C
CAIQ - Consensus Assessments Initiative Questionnaire (questionaire developed by the Cloud Security Alliance (CSA) to assess the information protection controls specific to cloud service providers and third parties that host data centers)
CAP - Corrective Action Plan (plan to correct identified risk issues involving a timeframe and details of implementation steps to bring into compliance)
CAT - computerized axial tomography (technology which creates x-ray photographs of a selected plane of the body)
CBAC - context-based access control (system access controls based on a user's past history of use and whether current use fits the pattern of past use)
CBK - common body of knowledge (information known or understood by those within a specialized field or industry)
CBPR - Cross-Border Privacy Rules (data privacy framework established by the Asia-Pacific Economic Cooperation (APEC) to protect privacy by establishing standards for the movement of data/information among APEC economies)
CC - Common Criteria (standards, as used in the healthcare area, to evaluate hardware and software tools for effectiveness in terms of security and protection)
CCB - Configuration Control Board (committee within an organization responsible for approving or implementing proposed changes to system networks)
CCD - Continuity of Care Document (format of Continuity of Care Record (the record of patient clinic visits or patient treatment history) in document mark-up structure)
C-CDA - Consolidated - Clinical Document Architecture (standard used to measure system interconnection involving Electronic Health Information (EHI))
CCPA - California Consumer Privacy Act of 2018 (California law governing privacy rights and consumer protection for California residents)
CCR - Continuity of Care Record (record of patient clinic visits or patient treatment history)
CCRA - Common Criteria Recognition Arrangement (agreement among countries to honor Common Criteria product evaluations)
CDA - Clinical Document Architecture (interconnection standard dealing with the exchange, integration, sharing, and retrieval of Electronic Health Information (EHI))
CDC - Centers for Disease Control and Prevention (federal agency responsible for tracking disease outbreaks, overseeing medical research, and providing guidelines/guidance for health safety procedures)
CDO - Chief Data Officer (senior executive within an organization who can support information security and privacy programs through responsibility for the use and governance of data across the organization - oversees a range of data-related functions that may include data management, ensuring data quality, and creating data strategy)
CDT - Current Dental Terminology (coding system developed by the American Dental Association codifying dental procedures and services)
CE - Covered Entity (an organization that directly handles Protected Health Information (PHI), including providers, payers, and healthcare clearinghouses - organizations that transmit any health information in electronic form in connection with a Health Insurance Portability and Accountability Act (HIPAA) transaction)
CFDA - Catalog of Federal Domestic Assistance (listing of federal assistance/grants to non-profit or state domestic programs)
CFPB - Consumer Financial Protection Bureau (independent agency established by the Dodd-Frank Act in 2010 responsible for consumer protection in the financial services/banking sector)
CIA - U.S. Central Intelligence Agency (U.S. spy agency dealing with the collection and analysis of information related to foreign governments and threats to the U.S.)
CIA Triad - confidentiality, integrity, and availability (ideas considered the three main tenets, or foundations, of information systems security)
CICA - Canadian Institute of Chartered Accountants (Canada's main professional accounting organization for accounting and external auditing)
CIO - Chief Information Officer (senior leadership position within an organization responsible for ensuring information technology and data processing initiatives align with the organization's mission or goals - principally responsible for much of the technology, interconnection, and data protection risks)
CIS - Center for Internet Security (nonprofit organization founded in 2000 dedicated to preventing and mitigating cyber threats, developing best practices for securing information technology (IT) systems and data, and providing standards)
CIS - Computer Information System (term used to describe the active functioning or data processing aspects of a computer system which allow the user to view, edit, add to, and process information, including stored data, data being used, and data being transferred)
CISA - Certified Information Systems Auditor (certification offered by the Information Systems Audit and Control Association (ISACA) in Information Systems Auditing)
CISA - Cybersecurity Information Sharing Act of 2015 (U.S. federal law authorizing cybersecurity information sharing between and among the private sector, state, local, and territorial governments, and the federal government)
CISA Act - Cybersecurity and Infrastructure Security Agency Act of 2018 (2018 federal law amending the Homeland Security Act of 2002 to redesignate the Department of Homeland Security's (DHS) National Protection and Programs Directorate as the Cybersecurity and Infrastructure Security Agency (CISA))
CISA - Cybersecurity and Infrastructure Security Agency (federal agency within the Department of Homeland Security (DHS) with oversight and management of threats (cyber and physical) to U.S. critical infrastracture, created in 2018 by the Cybersecurity and Infrastructure Security Agency Act (CISA))
CISO - Chief Information Security Officer (individual responsible for the design, implementation, management, and review of an organization's security policies, standards, procedures, baselines, and guidelines - manager of information and information system security risks for an organization)
CLO - Chief Legal Officer (senior legal counsel within an organization)
CLOUD - Clarifying Lawful Overseas Use of Data Act of 2018 (act which authorizes U.S. law enforcement agencies to demand and receive access, through a warrant, to data stored outside the U.S. - provides for bilateral agreements with other countries for data access)
CMS - Centers for Medicare and Medicaid Services (agency within the Department of Health and Human Services (HHS) which administers Medicare and Medicaid programs and provides guidance to the U.S. health system)
CNIL - Commission Nationale de l'informatique et des libertes (French Data Protection Authority) (French agency responsible for monitoring the security of information systems)
CNM - Certified Nurse Midwife (advanced registered nurse specialty, usually involving a Bachelor's Degree and Master of Science Degree in Nursing (MSN) and board certification in midwifery, and providing care such as birthing services for women who are not experiencing high-risk pregnancies)
COBIT - Control Objectives for Information and Related Technology (framework of IT management best practices, first issued in 1996, and maintained/updated by the Information Systems Audit and Control Association (ISACA))
COOP - Continuity of Operations/Continuity of Operations Plan (plan or planning involved in recovering from disasters or disruptions, or in providing backup procedures to continue an organization's operations with minimal disruption)
COPE - corporate-owned, personally-enabled (mobile device policy model in which a business owns a user device, but allows a worker to use it for limited personal purposes)
COPPA - Children's Online Privacy Protection Act (federal law enacted in 1998 to curtail the collection of personal information from children - applies tto websites and online services operated for commercial purpose directed to children under the age of 13)
COSO - Committee of Sponsoring Organizations of the Treadway Commission (body created in 1985 to study and deal with fraudulent financial activities and reporting, and to provide recommendations for controls and improvements)
CPO - Chief Privacy Officer (individual or position within an organization responsible for compliance with privacy laws and regulations and advising on privacy-preserving technology)
CPSR - Computer Professionals for Social Responsibility (organization focusing on ethical issues and technology)
CPT - Current Procedural Terminology (medical coding listing created by the American Medical Association (AMA) which describes medical services and procedures, used by doctors and other healthcare practitioners to describe, and bill for, medical procedures)
CRAMM - Central Computing and Telecommunications Agency Risk Analysis and Management Method (risk assessment methodology tool developed in the United Kingdom (UK))
CRNA - Certified Registered Nurse Anesthetist (in the U.S., an advanced practice registered nurse who has acquired graduate-level education and board certification in anesthesia)
CRO - Contract Research Organization (organization providing support to healthcare organizations conducting specialized types of biopharmaceutical development, preclinical research, clinical trials management, and drug safety)
CSA - Cloud Security Alliance (nonprofit organization, formed in 2009, promoting best practices and providing guidelines for using cloud computer services securely)
CSA - Cybersecurity Act of 2015 (federal law promoting information sharing between the public and private sectors, across industry entities, to deal with cybersecurity threats and actions to reduce risks)
CSC - Critical Security Controls (security framework developed by the Center for Internet Security, which serves as a global standard and incorporate regulatory and compliance requirements applicable to hardware, software, applications, and emerging technologies)
C-SCRM - Cyber Supply Chain Risk Management (National Institute of Standards and Technology (NIST) framework/process for dealing with/managing third-party risk when services are outsourced as part of the Supply-Chain-Life-Cycle steps or processes involved in the delivery of services)
CSF - Common Security Framework (certification/standard of information security controls offered by the Health Information Trust (HITRUST) organization)
CSF - Cybersecurity Framework (standard/guidelines for organizational cybersecurity developed by the National Institute of Standards and Technology (NIST))
CTS - Common Terminology Services (suite of standards for sharing data across different health IT systems, while also providing a way to federate the development of common international standards as well)
CVE - Common Vulnerabilities and Exposures (database of all known cyber vulnerabilities maintained by the MITRE Corporation)
CVSS - Common Vulnerability Scoring System (open framework for vulnerability ratings to assess risk)
CYOD - choose your own device (mobile device use model for businesses, where users must purchase one of a limited set of devices, which the business is willing to support)