This glossary defines operational, technical, procurement, regulatory, security, and performance acronyms used across the Nonprofit & Public Sector landscape. It helps executives, officials, vendors, and advisers navigate terminology central to the GovTech Practice, from digital identity and interoperability to cloud services, accessibility, open data, and technology acquisition.
A B C D E F G H I L M N O P Q R S T U V W Z
| A | |
| A11Y | Accessibility: A numeronym used for designing digital services that people with disabilities can perceive, understand, navigate, and operate. |
| AAL | Authentication Assurance Level: A NIST-defined measure of confidence that a person controlling an account is the legitimate subscriber, with progressively stronger requirements for authentication methods and security. |
| ACH | Automated Clearing House: A U.S. electronic payment network used by government platforms for disbursements, collections, payroll, taxes, fees, and vendor payments. |
| ACR | Accessibility Conformance Report: A vendor document, commonly based on a Voluntary Product Accessibility Template, that explains how a technology product conforms to specified accessibility standards. |
| ADA | Americans with Disabilities Act: U.S. civil-rights legislation that influences the accessibility requirements applied to public websites, mobile applications, kiosks, and other digital services. |
| ADM | Automated Decision-Making: The use of algorithms or software to make or materially support decisions, often requiring transparency, human oversight, impact assessment, and appeal mechanisms in public services. |
| AI | Artificial Intelligence: Technology that performs tasks associated with human intelligence, including prediction, classification, language processing, and decision support, with significant implications for public-service delivery and governance. |
| AIA | Algorithmic Impact Assessment: A structured evaluation of an automated system’s potential effects on rights, equity, privacy, security, and public outcomes before or during deployment. |
| AIMS | Artificial Intelligence Management System: A governance system for establishing policies, responsibilities, risk controls, monitoring, and continual improvement around organizational use of artificial intelligence. |
| AI RMF | Artificial Intelligence Risk Management Framework: A voluntary NIST framework for governing, mapping, measuring, and managing risks associated with artificial intelligence systems. |
| API | Application Programming Interface: A defined mechanism through which systems exchange data or invoke services, enabling digital platforms, registries, portals, and agency applications to interoperate. |
| ARIA | Accessible Rich Internet Applications: A W3C technical specification that adds semantic information to web interfaces so assistive technologies can interpret dynamic controls and content. |
| ATAG | Authoring Tool Accessibility Guidelines: W3C guidelines covering the accessibility of content-authoring tools and their ability to help users produce accessible digital content. |
| ATO | Authorization to Operate: A formal decision accepting the security risk of operating an information system, typically based on documented controls, testing, remediation, and continuous monitoring. |
| B | |
| B2G | Business-to-Government: Commercial activity in which companies provide products or services to public bodies, including software licensing, cloud services, systems integration, and managed operations. |
| BOD | Binding Operational Directive: A compulsory cybersecurity direction issued by the U.S. Cybersecurity and Infrastructure Security Agency to federal executive agencies, often creating technical obligations that vendors must support. |
| BPA | Blanket Purchase Agreement: A government purchasing arrangement that establishes terms for recurring orders from qualified suppliers, reducing administrative effort for repeated technology acquisitions. |
| BPM | Business Process Management: A disciplined approach to mapping, redesigning, automating, measuring, and improving workflows such as permitting, licensing, grants, inspections, and case administration. |
| BPMN | Business Process Model and Notation: A standardized graphical notation for documenting workflows, decision points, events, and system interactions during service redesign and automation. |
| C | |
| C5 | Cloud Computing Compliance Criteria Catalogue: A security control catalogue published by Germany’s Federal Office for Information Security and used to assess cloud services offered to public and regulated organizations. |
| CAGE | Commercial and Government Entity: A unique identifier assigned to organizations doing business with the U.S. government and used in supplier registration, contracting, logistics, and security processes. |
| CAIQ | Consensus Assessments Initiative Questionnaire: A Cloud Security Alliance questionnaire used by buyers to evaluate a cloud provider’s security controls, transparency, and control responsibilities. |
| CCM | Cloud Controls Matrix: A Cloud Security Alliance control framework that maps cloud security requirements across domains and supports supplier assessment, assurance, and shared-responsibility analysis. |
| CISA | Cybersecurity and Infrastructure Security Agency: The U.S. federal authority responsible for civilian government cybersecurity guidance, vulnerability directives, shared services, and critical-infrastructure risk reduction. |
| CLIN | Contract Line Item Number: A numbered element of a U.S. government contract that identifies a separately priced deliverable, service, period, or funding component. |
| CMDB | Configuration Management Database: A repository that records technology assets, configurations, dependencies, and service relationships to support operations, change control, incident response, and modernization planning. |
| COBIT | Control Objectives for Information and Related Technologies: An ISACA framework for governing and managing enterprise technology, often used to clarify decision rights, controls, assurance, and performance responsibilities. |
| COTS | Commercial Off-the-Shelf: Commercially available technology purchased with limited customization, often evaluated against bespoke development for cost, implementation speed, configurability, support, and vendor-lock-in risk. |
| CPARS | Contractor Performance Assessment Reporting System: The U.S. federal system for documenting supplier performance, which can influence source selection and future contracting opportunities. |
| CPV | Common Procurement Vocabulary: The European Union’s standardized classification system for describing public-contract subject matter and helping suppliers identify relevant tender opportunities. |
| CRM | Citizen Relationship Management: A platform for managing service requests, contacts, notifications, complaints, and interactions between residents and public bodies. |
| CRM | Constituent Relationship Management: A system used by public officials and institutions to manage constituent inquiries, correspondence, cases, outreach, and engagement histories. |
| CSA | Cloud Security Alliance: An industry organization that publishes widely used cloud security controls, assessment questionnaires, guidance, and assurance programs. |
| CSP | Cloud Service Provider: An organization delivering infrastructure, platforms, software, or related managed services through cloud environments under defined security and service responsibilities. |
| CVE | Common Vulnerabilities and Exposures: A standardized catalogue of publicly disclosed cybersecurity vulnerabilities used to coordinate remediation, advisories, scanning, and supplier risk management. |
| CVSS | Common Vulnerability Scoring System: A standardized method for rating vulnerability severity so agencies and suppliers can prioritize remediation according to technical risk. |
| D | |
| DCAT | Data Catalog Vocabulary: A W3C standard for describing datasets and data services, supporting interoperable government data catalogues and open-data discovery. |
| DID | Decentralized Identifier: A W3C-defined identifier designed for verifiable digital identity without dependence on a single centralized identity registry. |
| DLP | Data Loss Prevention: Policies and technologies that detect and restrict unauthorized movement, disclosure, or exfiltration of sensitive government information. |
| DMARC | Domain-based Message Authentication, Reporting, and Conformance: An email authentication policy and reporting standard that helps public bodies prevent spoofing and phishing involving official domains. |
| DNSSEC | Domain Name System Security Extensions: A set of protocols that uses digital signatures to protect domain-name responses from forgery and redirection attacks. |
| DPA | Data Processing Agreement: A contract defining how a supplier processes personal data, including permitted purposes, security measures, subprocessors, retention, breach handling, and deletion obligations. |
| DPA | Data Protection Act: Privacy legislation governing the collection and use of personal data within a particular jurisdiction, often imposing requirements on public bodies and their technology providers. |
| DPI | Digital Public Infrastructure: Shared digital capabilities such as identity, payments, data exchange, and registries that enable interoperable public and private services at scale. |
| DPIA | Data Protection Impact Assessment: A structured assessment used to identify and mitigate privacy risks before undertaking processing likely to create high risks for individuals. |
| DPO | Data Protection Officer: An independent privacy oversight role responsible for advising on compliance, monitoring controls, and engaging with data subjects and supervisory authorities. |
| DSAR | Data Subject Access Request: A request by an individual to access personal data held about them, requiring systems and suppliers to support reliable search, review, redaction, and disclosure. |
| E | |
| EA | Enterprise Architecture: A structured representation of an organization’s capabilities, processes, data, applications, and technology used to guide investment, interoperability, and modernization decisions. |
| EAA | European Accessibility Act: European Union legislation establishing accessibility requirements for specified products and services, affecting digital platforms, self-service terminals, and technology suppliers. |
| ECM | Enterprise Content Management: Technology and governance for capturing, storing, managing, retrieving, retaining, and disposing of documents and other institutional content. |
| EDR | Endpoint Detection and Response: Security technology that monitors endpoint activity to detect, investigate, contain, and remediate malicious behavior. |
| EFT | Electronic Funds Transfer: The electronic movement of money between accounts, used in digital government for benefits, refunds, grants, fees, taxes, and supplier payments. |
| eID | Electronic Identification: A digital mechanism for establishing or asserting a person’s or organization’s identity when accessing online services or signing transactions. |
| eIDAS | Electronic Identification, Authentication and Trust Services: The European Union regulatory framework for recognized electronic identification, signatures, seals, timestamps, registered delivery, and related trust services. |
| EIT | Electronic and Information Technology: A U.S. accessibility term encompassing software, websites, hardware, telecommunications, digital documents, and related technology acquired or used by federal agencies. |
| EN 301 549 | European Standard 301 549 — Accessibility Requirements for ICT Products and Services: The principal European technical standard used to specify and evaluate accessibility in public technology procurement. |
| ERMS | Electronic Records Management System: A system that manages official records according to classification, retention, access, auditability, legal-hold, and disposition requirements. |
| ERP | Enterprise Resource Planning: An integrated platform for core administrative functions such as finance, procurement, budgeting, inventory, payroll, and asset management. |
| ESB | Enterprise Service Bus: Integration middleware that routes, transforms, and coordinates messages between applications, frequently encountered in legacy government architectures. |
| ETL | Extract, Transform, Load: A data-integration process that retrieves data from source systems, converts it into a usable structure, and loads it into a target repository. |
| EUDI | European Union Digital Identity: The European framework for interoperable digital identity wallets through which users can obtain, store, and present identity data and electronic attestations. |
| F | |
| FAIR | Findable, Accessible, Interoperable, and Reusable: Data-management principles that improve discovery, controlled access, machine interoperability, and responsible reuse of public information assets. |
| FAL | Federation Assurance Level: A NIST-defined measure of protection for assertions and information exchanged between an identity provider and a relying service in federated authentication. |
| FAR | Federal Acquisition Regulation: The principal body of rules governing procurement by U.S. federal executive agencies, including competition, contracting methods, clauses, and supplier responsibilities. |
| FedRAMP | Federal Risk and Authorization Management Program: The U.S. government program that standardizes security assessment, authorization, and continuous monitoring for cloud products used by federal agencies. |
| FIDO | Fast IDentity Online: A family of open authentication standards supporting phishing-resistant, passwordless access through cryptographic credentials, security keys, or device authenticators. |
| FIPS | Federal Information Processing Standards: U.S. government standards for areas such as cryptography, identity credentials, and data processing that can be mandatory for federal technology systems. |
| FISMA | Federal Information Security Modernization Act: U.S. legislation requiring federal agencies to operate risk-based information security programs and assess systems and contractors against defined controls. |
| FOSS | Free and Open Source Software: Software whose source code may be inspected, used, modified, and redistributed under its license, offering potential benefits for transparency, reuse, and supplier independence. |
| G | |
| G2B | Government-to-Business: Digital interactions through which public bodies provide companies with services such as registration, licensing, tax filing, reporting, procurement, and regulatory submissions. |
| G2C | Government-to-Citizen: Digital delivery of public information, transactions, benefits, applications, payments, and case updates directly to residents. |
| G2G | Government-to-Government: Data exchange, shared services, and digital transactions between public bodies across departments or levels of government. |
| G-Cloud | Government Cloud: A United Kingdom procurement framework and digital marketplace route through which public bodies purchase approved cloud software, hosting, and support services. |
| GDPR | General Data Protection Regulation: European Union privacy law governing personal-data processing, data-subject rights, security, accountability, international transfers, and processor relationships. |
| GDS | Government Digital Service: The United Kingdom government organization responsible for cross-government digital standards, platforms, identity services, service design, and transformation capability. |
| GenAI | Generative Artificial Intelligence: Models that create text, code, images, audio, or other content, requiring controls for accuracy, privacy, security, intellectual property, bias, and human review. |
| GIS | Geographic Information System: Technology for managing, analyzing, and visualizing location-based data used in planning, assets, property, environment, infrastructure, and public-service delivery. |
| GOTS | Government Off-the-Shelf: Software developed by or for a government organization and made available for reuse by other public bodies, as distinct from a standard commercial product. |
| GovRAMP | Government Risk and Authorization Management Program: A U.S. cloud security assurance program that provides standardized assessment and continuous monitoring for technology used by state, local, education, and other public entities. |
| GSA | General Services Administration: The U.S. federal agency that operates major governmentwide procurement vehicles, shared technology services, supplier schedules, and acquisition platforms. |
| GWAC | Governmentwide Acquisition Contract: A U.S. federal multiple-award contract through which agencies acquire information technology products, solutions, and services. |
| H | |
| HCD | Human-Centered Design: An approach that grounds service and product design in research about users’ needs, circumstances, behaviors, accessibility requirements, and end-to-end experiences. |
| HSM | Hardware Security Module: A tamper-resistant device that securely generates, stores, and uses cryptographic keys for identity, signing, payments, encryption, and trust services. |
| I | |
| IaaS | Infrastructure as a Service: A cloud model providing virtualized computing, storage, and networking while the customer manages operating systems, applications, data, and many security controls. |
| IAL | Identity Assurance Level: A NIST-defined measure of confidence that a claimed real-world identity has been accurately resolved, validated, and verified. |
| IAM | Identity and Access Management: The policies and technologies used to establish identities, assign privileges, authenticate users, govern access, and remove permissions when no longer required. |
| ICT | Information and Communications Technology: The broad category covering computing, software, telecommunications, networks, digital content, and electronic services, frequently used in public procurement and accessibility standards. |
| IDIQ | Indefinite-Delivery, Indefinite-Quantity: A U.S. contracting structure that permits task or delivery orders when the exact quantity or timing of future technology needs is not known at award. |
| IdP | Identity Provider: A trusted service that authenticates users and supplies identity assertions to applications or relying parties in a federated environment. |
| iPaaS | Integration Platform as a Service: A cloud platform for building, deploying, and managing integrations, data flows, connectors, and application programming interfaces across diverse systems. |
| IRAP | Information Security Registered Assessors Program: An Australian government program under which qualified assessors evaluate systems and cloud services against government security requirements. |
| ISMS | Information Security Management System: A structured set of policies, processes, roles, risk treatments, and assurance activities for managing information security systematically. |
| ISO/IEC 20000-1 | International Organization for Standardization/International Electrotechnical Commission 20000-1 — Information Technology Service Management System Requirements: An international standard specifying how an organization should establish, operate, monitor, and continually improve a service management system. |
| ISO/IEC 27001 | International Organization for Standardization/International Electrotechnical Commission 27001 — Information Security Management Systems Requirements: An international certifiable standard for implementing risk-based information security governance and controls. |
| ISO/IEC 27701 | International Organization for Standardization/International Electrotechnical Commission 27701 — Privacy Information Management Systems: An international standard for establishing and improving organizational controls for managing personally identifiable information. |
| ISO/IEC 38500 | International Organization for Standardization/International Electrotechnical Commission 38500 — Governance of Information Technology for the Organization: An international standard that provides principles for accountable, effective, and responsible governance of technology use. |
| ISO/IEC 42001 | International Organization for Standardization/International Electrotechnical Commission 42001 — Artificial Intelligence Management System: An international certifiable standard for governing artificial intelligence policies, risks, objectives, controls, monitoring, and continual improvement. |
| ITIL | Information Technology Infrastructure Library: A widely used body of practices for designing, delivering, supporting, and continually improving technology-enabled services. |
| ITSM | Information Technology Service Management: The coordinated management of technology services through processes such as incident, request, problem, change, asset, configuration, and service-level management. |
| L | |
| LCNC | Low-Code/No-Code: Development platforms that use visual tools and reusable components to create applications and workflows with limited manual programming. |
| LLM | Large Language Model: A machine-learning model trained on large text collections to generate and analyze language, increasingly used for search, drafting, summarization, assistance, and casework support. |
| M | |
| MAS | Multiple Award Schedule: A U.S. General Services Administration contracting vehicle offering pre-negotiated products and services from multiple qualified suppliers. |
| mDL | Mobile Driver’s License: A digitally signed driver credential stored on a mobile device and designed for selective, verifiable presentation in person or online. |
| MDM | Master Data Management: Governance and technology for maintaining consistent, authoritative records of core entities such as people, organizations, properties, suppliers, and locations. |
| MEAT | Most Economically Advantageous Tender: A public-procurement evaluation approach that considers quality, technical merit, service, risk, sustainability, and whole-life value rather than price alone. |
| MFA | Multi-Factor Authentication: An access-control method requiring evidence from at least two authentication-factor categories, significantly reducing risks from compromised passwords. |
| MoReq | Modular Requirements for Records Systems: A European specification describing functional requirements for managing electronic records, including classification, retention, access, export, and disposal. |
| MSP | Managed Service Provider: A supplier that operates and supports defined technology functions under ongoing contractual, security, and service-level obligations. |
| N | |
| NAICS | North American Industry Classification System: A standardized classification of business activities used in U.S. government contracting, supplier analysis, eligibility rules, and market research. |
| NCSC | National Cyber Security Centre: The United Kingdom’s technical authority for cybersecurity guidance, incident support, assurance, and protection of government and critical services. |
| NIEM | National Information Exchange Model: A common vocabulary and modeling framework for designing consistent, reusable information exchanges among government systems and partners. |
| NIGP Code | National Institute of Governmental Purchasing Commodity/Services Code: A hierarchical taxonomy used by public procurement organizations to classify purchases, register suppliers, analyze spending, and distribute bid notices. |
| NIST | National Institute of Standards and Technology: The U.S. standards agency whose cybersecurity, privacy, identity, cryptography, and artificial intelligence publications are widely applied in public technology programs. |
| NIST CSF | National Institute of Standards and Technology Cybersecurity Framework: A risk-based framework organized around governing, identifying, protecting, detecting, responding to, and recovering from cybersecurity risk. |
| NIST PF | National Institute of Standards and Technology Privacy Framework: A voluntary framework for identifying and managing privacy risk across systems, products, services, and data-processing activities. |
| NIST RMF | National Institute of Standards and Technology Risk Management Framework: A structured lifecycle for categorizing systems, selecting and implementing security controls, assessing effectiveness, authorizing operation, and monitoring risk. |
| NLP | Natural Language Processing: Technology that enables computers to analyze and generate human language for uses such as virtual assistants, document classification, translation, search, and case triage. |
| O | |
| OASIS | Organization for the Advancement of Structured Information Standards: A standards consortium responsible for specifications used in government data exchange, procurement, identity, security automation, and emergency information systems. |
| OAuth | Open Authorization: A protocol framework that allows applications to obtain limited access to protected resources without receiving a user’s password. |
| OCDS | Open Contracting Data Standard: A structured data standard for publishing information across the planning, tender, award, contract, and implementation stages of public procurement. |
| OGC | Open Geospatial Consortium: An international standards organization that develops interoperable interfaces and data models for geospatial information and location-based services. |
| OIDC | OpenID Connect: An identity layer built on the Open Authorization framework that enables applications to verify users and obtain standardized profile information. |
| OSCAL | Open Security Controls Assessment Language: A NIST-developed set of machine-readable formats for representing security control catalogues, system plans, assessments, and authorization evidence. |
| OSS | Open Source Software: Software distributed under a license permitting source-code inspection, modification, and redistribution, enabling reuse and transparent technical review. |
| P | |
| PaaS | Platform as a Service: A cloud model providing managed application infrastructure, development tools, databases, and runtime environments so teams can build services without managing underlying hardware. |
| PAM | Privileged Access Management: Controls and technologies for securing, approving, recording, and monitoring high-risk administrative access to systems and data. |
| PCI DSS | Payment Card Industry Data Security Standard: A security standard applying to entities that store, process, or transmit payment-card data, including government payment portals and their service providers. |
| PDF/UA | Portable Document Format/Universal Accessibility: An international standard specifying how digital documents should be structured so assistive technologies can reliably interpret their content and reading order. |
| Peppol | Pan-European Public Procurement Online: An interoperability network and document framework used for electronic procurement, invoicing, ordering, and other standardized business transactions. |
| PIA | Privacy Impact Assessment: A documented evaluation of how a system or program collects, uses, shares, secures, retains, and disposes of personal information. |
| PII | Personally Identifiable Information: Information that directly identifies an individual or can reasonably be linked with other data to identify them, requiring appropriate privacy and security controls. |
| PIMS | Privacy Information Management System: A governance system of policies, roles, controls, and monitoring processes for managing privacy risk and personal-data responsibilities. |
| PIV | Personal Identity Verification: The U.S. federal standard for secure identity credentials used to authenticate employees and contractors to facilities and information systems. |
| PKI | Public Key Infrastructure: The policies, roles, certificates, keys, and technical services used to establish digital trust, encryption, authentication, and electronic signatures. |
| PPP | Public-Private Partnership: A long-term arrangement in which public and private parties allocate responsibilities, investment, delivery, and risk for a public asset or service, sometimes including major digital infrastructure. |
| PSI | Public Sector Information: Data and documents produced or held by public bodies, particularly in the context of open-data publication, licensing, and commercial or civic reuse. |
| PSN | Public Services Network: A United Kingdom network and assurance framework enabling public bodies to exchange information and access shared services securely. |
| PWS | Performance Work Statement: A government contract document that defines required outcomes, standards, deliverables, and measurable performance rather than prescribing detailed working methods. |
| Q | |
| QASP | Quality Assurance Surveillance Plan: A U.S. government contract-management plan specifying how officials will monitor a supplier’s performance against contractual standards and service requirements. |
| R | |
| RAG | Retrieval-Augmented Generation: An artificial intelligence architecture that retrieves relevant source material before generating a response, improving grounding and enabling use of authoritative government content. |
| RDF | Resource Description Framework: A W3C model for representing linked, machine-readable data as relationships between entities, supporting semantic interoperability and open-data integration. |
| RFI | Request for Information: A market-research document used by public buyers to understand available capabilities, suppliers, delivery approaches, pricing structures, and procurement options before solicitation. |
| RFP | Request for Proposal: A competitive solicitation inviting suppliers to propose a solution, delivery plan, technical approach, price, and evidence against defined evaluation criteria. |
| RFQ | Request for Quotation: A solicitation seeking prices and terms for clearly specified products or services, generally with less solution-design detail than a proposal request. |
| RoPA | Records of Processing Activities: Documentation of personal-data processing purposes, categories, recipients, transfers, retention, and safeguards maintained to demonstrate privacy accountability. |
| RPA | Robotic Process Automation: Software that imitates repetitive user actions across existing applications, often used to automate high-volume administrative tasks without immediately replacing legacy systems. |
| S | |
| SaaS | Software as a Service: A cloud model in which a provider hosts and operates an application accessed by customers under subscription, security, data, and service commitments. |
| SAM | System for Award Management: The U.S. federal platform for entity registration, eligibility information, exclusions, representations, and other data used in government contracting and assistance awards. |
| SAML | Security Assertion Markup Language: An OASIS standard for exchanging authentication and authorization assertions between identity providers and applications, commonly supporting single sign-on. |
| SBOM | Software Bill of Materials: A structured inventory of software components and dependencies used to identify vulnerable libraries, assess supply-chain exposure, and coordinate remediation. |
| SCC | Standard Contractual Clauses: European Commission-approved data-protection terms used as a legal mechanism for certain transfers of personal data outside the European Economic Area. |
| SCIM | System for Cross-domain Identity Management: An open standard for automating user-account and group provisioning between identity systems and cloud applications. |
| SDLC | Software Development Life Cycle: The controlled progression through planning, requirements, design, development, testing, deployment, operation, maintenance, and retirement of software. |
| SI | Systems Integrator: A supplier that combines software, infrastructure, data, and services into an operational solution spanning multiple platforms or vendors. |
| SIAM | Service Integration and Management: A governance model for coordinating multiple internal and external service providers so they operate as an integrated end-to-end technology service. |
| SIEM | Security Information and Event Management: Technology that centralizes logs and security events for correlation, alerting, investigation, compliance reporting, and incident response. |
| SIN | Special Item Number: A category within U.S. federal schedule contracting that groups similar products and services and helps agencies identify eligible suppliers. |
| SLA | Service-Level Agreement: A contractual or operational commitment defining measurable service expectations such as availability, response time, restoration time, support coverage, and remedies. |
| SLI | Service-Level Indicator: A quantitative measure of service behavior, such as availability, latency, error rate, or processing time, used to evaluate reliability. |
| SLO | Service-Level Objective: A target value or range for a service-level indicator that guides engineering priorities and operational performance management. |
| SOA | Service-Oriented Architecture: An architectural approach that exposes reusable business functions as interoperable services, often used to connect legacy and modern government applications. |
| SOC | Security Operations Center: A centralized function that monitors security events, investigates threats, coordinates incident response, and supports continuous cyber defense. |
| SOC 2 | System and Organization Controls 2: An independent assurance report evaluating a service organization’s controls against applicable trust services criteria such as security, availability, and confidentiality. |
| SOW | Statement of Work: A contract document defining project scope, tasks, deliverables, responsibilities, schedule, acceptance criteria, and other performance requirements. |
| SPF | Sender Policy Framework: An email authentication mechanism that identifies which mail servers are authorized to send messages for an official domain. |
| SSO | Single Sign-On: An authentication capability allowing users to access multiple approved applications through one identity session, reducing password burden and centralizing access control. |
| T | |
| TBM | Technology Business Management: A management discipline for connecting technology costs, assets, services, consumption, and outcomes to support budgeting, benchmarking, and investment decisions. |
| TCO | Total Cost of Ownership: The full lifecycle cost of a technology solution, including acquisition, implementation, integration, operations, support, security, upgrades, migration, and retirement. |
| TED | Tenders Electronic Daily: The online publication for notices associated with public procurement in the European Union and European Economic Area. |
| TIA | Transfer Impact Assessment: An evaluation of privacy and legal risks associated with transferring personal data to another jurisdiction, including the effectiveness of contractual and technical safeguards. |
| TIC | Trusted Internet Connections: A U.S. federal cybersecurity program that defines architectures and capabilities for securing agency network connections, cloud traffic, and remote access. |
| TLS | Transport Layer Security: A cryptographic protocol that protects data exchanged between systems by providing encryption, integrity, and endpoint authentication. |
| TOGAF | The Open Group Architecture Framework: A methodology and body of guidance for developing, governing, and maintaining enterprise architecture across business, data, application, and technology domains. |
| U | |
| UAAG | User Agent Accessibility Guidelines: W3C guidance describing how browsers, media players, and related user agents should support accessibility and interaction with assistive technologies. |
| UBL | Universal Business Language: An OASIS standard library of electronic business documents used for interoperable procurement transactions such as orders, invoices, and shipping notices. |
| UEI | Unique Entity Identifier: The identifier assigned through the U.S. federal award-management system to organizations seeking contracts, grants, loans, or other government awards. |
| USWDS | United States Web Design System: A federal design system providing accessible components, patterns, principles, and implementation guidance for consistent public digital services. |
| UX | User Experience: The overall quality and accessibility of a person’s interaction with a digital service, including usability, clarity, trust, effort, and successful task completion. |
| V | |
| VC | Verifiable Credential: A cryptographically secured digital credential whose issuer and integrity can be verified while allowing the holder to present relevant claims to a relying service. |
| VPAT | Voluntary Product Accessibility Template: A standard template vendors use to document how a technology product supports accessibility requirements and to produce an accessibility conformance report. |
| W | |
| W3C | World Wide Web Consortium: The international organization that develops web standards covering accessibility, data, identity, privacy, and interoperable digital services. |
| WAI | Web Accessibility Initiative: The World Wide Web Consortium program that develops accessibility guidelines, technical specifications, educational materials, and evaluation resources. |
| WCAG | Web Content Accessibility Guidelines: Internationally recognized guidelines for making web content perceivable, operable, understandable, and robust for people with disabilities. |
| WFS | Web Feature Service: An Open Geospatial Consortium standard for querying and exchanging vector-based geographic features over the web. |
| WMS | Web Map Service: An Open Geospatial Consortium standard for delivering georeferenced map images from distributed geographic data sources. |
| WORM | Write Once, Read Many: A storage method that prevents records from being altered or deleted after writing, supporting retention, evidentiary integrity, and audit requirements. |
| Z | |
| ZTA | Zero Trust Architecture: A security model that grants access based on continuous verification of identity, device, context, and policy rather than implicit trust based on network location. |
| ZTNA | Zero Trust Network Access: Technology that provides identity- and policy-based access to specific applications or resources without exposing an entire internal network. |