S
SaaS - Software-as-a-Service (cloud-based software solution in which an organization uses software provided by the cloud provider instead of software installed on its network)
SABSA - Sherwood Applied Business Security Architecture (framework providing guidance and standards related to the physical environment in which a computing network resides as well as the physical architecture of the computing environment, such as a data center or storage facility)
SCHIP - State Children's Health Insurance Program (program designed to provide health insurance for children)
SDLC - System Development Life-Cycle (a framework describing the entire useful life of a system or software, which usually includes phases relating to requirements definition, design, development, acquisition, implementation, sustainability, and disposal)
SecDevOps - Security, Development, and Operations (software development process in which system security is planned and incorporated into development from the start, rather than after a system is completed)
SIEM - Security Incident and Event Management (a system or application which combines security information management (SIM) - the ability to digest and analyze large amounts of log data - and security event management (SEM) - the ability to consolidate and correlate large amounts of event data in order to prioritize and react to threats)
SIEM - Security Incident and Event Monitoring (system or application which tracks attempted or successful attacks or intrusions, mostly through log analysis - term implies a more passive role)
SIG - Special Interest Group (organizational category for members of an organization involved/interested in a specialized area or field of study or interest)
SIG - Standardized Information Gathering Questionnaire (a questionnaire developed by an industry consortium which provides a standardized, repeatable, and reusable assessment document related to risk)
SLA - Service-Level Agreement (a contractual agreement between an organization and a third-party provider, that details the rights and responsibilities of each party, such as the level of security, data availability, and other protections afforded the organization's data held by the third party)
SLE - Single Loss Expectancy (a dollar amount that is assigned to a single event that represents a company's potential loss amount if a specific threat were to take place - estimated loss value of an asset from a one-time occurrence or single loss)
SMTP - Simple Mail Transfer Protocol (a protocol used by many e-mail applications to send and receive e-mail)
SNOMED CT - Systematized Nomenclature of Medicine Clinical Terms (coding standard used in healthcare which is based on a comprehensive, multilingual vocabulary database repository of healthcare clinical and medical terms)
SOC - Security Operations Center (a centralized unit comprised of people, processes, and technologies working together to prevent, detect, investigate, and respond to cybersecurity threats and incidents)
SOC - Service Organization Controls (controls (or protections) related to data handling involving privacy or confidentiality by service organizations (organizations that provide outsourcing services to other organizations) - service organizations provide services such as insurance and medical claims processing - in 2017, the American Institute of Certified Public Accountants (AICPA) changed SOC from 'Service Organization Controls' to the term 'System and Organization Controls')
SOC - System and Organization Controls (security controls (or protections) involving organizations that provide outsourcing services, such as claims processing, security services, or data processing services, on a contract basis, to other organizations
until 2017, the American Institute of Certified Public Accountants (AICPA) defined SOC using the term 'Service Organization Controls' and began using the term 'System and Organization Controls' for SOC)
SOC1 - System and Organization Controls (formerly Service Organization Controls) - Type 1 Report (report on internal controls (System and Organization Controls) prepared by an independent CPA - Internal Control over Financial Reporting (ICFR) - used for entities that audit financial statements - based on the American Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements 18 (SSAE 18))
SOC2 - System and Organization Controls (formerly Service Organization Controls) - Type 2 Report (report on security controls (System and Organization Controls) prepared by an independent CPA - a SOC2 report is a more comprehensive report, since it normally involves actual testing of controls - since it provides details, it is generally not made available to the public - based on the American Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements 18 (SSAE 18))
SOC3 - System and Organization Controls (formerly Service Organization Controls) - Type 3 Report (publicly-available, summary report on security controls (System and Organization Controls) prepared by an independent CPA - a SOC3 report is generally a statement that a SOC engagement was performed, but provides few details of the tests performed - based on the American Institute of Certified Public Accountants (AICPA) Statement on Standards for Attestation Engagements 18 (SSAE 18))
SOMAP - Security Officers Management and Analysis Project (Swiss nonprofit organization providing guidance and tools involving information security and risk management)
SOP - Standard Operating Procedure (routine organizational response to an event or occurrence, which has been incorporated into general procedures)
SPI - sensitive personal information (information of a sensitive nature maintained about employees or patients)
SSAE - Statement on Standards for Attestation Engagements (American Institute of Certified Public Accountants (AICPA) standards for attestation engagements related to non-financial statement reviews - attestation engagements are reviews, studies, or investigations provided by CPAs, which look at a specific area, operation, or function within an organization and report on their findings, but are not as extensive as a full financial statement audit)
SSL - Secure Sockets Layer (a secure application layer protocol that relies on digital certificates and public/private keys to set up authentication and encryption services between two hosts)
SSO - Single Sign On (access management system which allows a single user to access more than one system or program using a single user credential)
SSO - Standard Setting Organization (accredited organization that develops standards under Health Insurance Portability and Accountability Act (HIPAA) for information transactions, data elements, and electronic information exchange)
STD - Sexually transmitted disease (disease transmitted through sexual activity, or associated with sexual activity - syphillis, HIV)
STIX - Structured Threat Information Expression (language and serialization format used to exchange cyber threat intelligence (CTI) which can serve as a source for a threat intelligence program)