Laws/Legal Terms - S
Safety of Life at Sea (SOLAS) - (convention for security in international shipping)
Sarbanes-Oxley Act of 2002 (SOX) (SARBOX) (official name - Public Company Accounting Reform and Investor Protection Act) - (Federal law requiring officers of publicly traded companies to have accurate and audited financial statements - SOX also requires proper security controls to protect financial records and insider information - intended to provide investors with protection from financial fraud)
Securities and Exchange Commission (SEC) - (federal agency created under the Securities Exchange Act of 1934 to enforce the Securities Act of 1933, with overall responsibility for regulating the U.S. securities markets)
security assessment report (SAR) - (FISMA/NIST Risk Management Framework)
Security Content Automation Protocol (SCAP) - (FISMA/NIST - automated monitoring/standardization/structured development)
security control assessment (SCA) - (FISMA/NIST Risk Management Framework)
Security Information and Event Management (SIEM) - (Umbrella term for advanced technological systems capable of monitoring entire networks and systems on a continuing (real-time) basis, analyzing log activity data, and generating reports in real time. Began as security event management (SEM) or security threat management (STM) which largely involved "events" or specific threat analysis, correlation of data with incidents, and providing a response to immediate threats. As computer power and capabilities grew, SEM was consolidated with the security information management (SIM) function, involving expanded log searches, archiving, forensic investigations, and data mining. The latest generation of SIEM systems have expanded to "big data security analytics" to analyze large amounts of data over long periods of time, and in addition to data mining of available data, in some cases to incorporate outside intelligence data about current world-wide attacks, as well as providing automated threat response. Advanced SIEM capabilities require advanced technology, are very expensive, in terms of equipment and software, as well as a dollar commitment for full-time staffing, which makes them practical only for very large companies or organizations.)
security operations center (SOC) - (centralized unit of people, processes, and technologies organized to deal with threats and incidents)
security technical implementation guide (STIG) - (federal agency system configuration management)
sensitive personal data (SPD) -
service level agreement (SLA) - (contract by Internet service providers for service availability)
Service Organization Controls (SOC) - (security controls over/monitoring of service organizations - vendors, businesses providing outsourced services to an organization - standards falling under Statements on Standards for Attestation Engagements (SSAE) 16 after 2011 - replaced by the term "System and Organization Controls" in 2017)
Severe Acute Respiratory Syndrome (SARS) - (health/disease control/National Centers for Disease Control)
Sherwood Applied Business Security Architecture (SABSA) - (system control framework)
Social Security Administration (SSA) - (federal agency administering retirement benefits)
Social Security Number (SSN) -
SOCKS - name for a proxy server providing anonymous Internet services - uses TOR (the Onion Router)
Software Assurance Metrics and Tools Evaluation (SAMATE) - (NIST - automated technologies research and development)
software development life cycle (SDLC) - (FISMA/NIST Risk Management Framework)
Special Publication (SP) - (NIST guidelines for federal agency computer security)
specially designated nationals (SDN) - (Office of Foreign Assets Control (OFAC) designated individuals - prohibited dealing/contact)
state administrative agency (SAA) -
State Children's Health Insurance Program (SCHIP) - (Social Security Act)
State Homeland Security Grant Program (SHSGP) - (financial assistance to state governments for security programs)
Statement on Auditing Standards (SAS) - (audit)
Statement of Standards for Attestation Engagements (SSAE) - (audit)
Student and Exchange Visitor Information System (SEVIS) - (electronic reporting by school officials under the Border Security Act)
Support Anti-Terrorism by Fostering Effective Technologies Act of 2002 (SAFETY Act) - (liability limitations for contractors/sellers of technology/technological systems)
suspicious activity report (SAR) - (Banking report where criminal activity/money laundering is suspected.)
system development life cycle (SDLC) - (FISMA/NIST Risk Management Framework)
System and Organization Controls (SOC) - (system-level controls related to third-party organizations providing services to organizations - vendors, businesses providing outsourced services to an organization in specialized areas, such as claims processing, data processing - standards falling under Statements on Standards for Attestation Engagements (SSAE) 18 after 2017 - replaced the earler term "Service Organization Controls")
system of records notice (SORN) - (federal agency public notice requirements under the Privacy Act)
system security plan (SSP) - (FISMA/NIST element of guidelines for federal agency information systems security)
Undertaking Spam, Spyware and Fraud with Enforcers Beyond Borders Act of 2006 (SAFE WEB Act) -