Learn · Security+

Security+ acronym list

Security+ uses a lot of acronyms. Here are the common ones in plain language, grouped by the domain where they come up most. Use your browser’s find (Ctrl/Cmd+F) to jump to one. CompTIA publishes its full official acronym list with the exam objectives.

Domain 1: General Security Concepts

Acronym	Stands for	What it means
AAA	Authentication, Authorization, and Accounting	Verify identity, grant permissions, and log actions.
CIA	Confidentiality, Integrity, Availability	Core goals of information security.
MFA	Multifactor Authentication	Requires at least two distinct authentication factor categories.
SSO	Single Sign-On	One login provides access to multiple connected services.
PKI	Public Key Infrastructure	System of certificates, keys, and trust authorities.
CA	Certificate Authority	Issues and signs trusted digital certificates.
CSR	Certificate Signing Request	Request containing certificate identity and public key information.
CRL	Certificate Revocation List	Published list of revoked certificates.
OCSP	Online Certificate Status Protocol	Queries whether a certificate has been revoked.
AES	Advanced Encryption Standard	Widely used symmetric block cipher.
RSA	Rivest–Shamir–Adleman	Public-key cryptography algorithm used for signing and encryption.
ECC	Elliptic Curve Cryptography	Public-key cryptography using elliptic-curve mathematics.
HMAC	Hash-based Message Authentication Code	Verifies message integrity and authenticity with a shared secret.
SHA	Secure Hash Algorithm	Family of cryptographic hashing functions.
TLS	Transport Layer Security	Protects communications in transit.
TPM	Trusted Platform Module	Hardware-backed security for keys and device integrity.
HSM	Hardware Security Module	Tamper-resistant device protecting cryptographic keys.
PFS	Perfect Forward Secrecy	Past sessions stay protected if a long-term key is later exposed.
PSK	Pre-Shared Key	Secret agreed upon before an authenticated exchange.
RBAC	Role-Based Access Control	Permissions assigned according to job roles.
ABAC	Attribute-Based Access Control	Access decisions based on user, resource, and context attributes.
DAC	Discretionary Access Control	Resource owner determines access permissions.
MAC	Mandatory Access Control	System-enforced access based on labels and clearances.
FDE	Full-Disk Encryption	Encrypts an entire storage drive.
PIV	Personal Identity Verification	US government smart-card credential standard for identity verification.
TOTP	Time-based One-Time Password	Temporary code derived from a secret and time.
HOTP	HMAC-based One-Time Password	Counter-based one-time authentication code.
FIDO	Fast Identity Online	Standards for phishing-resistant modern authentication.

Domain 2: Threats, Vulnerabilities, and Mitigations

Acronym	Stands for	What it means
APT	Advanced Persistent Threat	Sophisticated attacker conducting sustained, targeted activity.
CVE	Common Vulnerabilities and Exposures	Identifier assigned to a publicly disclosed vulnerability.
CVSS	Common Vulnerability Scoring System	Framework scoring vulnerability severity.
CWE	Common Weakness Enumeration	Catalog of classes of software and hardware weaknesses.
DDoS	Distributed Denial of Service	Traffic from multiple systems overwhelms a target.
DoS	Denial of Service	Attack degrades or prevents service availability.
SQLi	SQL Injection	Malicious input changes database queries.
XSS	Cross-Site Scripting	Injected script executes in a user's browser.
CSRF	Cross-Site Request Forgery	Tricks an authenticated browser into making an unwanted request.
SSRF	Server-Side Request Forgery	Makes a server issue requests chosen by an attacker.
RCE	Remote Code Execution	Ability to execute code on another system.
RAT	Remote Access Trojan	Malware allowing unauthorized remote control.
IOC	Indicator of Compromise	Observable clue suggesting malicious activity.
IOA	Indicator of Attack	Evidence of suspicious attacker behavior or technique.
MITM	Man-in-the-Middle (on-path attack)	Attacker sits between two parties to read or change traffic. CompTIA now calls this an on-path attack.
BEC	Business Email Compromise	Social-engineering fraud through trusted-looking business messages.
OSINT	Open-Source Intelligence	Information gathered from publicly available sources.
ASLR	Address Space Layout Randomization	Randomizes memory locations to impede exploitation.
DEP	Data Execution Prevention	Prevents execution in memory regions marked as data.
EDR	Endpoint Detection and Response	Endpoint telemetry, detection, investigation, and response.
AV	Antivirus	Detects and blocks known or suspicious malicious software.
NIDS	Network Intrusion Detection System	Monitors network traffic for suspicious activity.
NIPS	Network Intrusion Prevention System	Detects and actively blocks malicious network traffic.
WAF	Web Application Firewall	Filters HTTP traffic to protect web applications.
SAST	Static Application Security Testing	Analyzes source or binary code without running it.
DAST	Dynamic Application Security Testing	Tests running applications for weaknesses.
C2	Command and Control	Attacker's channel for managing compromised systems.
ATT&CK	Adversarial Tactics, Techniques, and Common Knowledge	MITRE knowledge base of observed adversary behaviors.

Domain 3: Security Architecture

Acronym	Stands for	What it means
DMZ	Demilitarized Zone (screened subnet)	Isolated network segment for internet-facing systems. Current CompTIA wording is screened subnet.
VLAN	Virtual Local Area Network	Logical segmentation of a switched network.
VPN	Virtual Private Network	Protected logical connection across another network.
IPsec	Internet Protocol Security	Protocol suite securing IP traffic.
IKE	Internet Key Exchange	Negotiates secure associations and keys for IPsec.
DNS	Domain Name System	Resolves domain names to network records.
DNSSEC	Domain Name System Security Extensions	Authenticates DNS responses with digital signatures.
DHCP	Dynamic Host Configuration Protocol	Automatically distributes IP settings to hosts.
NAT	Network Address Translation	Translates network addresses between domains.
SDN	Software-Defined Networking	Separates control and forwarding for programmable networks.
SASE	Secure Access Service Edge	Combines network connectivity with cloud-delivered security.
ZTNA	Zero Trust Network Access	Grants application access through identity-aware verification.
CASB	Cloud Access Security Broker	Enforces security policies for cloud service usage.
CSP	Cloud Service Provider	Vendor supplying cloud infrastructure or services.
IaaS	Infrastructure as a Service	Provider supplies compute, storage, and networking resources.
PaaS	Platform as a Service	Provider supplies managed application runtime and development platform.
SaaS	Software as a Service	Application delivered and operated by a provider.
VDI	Virtual Desktop Infrastructure	Desktop environments hosted centrally.
BYOD	Bring Your Own Device	Personal devices are allowed for organizational work.
COPE	Corporate Owned, Personally Enabled	Organization-owned device permitting personal use.
MDM	Mobile Device Management	Manages configuration and security of mobile devices.
MTD	Mobile Threat Defense	Detects threats on mobile endpoints.
SDLC	Software Development Life Cycle	Phases for developing and maintaining software.
CI/CD	Continuous Integration / Continuous Delivery	Automated processes to build, test, and release changes.
IaC	Infrastructure as Code	Manages infrastructure through versioned configuration code.
RTO	Recovery Time Objective	Maximum acceptable time to restore a service.
RPO	Recovery Point Objective	Maximum acceptable data loss measured in time.
UPS	Uninterruptible Power Supply	Provides short-term backup electrical power.
HVAC	Heating, Ventilation, and Air Conditioning	Controls building temperature and airflow.

Domain 4: Security Operations

Acronym	Stands for	What it means
SOC	Security Operations Center	Team or facility monitoring and responding to security events.
SIEM	Security Information and Event Management	Aggregates and correlates logs for detection and investigation.
SOAR	Security Orchestration, Automation, and Response	Coordinates and automates security-response workflows.
XDR	Extended Detection and Response	Correlates detection data across multiple security layers.
IDS	Intrusion Detection System	Alerts on suspected malicious activity.
IPS	Intrusion Prevention System	Detects and blocks prohibited traffic or behavior.
NGFW	Next-Generation Firewall	Firewall with application awareness and advanced inspection.
NAC	Network Access Control	Enforces device or user access requirements on networks.
DLP	Data Loss Prevention	Detects and restricts unauthorized sensitive-data movement.
IAM	Identity and Access Management	Manages identities, authentication, and access rights.
PAM	Privileged Access Management	Controls, monitors, and secures privileged accounts.
LDAP	Lightweight Directory Access Protocol	Queries and manages directory information.
SAML	Security Assertion Markup Language	Exchanges identity assertions for federation and SSO.
OAuth	Open Authorization	Delegates limited access to resources without sharing passwords.
OIDC	OpenID Connect	Authentication layer built on OAuth 2.0.
RADIUS	Remote Authentication Dial-In User Service	Centralized authentication and accounting for network access.
TACACS+	Terminal Access Controller Access-Control System Plus	AAA protocol often used for network device administration.
SSH	Secure Shell	Encrypted remote command-line access.
RDP	Remote Desktop Protocol	Remote graphical desktop connection.
SNMP	Simple Network Management Protocol	Monitors and manages network devices.
NTP	Network Time Protocol	Synchronizes device clocks.
HTTP	Hypertext Transfer Protocol	Application protocol used for web traffic.
HTTPS	Hypertext Transfer Protocol Secure	HTTP transmitted over TLS.
SMTP	Simple Mail Transfer Protocol	Transfers outgoing email between servers.
SPF	Sender Policy Framework	DNS policy listing permitted email senders.
DKIM	DomainKeys Identified Mail	Cryptographically signs mail to validate sending domains.
DMARC	Domain-based Message Authentication, Reporting, and Conformance	Email-domain policy coordinating SPF/DKIM alignment and reporting.
CIRT	Computer Incident Response Team	Group coordinating cyber incident handling.
IR	Incident Response	Process of detecting, containing, and recovering from incidents.
DFIR	Digital Forensics and Incident Response	Investigating digital evidence and managing incidents.
PCAP	Packet Capture	Recorded network packets for troubleshooting and investigation.
FIM	File Integrity Monitoring	Detects unexpected file changes.
SCAP	Security Content Automation Protocol	Standards for automated security configuration checks.
STIX	Structured Threat Information Expression	Structured format for cyber threat intelligence.
TAXII	Trusted Automated Exchange of Intelligence Information	Protocol for exchanging cyber threat intelligence.

Domain 5: Security Program Management and Oversight

Acronym	Stands for	What it means
GRC	Governance, Risk, and Compliance	Framework aligning security oversight, risks, and obligations.
BIA	Business Impact Analysis	Identifies critical operations and impacts of disruption.
BCP	Business Continuity Plan	Maintains essential operations during disruptions.
DRP	Disaster Recovery Plan	Restores systems and services after disruption.
COOP	Continuity of Operations Plan	Maintains mission-essential functions during emergencies.
SLE	Single Loss Expectancy	Expected cost from one realized risk event.
ARO	Annualized Rate of Occurrence	Expected frequency of a risk event per year.
ALE	Annualized Loss Expectancy	Estimated annual loss: SLE multiplied by ARO.
MTTR	Mean Time to Repair	Average time required to repair a failed component.
MTBF	Mean Time Between Failures	Average operating time between repairable failures.
MTTF	Mean Time to Failure	Expected time until a nonrepairable item fails.
NDA	Non-Disclosure Agreement	Contract requiring confidentiality.
SLA	Service Level Agreement	Defines expected service performance and obligations.
MOU	Memorandum of Understanding	Documents shared intentions between parties.
MOA	Memorandum of Agreement	Documents agreed responsibilities between parties.
AUP	Acceptable Use Policy	Defines permitted use of systems and networks.
PII	Personally Identifiable Information	Data that identifies or can identify an individual.
PHI	Protected Health Information	Sensitive health information protected by applicable rules.
GDPR	General Data Protection Regulation	European Union personal-data protection law.
PCI DSS	Payment Card Industry Data Security Standard	Industry security requirements for cardholder data.
HIPAA	Health Insurance Portability and Accountability Act	US law establishing requirements for protected health information.
DPO	Data Protection Officer	Person overseeing organizational data-protection obligations.
RACI	Responsible, Accountable, Consulted, Informed	Matrix assigning roles for a task or decision.
KPI	Key Performance Indicator	Metric tracking performance against an objective.
KRI	Key Risk Indicator	Metric indicating changing risk exposure.
ROI	Return on Investment	Benefit compared with cost of an investment.

Official exam details, objectives and pricing: CompTIA Security+ (official page) (opens in new tab).

NeonKey isn't affiliated with or endorsed by CompTIA. Security+ is a trademark of CompTIA. No pass guarantees — check CompTIA for current exam details.

← Back to the Security+ guide