S
SAA - state administrative agency
SABSA - Sherwood Applied Business Security Architecture (system control framework)
SAFETY Act - Support Anti-Terrorism by Fostering Effective Technologies Act of 2002 (liability limitations for contractors/sellers of technology/technological systems)
SAFE WEB Act - Undertaking Spam, Spyware and Fraud with Enforcers Beyond Borders Act of 2006
SAMATE - Software Assurance Metrics and Tools Evaluation (NIST - automated technologies research and development)
SAR - security assessment report (FISMA/NIST Risk Management Framework)
SAR - suspicious activity report (banking - criminal activity/money laundering)
Sarbox - Sarbanes-Oxley Act of 2002 (protection of investors from financial fraud)
SARS - Severe Acute Respiratory Syndrome (health/disease control/National Centers for Disease Control)
SAS - Statement on Auditing Standards (audit)
SCA - security control assessment (FISMA/NIST Risk Management Framework)
SCAP - Security Content Automation Protocol (FISMA/NIST - automated monitoring/standardization/structured development)
SCHIP - State Children's Health Insurance Program (Social Security Act)
SDLC - software development life cycle (FISMA/NIST Risk Management Framework)
SDLC - system development life cycle (FISMA/NIST Risk Management Framework)
SDN - specially designated nationals (Office of Foreign Assets Control (OFAC) designated individuals - prohibited dealing/contact)
SEC - Securities and Exchange Commission (federal agency with oversight of securities trading/stock markets)
SEVIS - Student and Exchange Visitor Information System (electronic reporting by school officials under the Border Security Act)
SHSGP - State Homeland Security Grant Program (financial assistance to state governments for security programs)
SIEM - security information and event management (security - monitoring/reporting technology/system)
SLA - service level agreement (contract by Internet service providers for service availability)
SOC - security operations center (centralized unit of people, processes, and technologies organized to deal with threats and incidents)
SOC - Service Organization Controls (security controls over/monitoring of service organizations - vendors, businesses providing outsourced services to an organization - standards falling under Statements on Standards for Attestation Engagements (SSAE) 16 after 2011 - replaced by the term "System and Organization Controls" in 2017)
SOC - System and Organization Controls (system-level controls related to third-party organizations providing services to organizations - vendors, businesses providing outsourced services to an organization in specialized areas, such as claims processing, data processing - standards falling under Statements on Standards for Attestation Engagements (SSAE) 18 after 2017 - replaced the earler term "Service Organization Controls")
SOCKS - name for a proxy server providing anonymous Internet services - uses TOR (the Onion Router)
SOLAS - Safety of Life at Sea (convention for security in international shipping)
SORN - system of records notice (federal agency public notice requirements under the Privacy Act)
SOX - Sarbanes-Oxley Act of 2002 (protection of investors from financial fraud) (official name - Public Company Accounting Reform and Investor Protecrtion Act)
SP - Special Publication (NIST guidelines for federal agency computer security)
SPD - sensitive personal data
SSA - Social Security Administration (federal agency administering retirement benefits)
SSAE - Statement of Standards for Attestation Engagements (audit)
SSN - Social Security Number
SSP - system security plan (FISMA/NIST element of guidelines for federal agency information systems security)
STIG - security technical implementation guide (federal agency system configuration management)