Scarlet Risk logoSCARLET RISK

Glossary

Risk & compliance, defined.

Plain-English definitions of the terms SMBs actually run into — across compliance, cyber, financial crime, and world watch.

A

AMLAnti-Money Laundering — controls to detect and prevent illicit financial flows.Attack SurfaceThe set of external-facing systems, services, and data an attacker could target.AttestationA formal opinion by a licensed CPA on management's assertion about a set of controls.

C

CMMCThe DoD's Cybersecurity Maturity Model Certification, mandatory across the defense supply chain.Continuous MonitoringOngoing assessment of controls, vulnerabilities, and risk posture — not annual point-in-time.Counterparty RiskThe risk that the other party to a financial transaction fails to meet their obligation.CUIControlled Unclassified Information — unclassified but protected government data.

G

Geopolitical RiskThe exposure of a business to political, military, or regulatory events across borders.

H

HIPAAUS law protecting Protected Health Information (PHI) held by covered entities and business associates.

I

Incident ResponseThe structured process for detecting, containing, and recovering from a security incident.ISO 27001International standard for an Information Security Management System (ISMS).

K

KYCKnow Your Customer — verifying the identity of counterparties, users, and beneficial owners.

M

MFAMulti-Factor Authentication — proving identity with more than a password.

N

NIST 800-171The 110-control baseline for protecting Controlled Unclassified Information (CUI).

O

OFACUS Office of Foreign Assets Control — the agency behind US economic sanctions programs.

P

PCI-DSSThe Payment Card Industry Data Security Standard for handling cardholder data.POA&MPlan of Action & Milestones — the roadmap for closing security control gaps.

R

RansomwareMalware that encrypts data and demands payment for decryption — often with data-theft extortion.Risk IntelligenceCurated, prioritized signal about risks that matter to a specific business.

S

Sanctions ScreeningScreening customers, vendors, and beneficial owners against OFAC, EU, UK, and UN lists.SOC 2AICPA attestation report covering how a service organization handles customer data.SPRSThe DoD's Supplier Performance Risk System — where your NIST 800-171 score lives.

T

Threat IntelligenceEvidence-based knowledge about existing or emerging cyber threats.TPRMThird-Party Risk Management — the discipline of assessing and monitoring your vendors.

V

Vendor RiskThe risk your third-party vendors introduce into your operations, data, and compliance posture.

Z

Zero TrustA security model that never implicitly trusts a network, user, or device.

Definitions with business context

A term becomes useful when you connect it to a decision. Compliance entries explain the difference between standards, attestations, and legal obligations. Cyber entries cover safeguards and response practices. Vendor, financial, and world-watch concepts help trace an external event to a business dependency.

Each entry includes practical review guidance and evidence limits. Use those distinctions when reading a customer questionnaire or a supplier report: a self-attested claim, an independent opinion, and a confirmed account finding are different forms of information.

Check scope before drawing a conclusion

A definition does not establish which requirements apply to your organization. The relevant relationship, information, contract, standard revision, and system boundary matter. Use the official references linked from entries to investigate a specific requirement, and involve qualified specialists for formal assessment or legal decisions.

Related terms help explain neighboring concepts without treating them as equivalents. Knowing what a label means is the starting point; documenting the evidence and deciding what to do next is the operational work.