password
- An authenticator-app code that changes every 30 seconds or so.
- TPM
- Trusted Platform Module
- A chip in the computer that stores keys and checks that the boot process hasn't been tampered with.
- TTP
- Tactics, Techniques and Procedures
- How an attacker operates; MITRE ATT&CK catalogs them.
U
- UDP
- User Datagram Protocol
- Connectionless transport: fast, but with no handshake or delivery guarantee.
- UEFI
- Unified Extensible Firmware Interface
- Modern startup firmware that supports Secure Boot.
- UPS
- Uninterruptible Power Supply
- A battery unit that keeps equipment running through short power cuts.
- USB
- Universal Serial Bus
- The everyday connector; a malicious USB device can pose as a keyboard and type commands.
- UTM
- Unified Threat Management
- One appliance that combines firewall, intrusion prevention, filtering and antivirus.
V
- VLAN
- Virtual Local Area Network
- Splits one physical switched network into separate logical networks.
- VM
- Virtual Machine
- A software computer on a hypervisor; VM snapshots can preserve evidence.
- VNC
- Virtual Network Computing
- Cross-platform remote desktop sharing, usually from port 5900.
- VPN
- Virtual Private Network
- An encrypted tunnel that carries traffic across an untrusted network.
W
- WAF
- Web Application Firewall
- Filters HTTP traffic to block attacks such as injection against web apps.
- WIPS
- Wireless Intrusion Prevention System
- Finds and contains rogue access points and wireless attacks.
- WPA3
- Wi-Fi Protected Access 3
- The current Wi-Fi security standard, replacing WPA2.
X
- XDR
- Extended Detection and Response
- Detection and response that correlates endpoint, network, email and cloud data together.
- XSS
- Cross-Site Scripting
- Injecting script into a web page so it runs in other visitors' browsers.
Z
- ZTNA
- Zero Trust Network Access
- Grants access to one application at a time after checking user and device, instead of the whole network.
No acronyms match. Try fewer letters, or clear the filters.
“New in SY0-801” marks acronyms that appear on CompTIA’s SY0-801 list but not on its SY0-701 list. “SY0-701 term” marks terms the SY0-801 objectives no longer name; they still matter if you’re taking SY0-701.
New in SY0-801
34 acronyms the SY0-701 list didn’t have
The SY0-801 list is much shorter, but it adds AI, cloud, identity and procurement terms. A few, like OAuth, were there before under a different spelling. Select one to read it in the glossary.
- AML/CTF
- BEC
- BIMI
- CAB
- CI/CD
- CSPM
- CWE
- EOI
- GBIC
- gMSA
- HR
- IPFIX
- LLM
- LMS
- NIC
- NVD
- OAuth
- OTP
- PIR
- QR
- RCS
- RF
- RFC
- RFI
- RFP
- RFQ
- RPS
- RTF
- SELinux
- SFP
- SOP
- SSE
- VNC
Most of these tie to new SY0-801 topics. Read what changed in SY0-801 or work through the objectives checklist.
Study tip
How to learn Security+ acronyms so they stick
Knowing what a term does matters more than reciting its letters. Scenario questions describe a situation and ask which control, protocol or attack fits it.
- Expand it
Say the full name once, then put the letters away. “BIMI” only helps if you know it’s about brand logos on authenticated mail.
- Place it
Learn it next to its neighbors: SPF, DKIM, DMARC and BIMI together; RTO next to RPO; IDS next to IPS.
- Test it
Use spaced repetition. Our acronym flashcards bring back the ones you miss sooner.
FAQ
Security+ acronyms, answered
How many acronyms are on the Security+ exam?
CompTIA’s SY0-801 acronym list has 106 entries, down from about 320 on the SY0-701 list. CompTIA prints the list at the end of the exam objectives document. This glossary covers 180 terms because you’ll meet more acronyms while studying than the exam’s list names.
Is this the official Security+ acronym list?
No. This is our own glossary, written in our own words. CompTIA publishes the official list inside its SY0-801 exam objectives PDF, so check that for the definitive list.
Do I need to memorize every Security+ acronym?
You need to know what each one does, not just its letters. Nine of the 27 SY0-801 objectives are scenario-based, so you’ll often apply a term rather than name it. Knowing that DMARC tells receivers what to do with mail that fails SPF or DKIM is worth more than reciting the expansion.
Which Security+ acronyms are new in SY0-801?
By our comparison, 34 acronyms are on the SY0-801 list but not SY0-701’s, including LLM, SSE, BIMI, CSPM, IPFIX, gMSA, BEC and PIR. Turn on “Only acronyms new in SY0-801” in the glossary to see them all with explanations.
What’s the best way to learn Security+ acronyms?
Learn them in context, a topic at a time, and say in one sentence what each is for. Then test yourself with spaced repetition. Our free Security+ flashcards include an acronym deck built from this list.
See the acronyms in real questions
Mock Test 1 is a free, full-length SY0-801 practice exam. Every option is explained, so each acronym comes with a reason.
