IT Glossary

The EU AI Act regulates AI by risk level. Timeline after the 2026 AI Omnibus, deployer duties such as AI literacy, and why an AI inventory comes first.

Privileged identity management makes admin roles eligible instead of permanent: activated on demand, time-bound and approved. How it works and PIM vs PAM.

Dormant accounts belong to current users who no longer sign in. Why they carry security and license risk, how they differ from orphaned accounts.

An access token is the credential an OAuth 2.0 client presents to an API, with set scopes and lifetime. How it differs from ID tokens and refresh tokens.

Shelfware is paid software nobody uses: unassigned seats, inactive users, oversized plans. How to detect it and how it differs from license reclaim.

Digital sovereignty is the ability to choose, control and replace your tech stack, data and providers. How it differs from data sovereignty and residency.

Conditional access is an if-then policy engine that decides at sign-in whether to allow, require MFA or block. How it works, licensing and where it stops.

A service principal is the identity an application uses in a Microsoft Entra ID tenant. How it works and how it differs from an app registration.

An API key is a static secret that identifies the application calling an API. Why API keys outlive their creators and how they differ from access tokens.

The CLOUD Act is a US law letting US authorities require providers to disclose data they control, even if stored in the EU. What it means for SaaS buyers.

Contract sprawl is the uncontrolled growth of software contracts and renewals with no single owner. How it happens, what it costs and how to contain it.

An IAM policy sets who may get which access, who approves it, when it is reviewed and removed. What it contains and how it differs from an AWS policy.

The A2A protocol lets AI agents from different vendors discover each other and delegate tasks. How Agent Cards work, A2A vs MCP, and what to govern.

Access management decides who can sign in to which application and what they can do inside it. How it works, where it stops and how it differs from IAM.

Workload identity lets an application prove what it is without a stored secret. Learn how it works and why it is replacing service account keys.

Secrets management stores, rotates, and audits the credentials machines use. Learn how a vault works and why the secrets you know about are the easy ones.

DORA sets digital operational resilience rules for EU financial entities. Learn what it requires on ICT risk, incidents, and third-party providers.

A service account is a non-human account used by an application or script. Learn what makes it risky and why ownerless accounts cannot be revoked.

Identity threat detection and response watches for attacks against identity itself. Learn what ITDR detects and why SaaS sits in its blind spot.

A cloud access security broker enforces policy between users and cloud apps. Learn the four pillars, the deployment modes, and how CASB differs from SSPM.

PCI DSS protects payment card data across everyone who handles it. Learn what version 4.0 requires on access, including the six-month review rule.

ISO 27001 is the international standard for information security management. Learn which Annex A controls cover access and why audits fail on evidence.

The GDPR governs how personal data is processed in the EU. Learn what Articles 5, 30, and 32 really require on access control and shadow IT.

HIPAA sets US rules for protecting health information. Learn what the Security Rule requires on access, and when a European company falls under it.

SaaSOps runs the SaaS estate through automation instead of tickets. Learn what the practice covers and where it sits between IT and security.

Software license optimization right-sizes seats, tiers, and terms to cut cost. Learn the four levers and why tier mismatch beats seat reclaim.

SaaS governance sets the rules for buying, using, and retiring applications. Learn what a workable policy contains and where most policies fail.

SaaS contract management tracks terms, notice periods, and obligations per vendor. Learn what to capture and why auto-renewal is the costly clause.

SaaS spend management gives finance and IT one view of every subscription. Learn what it covers and why the invoice is the wrong starting point.

Software metering measures how software is really used, not just what is licensed. Learn how it works and why SaaS made metering harder, not easier.

SaaS security posture management monitors application configuration for risk. Learn what SSPM checks, where it stops, and how it differs from CASB.

A SaaS management platform discovers, governs, and optimizes every app a company runs. Learn what an SMP does and how it differs from an IAM tool.

FinOps brings engineering, finance, and business together to manage cloud spend. Learn the framework and why SaaS is the blind spot in most programs.

Application portfolio management inventories and scores every app a company runs. Learn how APM works and what SaaS changed about the discipline.

Identity reconciliation matches accounts across systems to the real person behind them. Learn how correlation works and why orphans hide in the gaps.

A self-service access request lets employees ask for access through a workflow. Learn how to design one that speeds work up without adding sprawl.

Access attestation is a named person formally confirming an entitlement is correct. Learn who signs, what it proves, and how it differs from a review.

IT offboarding removes every access a departing employee holds. Learn what the checklist misses and why the SaaS estate is always the hard part.

Access recertification is the recurring re-approval of existing entitlements. Learn how it differs from certification and what the revocation rate reveals.

Birthright access is the permission set every employee gets automatically. Learn how to define the baseline and why defaults are almost never reviewed.

Directory synchronization keeps identity data consistent between directories. Learn how it works and why it is not the same thing as provisioning.

Delegated administration gives limited admin rights to teams closest to a tool. Learn how to scope it and why unscoped delegation spreads risk.

HRIS integration makes the HR system the trigger for IT access. Learn how it works and why contractors stay invisible to every automation built on it.

Employee onboarding takes a new hire from contract to productive. Learn what the IT half involves and why day-one access still slips so often.

Just-enough-access limits every account to the exact permissions its task needs. Learn how JEA works and why it only pays off paired with JIT access.

Break glass access is the emergency account used when normal login fails. Learn how to design it, protect it, and keep it out of your audit findings.

Access governance is the discipline of proving who has access to what and why. Learn what it covers and how it differs from access management.

Privilege creep is the slow build-up of access rights as employees change roles. Learn why internal movers are the blind spot and how to reverse it.

Fine-grained access control decides permissions at record and field level. Learn how it works, what it costs to run, and when coarse control is enough.

Just-in-time access grants elevated rights only when needed, then revokes them. Learn how JIT access works and how it differs from JIT provisioning.

Privilege escalation turns limited access into control. Learn the vertical and horizontal types, and the SaaS path most mid-market teams miss.

Mandatory access control (MAC) enforces access through central classification labels. Learn how it works and how it differs from DAC and ABAC.

Discretionary access control (DAC) lets the resource owner decide who gets in. Learn how DAC works and why your SaaS stack runs on it by default.

An access control list (ACL) defines who can reach a resource and what they can do with it. Learn how ACLs work and why they stop scaling in SaaS.

Adaptive authentication adjusts login requirements to real-time risk signals. Learn which signals matter, how it works, and where it has no visibility.

A directory service is the central store of identities and groups in an IT estate. Learn how it works and why it is not SaaS access governance.

Biometric authentication verifies identity with a fingerprint or face. Learn how it works, what GDPR Article 9 requires, and where the data lives.

RADIUS authenticates users to Wi-Fi, VPN, and network gear. Learn how the protocol works, why it persists, and the offboarding gap it creates.

WebAuthn is the W3C browser API behind passkeys and FIDO2 logins. Learn how it works, how it differs from FIDO2, and what it covers in a SaaS stack.

FIDO2 is the open standard behind passkeys and security keys. Learn how it blocks phishing, what WebAuthn and CTAP do, and where to deploy it first.

TOTP is the six-digit code produced by authenticator apps. Learn how the algorithm works, what it protects against, and where phishing defeats it.

A JSON Web Token (JWT) is a signed token carrying identity claims between systems. Learn its structure, its role in SSO, and its offboarding risk.

Microsoft Entra ID, formerly Azure AD, is Microsoft's cloud identity service. Learn how it works and where SaaS access still escapes its policies.

Active Directory is Microsoft's on-premises directory service for Windows identities. Learn how AD works and where it stops covering your SaaS apps.

AI agent governance applies access controls and oversight to autonomous AI agents. Learn what it covers, why it matters, and how it extends IAM.

A machine identity authenticates non-human entities like servers and services. Learn how they work, how they differ from NHIs, and why governance matters.

A non-human identity (NHI) is a digital identity for a machine, service, or AI agent. Learn what NHIs are, why they grow, and why they need governance.

An orphaned account is an active account with no owner. Learn why orphaned accounts are a security risk and how clean deprovisioning eliminates them.

An audit trail is a chronological record of who did what, when. Learn how audit trails work, what they record in IAM, and why compliance needs them.

Data sovereignty means data is governed by the laws of where it is stored. Learn how it differs from data residency and why it shapes vendor choice.

EU data residency means storing and processing data inside the EU. Learn what it is, how it supports GDPR, and why European buyers require it.

A Software Bill of Materials (SBOM) is an inventory of all components in software. Learn what an SBOM contains, why it matters for supply-chain security.

SOC 2 is a framework for managing customer data on five trust principles. Learn how SOC 2 works, SOC 2 vs ISO 27001, and what a report proves.

The NIS2 Directive strengthens EU cybersecurity rules for essential and important entities. Learn its scope, requirements, and how to comply.

Renewal management tracks software renewals so none auto-renew unchecked. Learn how it works, why it prevents waste, and how Corma surfaces renewals early.

Vendor consolidation reduces software vendors to cut cost and complexity. Learn how it works, its benefits, and how it fits SaaS spend optimization.

Application rationalization reviews your apps to keep, consolidate, or retire them. Learn how it works, the framework, and how it tackles SaaS sprawl.

Software Asset Management (SAM) governs software across its lifecycle. Learn how SAM works, how it relates to SaaS management, and why it matters.

License reclaim recovers unused or departed-user seats. Learn how reclamation works, what triggers it, and how Corma automates it to cut spend.

Software license management tracks and optimizes software licenses across a company. Learn how it works, why it cuts cost, and how Corma automates it.

SaaS discovery finds every app in use, including shadow IT. Learn how SaaS discovery works, its data sources, and why it underpins SaaS control.

Shadow AI is the unsanctioned use of AI tools by employees. Learn the risks of shadow AI, why it differs from shadow IT, and how to bring it under control.

Shadow IT is software used without IT approval. Learn what shadow IT is, the risks it creates, and how SaaS discovery brings it under control with Corma.

SaaS sprawl is the uncontrolled growth of SaaS apps across a company. Learn its causes, risks, and how to regain control with SaaS discovery and Corma.

Entitlement management governs the fine-grained permissions users hold in apps. Learn how it works, how entitlements relate to roles, and why it matters.

Access certification is the documented sign-off proving access was reviewed. Learn how it works, how it differs from reviews, and why auditors need it.

An access review checks that user access is still appropriate. Learn how access reviews work, review vs certification, and how Corma automates them.

Identity lifecycle management governs access from onboarding to offboarding. Learn its stages, how it links to JML, and how Corma automates it.

The Joiner-Mover-Leaver (JML) process manages access across the employee lifecycle. Learn how JML works, its three stages, and how Corma automates it.

Just-in-time (JIT) provisioning creates accounts the moment access is needed. Learn how JIT works, JIT vs standing access, and how it supports Zero Trust.

Deprovisioning removes user access when people leave or change roles. Learn the risks of poor deprovisioning, best practices, and how Corma automates it.

User provisioning creates and manages accounts and access across apps. Learn how provisioning works, manual vs SCIM vs JIT, and how Corma automates it.

Federated identity lets one identity access systems across domains. Learn how identity federation works, federation vs SSO, and where it fits in IAM.

An identity provider (IdP) authenticates users and issues trusted tokens to apps. Learn how an IdP works, IdP vs SP, and how Corma governs IdP access.

Separation of Duties (SoD) splits critical tasks across people to prevent fraud. Learn how SoD works, common conflicts, and how Corma detects them.

Zero Trust is a security model built on "never trust, always verify." Learn its core principles, how it works, and how access control fits in.

The principle of least privilege grants only the minimum access needed. Learn how least privilege works, why it matters, and how Corma enforces it.

Policy-Based Access Control (PBAC) governs access through central policies that blend roles and attributes. Learn how PBAC works and compares to RBAC.

Attribute-Based Access Control (ABAC) grants access using attributes and context. Learn how ABAC works, ABAC vs RBAC, and when to use each model.

Role-Based Access Control (RBAC) grants permissions by role, not per user. Learn how RBAC works, RBAC vs ABAC, and how it supports least privilege.