This glossary explains key acronyms used across Technology & Telecom, with a focused lens on the Enterprise Software & SaaS Practice. It helps executives, operators, product teams, engineers, buyers, and advisers navigate subscription economics, software delivery, enterprise sales, security, compliance, integration, and customer-success terminology.
0–9 A B C D E F G H I J K L M N O P Q R S T U V W X
| 0–9 | |
| 2FA | Two-Factor Authentication: An access-control method requiring two different forms of identity verification, reducing the risk that stolen credentials alone can expose a software account. |
| A | |
| ABAC | Attribute-Based Access Control: An authorization model that evaluates user, resource, action, and environmental attributes to make granular access decisions in complex enterprise applications. |
| ABM | Account-Based Marketing: A go-to-market approach that coordinates marketing and sales activity around selected high-value organizations, buying committees, and expansion opportunities. |
| ACR | Accessibility Conformance Report: A completed accessibility assessment, commonly based on the Voluntary Product Accessibility Template, that helps enterprise buyers evaluate a product against recognized accessibility standards. |
| ACV | Annual Contract Value: The average annualized value of a customer contract, including recurring charges and, depending on company policy, selected one-time fees. It supports deal-size, segmentation, and sales-productivity analysis. |
| AES | Advanced Encryption Standard: A widely adopted symmetric encryption standard used to protect stored data, backups, credentials, and other sensitive application information. |
| AGPL | GNU Affero General Public License: A strong copyleft open-source license that can require source-code disclosure when modified software is made available to users over a network, making license review important for hosted products. |
| AI | Artificial Intelligence: Software capabilities that perform tasks associated with human intelligence, such as prediction, reasoning, content generation, classification, or decision support. |
| AICPA | American Institute of Certified Public Accountants: The professional organization responsible for the attestation framework and Trust Services Criteria used in widely requested service-organization assurance reports. |
| AI RMF | Artificial Intelligence Risk Management Framework: A National Institute of Standards and Technology framework for governing, mapping, measuring, and managing risks associated with artificial-intelligence systems. |
| ALM | Application Lifecycle Management: The coordinated management of software requirements, development, testing, release, operation, maintenance, and retirement across the product lifecycle. |
| aPaaS | Application Platform as a Service: A cloud-delivered environment for building, deploying, integrating, and managing applications without operating the full underlying infrastructure stack. |
| API | Application Programming Interface: A defined mechanism through which software components exchange data or invoke functionality. Its quality directly affects integration effort, ecosystem reach, and product extensibility. |
| APM | Application Performance Monitoring: Tools and practices that measure application latency, errors, transactions, dependencies, and resource behavior so teams can detect and diagnose performance problems. |
| APM | Application Portfolio Management: The structured evaluation of an organization’s software estate to identify cost, risk, redundancy, modernization needs, and opportunities for consolidation or retirement. |
| ARPA | Average Revenue per Account: Recurring revenue divided by the number of customer accounts for a defined period, used to track customer mix, pricing, and expansion. |
| ARPU | Average Revenue per User: Revenue divided by the relevant user population for a period, useful when pricing and adoption are closely tied to seats or active users. |
| ARR | Annual Recurring Revenue: The annualized value of recurring subscription and support revenue at a point in time. It is a central non-GAAP measure of scale and growth for subscription businesses. |
| ASC 340-40 | Accounting Standards Codification Topic 340-40, Other Assets and Deferred Costs—Contracts with Customers: U.S. accounting guidance governing capitalization and amortization of incremental contract-acquisition costs, including qualifying sales commissions. |
| ASC 606 | Accounting Standards Codification Topic 606, Revenue from Contracts with Customers: U.S. revenue-recognition guidance that determines how subscription, license, implementation, support, and other contract elements are accounted for. |
| ASP | Application Service Provider: A provider that hosts and manages business applications for customers, often describing an earlier hosted-software model that may appear in legacy products and contracts. |
| ASP | Average Selling Price: The average realized price of a product, subscription, seat, or deal over a specified period, used to assess pricing execution and customer mix. |
| AUP | Acceptable Use Policy: Contractual rules defining prohibited or restricted customer behavior on a software service, such as abuse, illegal activity, excessive load, or security violations. |
| B | |
| BAA | Business Associate Agreement: A contract required under U.S. health-privacy rules when a service provider creates, receives, maintains, or transmits protected health information for a covered entity. |
| BANT | Budget, Authority, Need, Timeline: A sales-qualification framework used to assess whether a prospect has funding, decision power, a defined business problem, and an actionable purchasing schedule. |
| BCP | Business Continuity Plan: A documented approach for sustaining critical operations during disruption, commonly reviewed by enterprise buyers as part of vendor-risk assessment. |
| BCR | Binding Corporate Rules: Internal data-protection rules approved by European regulators that permit qualifying transfers of personal data within a multinational corporate group. |
| BDR | Business Development Representative: A sales role focused primarily on prospecting, initial qualification, and creating opportunities for account executives. |
| BI | Business Intelligence: Software and methods for transforming organizational data into reports, dashboards, analyses, and decision-support insights. |
| BPA | Business Process Automation: The use of software to execute repeatable workflows, route work, enforce rules, and reduce manual effort across business processes. |
| BPM | Business Process Management: A discipline and software category focused on designing, executing, monitoring, and improving end-to-end business processes. |
| BPMN | Business Process Model and Notation: A standardized graphical notation for documenting business processes in a form understandable to business stakeholders and implementation teams. |
| BPMS | Business Process Management Suite: An integrated software platform for process modeling, workflow execution, rules, monitoring, and continuous process improvement. |
| BRD | Business Requirements Document: A document describing the business objectives, needs, scope, and expected outcomes that a software initiative or product capability must address. |
| BYOK | Bring Your Own Key: An encryption model allowing customers to supply or control keys used to protect their data within a vendor’s service. |
| BYOL | Bring Your Own License: A licensing arrangement that permits customers to apply existing software entitlements to a hosted, cloud, or partner-operated environment. |
| C | |
| CAC | Customer Acquisition Cost: Sales and marketing expenditure required to acquire new customers, calculated using a consistently defined cost base and acquisition cohort. |
| CAIQ | Consensus Assessments Initiative Questionnaire: A Cloud Security Alliance questionnaire used by customers to assess a service provider’s security controls and operating practices. |
| CAL | Client Access License: A software entitlement allowing a user or device to access server software, commonly encountered in traditional enterprise licensing models. |
| CARR | Committed Annual Recurring Revenue: The annualized recurring value contractually committed by customers, sometimes including signed amounts not yet live or recognized under a company’s defined policy. |
| CCM | Cloud Controls Matrix: A control framework from the Cloud Security Alliance used to assess security, privacy, governance, and compliance practices for cloud-delivered services. |
| CCPA | California Consumer Privacy Act: A California privacy law establishing consumer rights and obligations concerning the collection, use, disclosure, and sale or sharing of personal information. |
| CD | Continuous Delivery: A software practice that keeps code in a deployable state through automated build, test, and release processes while retaining a controlled production-release decision. |
| CD | Continuous Deployment: A software practice in which changes that pass automated checks are released to production without a separate manual deployment gate. |
| CDC | Change Data Capture: A data-integration technique that identifies and propagates database inserts, updates, and deletes so connected systems remain synchronized. |
| CES | Customer Effort Score: A survey metric measuring how easy customers find a task or interaction, such as onboarding, problem resolution, or feature use. |
| CI | Continuous Integration: A development practice in which code changes are merged frequently and validated through automated builds and tests to identify defects early. |
| CI/CD | Continuous Integration and Continuous Delivery or Deployment: An automated software pipeline that moves code from integration and testing toward controlled delivery or direct production deployment. |
| CIS | Center for Internet Security: A nonprofit organization that publishes security controls and configuration benchmarks frequently used to harden software environments and support assurance reviews. |
| CLI | Command-Line Interface: A text-based mechanism for configuring or operating software, particularly important for administrators, developers, automation, and advanced users. |
| CLM | Contract Lifecycle Management: Software for creating, negotiating, approving, signing, storing, monitoring, renewing, and analyzing commercial contracts. |
| CLV | Customer Lifetime Value: An estimate of the economic value generated by a customer over the relationship, used to guide acquisition spending, retention priorities, and segmentation. |
| CMDB | Configuration Management Database: A repository recording technology assets, services, configurations, and relationships to support service management, change control, and incident analysis. |
| CMK | Customer-Managed Key: An encryption key whose lifecycle and permissions are controlled by the customer, providing additional control over access to hosted data. |
| CMMC | Cybersecurity Maturity Model Certification: A U.S. Department of Defense program for verifying cybersecurity practices among contractors and service providers handling sensitive defense information. |
| CMRR | Committed Monthly Recurring Revenue: Monthly recurring revenue adjusted for contracted new business, expansion, contraction, and cancellations expected to take effect. |
| CMS | Content Management System: Software used to create, govern, organize, publish, and maintain digital content without requiring direct manipulation of underlying code. |
| COTS | Commercial Off-the-Shelf: Generally available software purchased or subscribed to rather than developed specifically for one customer, often configured or integrated during implementation. |
| CPQ | Configure, Price, Quote: Software that helps sellers configure valid offerings, apply pricing and discount rules, and generate accurate customer quotations. |
| CPRA | California Privacy Rights Act: Legislation that amended and expanded California privacy requirements, including consumer rights, sensitive-information rules, and regulatory enforcement. |
| CRM | Customer Relationship Management: Software for managing prospect and customer information, sales activity, service interactions, pipeline, and relationship history. |
| cRPO | Current Remaining Performance Obligations: Contracted revenue not yet recognized that is expected to be recognized within the next twelve months, often disclosed as a forward-looking revenue indicator. |
| CRUD | Create, Read, Update, Delete: The four basic operations commonly supported for persistent application data and exposed through databases or application interfaces. |
| CSA | Cloud Security Alliance: An industry organization that publishes cloud-security frameworks, assurance programs, research, and assessment tools used by providers and enterprise buyers. |
| CSA STAR | Cloud Security Alliance Security, Trust, Assurance and Risk Program: A provider-assurance program combining control-framework requirements with self-assessment, third-party certification, or attestation. |
| CSAT | Customer Satisfaction Score: A survey-based measure of customer satisfaction with a product, support case, implementation, or other interaction. |
| CSM | Customer Success Manager: A role responsible for helping customers adopt the product, realize value, manage risks, renew, and identify appropriate expansion opportunities. |
| CSP | Content Security Policy: A browser-security standard that limits which resources a web application may load or execute, helping mitigate cross-site scripting and related injection attacks. |
| CSRF | Cross-Site Request Forgery: A web attack that tricks an authenticated user’s browser into submitting an unintended request, requiring application-level safeguards against unauthorized actions. |
| CSV | Comma-Separated Values: A simple tabular file format widely used for importing, exporting, migrating, and exchanging business data between applications. |
| CVE | Common Vulnerabilities and Exposures: A standardized catalog of publicly disclosed cybersecurity vulnerabilities used to track affected software and remediation requirements. |
| CVSS | Common Vulnerability Scoring System: A standardized method for rating vulnerability severity, helping engineering and security teams prioritize remediation alongside exploitability and business context. |
| CWE | Common Weakness Enumeration: A standardized classification of software and hardware weakness types used in secure development, testing, and vulnerability analysis. |
| D | |
| DAST | Dynamic Application Security Testing: Security testing that evaluates a running application from the outside to identify exploitable vulnerabilities and unsafe runtime behavior. |
| DAU | Daily Active Users: The number of distinct users who perform a defined qualifying action during a day, used to monitor adoption and engagement. |
| DBMS | Database Management System: Software that stores, retrieves, secures, and manages structured or unstructured data used by applications. |
| DBNRR | Dollar-Based Net Retention Rate: The recurring revenue retained from an existing customer cohort after expansion, contraction, and churn, excluding new customers. |
| DLP | Data Loss Prevention: Policies and technologies that detect and restrict unauthorized movement, disclosure, or exfiltration of sensitive information. |
| DMN | Decision Model and Notation: A standard for modeling business decisions and rules in a consistent form that can be understood by business and technical teams. |
| DORA | DevOps Research and Assessment: A research program associated with software-delivery performance measures such as deployment frequency, lead time for changes, change failure rate, and recovery time. |
| DORA | Digital Operational Resilience Act: A European Union regulation governing information and communications technology risk, incident reporting, resilience testing, and third-party providers in the financial sector. |
| DPA | Data Processing Agreement: A contract defining how a service provider processes personal data, including instructions, safeguards, subprocessors, assistance duties, and deletion or return requirements. |
| DPF | Data Privacy Framework: A transfer mechanism under which eligible U.S. organizations can self-certify commitments for receiving personal data from participating European jurisdictions. |
| DPIA | Data Protection Impact Assessment: A structured assessment of privacy risks and safeguards required for certain processing activities likely to create high risks for individuals. |
| DR | Disaster Recovery: The plans, systems, and procedures used to restore data and service operation after a severe outage or destructive event. |
| DSAR | Data Subject Access Request: A request through which an individual exercises applicable privacy rights regarding access to, correction of, deletion of, or other action on personal data. |
| E | |
| E2EE | End-to-End Encryption: Encryption designed so that only communicating endpoints can read the protected content, limiting intermediary access to plaintext data. |
| EAI | Enterprise Application Integration: The architecture and tooling used to connect business applications, synchronize data, and coordinate processes across heterogeneous systems. |
| EAM | Enterprise Asset Management: Software for managing the lifecycle, maintenance, performance, cost, and risk of physical assets and related work. |
| EAP | Early Access Program: A controlled release program that gives selected customers access to new capabilities before general availability to gather feedback and validate readiness. |
| ECM | Enterprise Content Management: Software and practices for capturing, governing, storing, retrieving, retaining, and disposing of organizational documents and content. |
| EDI | Electronic Data Interchange: The structured computer-to-computer exchange of standardized business documents such as purchase orders, invoices, and shipment notices. |
| ELA | Enterprise License Agreement: A negotiated contract granting broad software-use rights across an organization, often with volume pricing, deployment rules, and audit provisions. |
| ELT | Extract, Load, Transform: A data-integration pattern that loads source data into a target platform before transforming it for analysis or application use. |
| EOL | End of Life: The lifecycle point after which a product or version is retired and may no longer receive support, maintenance, or security updates. |
| EOS | End of Sale: The date after which a product, edition, or version is no longer available for new purchase, although existing customers may continue using it. |
| EOS | End of Support: The date after which a vendor stops providing standard technical assistance, fixes, or updates for a product or version. |
| ERP | Enterprise Resource Planning: Integrated software for core business processes such as finance, procurement, inventory, manufacturing, projects, and order management. |
| ESB | Enterprise Service Bus: Integration middleware that routes, transforms, and orchestrates messages among applications and services through a shared communication layer. |
| ETL | Extract, Transform, Load: A data-integration process that retrieves source data, converts it into the required structure, and loads it into a target system. |
| EULA | End-User License Agreement: A contract specifying the rights, restrictions, warranties, and liabilities governing an end user’s use of software. |
| F | |
| FedRAMP | Federal Risk and Authorization Management Program: A U.S. government program providing standardized security assessment, authorization, and continuous-monitoring requirements for cloud products used by federal agencies. |
| FIPS | Federal Information Processing Standards: U.S. government standards for federal information systems, including cryptographic requirements frequently relevant to public-sector software deployments. |
| FISMA | Federal Information Security Modernization Act: A U.S. law establishing information-security responsibilities and risk-management requirements for federal agencies and certain systems operated on their behalf. |
| FOSS | Free and Open Source Software: Software whose licensing permits access to source code and specified rights to use, modify, and redistribute it, subject to applicable license obligations. |
| FSM | Field Service Management: Software for planning, dispatching, executing, and tracking installation, maintenance, inspection, and repair work performed at customer or asset locations. |
| G | |
| GA | General Availability: The release stage at which a product or feature is broadly available and supported for production use under standard commercial terms. |
| GDPR | General Data Protection Regulation: The European Union’s principal data-protection regulation governing lawful processing, individual rights, security, accountability, and international transfers of personal data. |
| GDR | Gross Dollar Retention: The percentage of recurring revenue retained from an existing customer cohort before expansion, reflecting churn and contraction only. |
| GenAI | Generative Artificial Intelligence: Models and applications that create text, code, images, audio, or other content in response to instructions or contextual inputs. |
| GPAI | General-Purpose Artificial Intelligence: Artificial-intelligence models capable of performing a broad range of tasks and being integrated into downstream applications, including enterprise products. |
| GPL | GNU General Public License: A widely used copyleft open-source license requiring distributed derivative works to remain under the same licensing terms and include corresponding source code. |
| GRR | Gross Revenue Retention: The percentage of starting recurring revenue retained from an existing customer cohort after churn and contraction but before expansion. |
| GTM | Go-to-Market: The coordinated strategy for reaching target customers through positioning, pricing, marketing, sales, partnerships, onboarding, and customer success. |
| GUI | Graphical User Interface: A visual interface through which users interact with software using elements such as screens, menus, forms, icons, and controls. |
| H | |
| HA | High Availability: An architectural objective of keeping a service operational despite component failures through redundancy, failover, and resilient system design. |
| HCM | Human Capital Management: Enterprise software supporting workforce administration, payroll, talent, performance, benefits, learning, and workforce planning. |
| HIPAA | Health Insurance Portability and Accountability Act: A U.S. law whose privacy, security, and breach-notification rules affect software providers handling protected health information for regulated healthcare organizations. |
| HITRUST CSF | HITRUST Common Security Framework: A certifiable control framework that harmonizes multiple security and privacy requirements and is frequently requested by healthcare and other regulated customers. |
| HRIS | Human Resources Information System: Software that maintains employee records and supports core human-resources processes such as payroll, benefits, compliance, and reporting. |
| HYOK | Hold Your Own Key: An encryption model in which customers retain keys outside the provider’s environment, offering stronger control but potentially limiting application functionality. |
| I | |
| IAM | Identity and Access Management: Policies and technologies that manage digital identities, authentication, authorization, roles, and access throughout the user lifecycle. |
| ICP | Ideal Customer Profile: A description of the organizations most likely to buy, succeed with, retain, and expand use of a product, based on attributes such as industry, size, needs, and technology environment. |
| IDE | Integrated Development Environment: A software workspace combining code editing, building, testing, debugging, and related development tools. |
| IdP | Identity Provider: A trusted system that authenticates users and supplies identity assertions to connected applications, enabling centralized access and single sign-on. |
| IEC | International Electrotechnical Commission: An international standards organization that jointly publishes important information-security, privacy, service-management, and artificial-intelligence standards. |
| IFRS 15 | International Financial Reporting Standard 15, Revenue from Contracts with Customers: International accounting guidance governing the timing and measurement of revenue from subscriptions, licenses, implementation, support, and other contract obligations. |
| iPaaS | Integration Platform as a Service: A cloud-delivered platform for building, deploying, monitoring, and governing integrations among applications, data sources, interfaces, and business processes. |
| ISMS | Information Security Management System: A structured set of policies, processes, controls, responsibilities, and improvement mechanisms for managing information-security risk. |
| ISO | International Organization for Standardization: An independent international body that develops standards frequently used to demonstrate security, privacy, quality, and management-system maturity. |
| ISO/IEC 27001 | Information Security, Cybersecurity and Privacy Protection—Information Security Management Systems—Requirements: The certifiable international standard for establishing, operating, monitoring, and continually improving an information-security management system. |
| ISO/IEC 27017 | Code of Practice for Information Security Controls Based on ISO/IEC 27002 for Cloud Services: Guidance that extends information-security controls with cloud-specific implementation considerations for service providers and customers. |
| ISO/IEC 27018 | Code of Practice for Protection of Personally Identifiable Information in Public Clouds Acting as Processors: Guidance for protecting personal information processed by public-cloud service providers on behalf of customers. |
| ISO/IEC 27701 | Privacy Information Management Systems—Requirements and Guidance: An international standard for establishing and improving a management system for privacy controls, accountability, and personal-data processing. |
| ISO/IEC 42001 | Information Technology—Artificial Intelligence—Management System: A certifiable international standard for governing the responsible development, provision, or use of artificial-intelligence systems. |
| ISV | Independent Software Vendor: A company that develops and sells software products rather than primarily manufacturing hardware or delivering bespoke implementation services. |
| ITIL | Information Technology Infrastructure Library: A widely used service-management framework covering practices such as incident, problem, change, request, and service-level management. |
| ITSM | Information Technology Service Management: The discipline and software category for designing, delivering, supporting, and improving technology services through standardized workflows and controls. |
| J | |
| JDBC | Java Database Connectivity: A standard interface that enables Java applications to connect to relational databases, execute queries, and process results. |
| JIT | Just-in-Time Provisioning: The automatic creation or update of a user account when the user first authenticates through a trusted identity provider. |
| JSON | JavaScript Object Notation: A lightweight data-interchange format widely used in application interfaces, configuration, integrations, and event messages. |
| JTBD | Jobs to Be Done: A product-development framework that defines customer needs in terms of the progress or outcome users seek rather than product features alone. |
| JWT | JavaScript Object Notation Web Token: A compact, signed token format used to transmit identity, authorization, and other claims between application components. |
| K | |
| KMS | Key Management System: Technology for generating, storing, rotating, controlling, and auditing cryptographic keys used to protect application data and secrets. |
| L | |
| LDAP | Lightweight Directory Access Protocol: A protocol for querying and managing directory information, often used to integrate enterprise applications with centralized identity stores. |
| LGPL | GNU Lesser General Public License: A weak copyleft open-source license that generally permits linking licensed libraries with proprietary software while preserving modification obligations for the library itself. |
| LLM | Large Language Model: A machine-learning model trained on extensive text or code data to generate, summarize, classify, retrieve, or reason over language-based content. |
| LLMOps | Large Language Model Operations: Practices and tools for deploying, evaluating, monitoring, securing, and governing language-model applications in production. |
| LMS | Learning Management System: Software for administering, delivering, tracking, and reporting employee, customer, partner, or academic learning programs. |
| LTS | Long-Term Support: A product version maintained with fixes and security updates for an extended period, giving enterprise customers a more stable upgrade path. |
| LTV | Lifetime Value: The estimated economic value contributed by a customer over the relationship, commonly modeled from revenue, gross margin, retention, and expected lifetime. |
| LTV:CAC | Lifetime Value to Customer Acquisition Cost Ratio: A unit-economics measure comparing expected customer value with the cost of acquiring that customer. |
| M | |
| MAU | Monthly Active Users: The number of distinct users performing a defined qualifying action during a month, used to track reach, adoption, and engagement. |
| MCP | Model Context Protocol: An open protocol for connecting artificial-intelligence applications to external tools, resources, and data through standardized interfaces. |
| MDM | Master Data Management: Software and governance for creating consistent, authoritative records of core entities such as customers, products, suppliers, and locations. |
| MDM | Mobile Device Management: Software for enrolling, configuring, securing, monitoring, and remotely managing smartphones, tablets, and other enterprise endpoints. |
| MEDDIC | Metrics, Economic Buyer, Decision Criteria, Decision Process, Identify Pain, Champion: A qualification framework used in complex enterprise sales to test deal value, stakeholder access, purchasing logic, pain, and internal support. |
| MEDDPICC | Metrics, Economic Buyer, Decision Criteria, Decision Process, Paper Process, Identify Pain, Champion, Competition: An expanded enterprise-sales qualification framework that adds contracting steps and competitive position to the core deal-assessment elements. |
| MES | Manufacturing Execution System: Software that monitors, controls, and documents production activity between planning systems and shop-floor operations. |
| MFA | Multi-Factor Authentication: An authentication method requiring evidence from two or more credential categories, materially reducing account-takeover risk. |
| ML | Machine Learning: A branch of artificial intelligence in which models learn patterns from data to make predictions, classifications, recommendations, or automated decisions. |
| MLOps | Machine Learning Operations: Practices and tooling for developing, deploying, monitoring, retraining, versioning, and governing machine-learning models in production. |
| MQL | Marketing Qualified Lead: A prospect judged by defined engagement and fit criteria to warrant further marketing or sales follow-up. |
| MRD | Market Requirements Document: A product-planning document describing the target market, customer problems, competitive context, and market-level requirements for an offering. |
| MRR | Monthly Recurring Revenue: The normalized monthly value of recurring subscription revenue, used to track new business, expansion, contraction, and churn. |
| MSA | Master Services Agreement: A framework contract establishing the principal legal and commercial terms governing current and future transactions between a vendor and customer. |
| MTBF | Mean Time Between Failures: The average operating time between repairable system failures, used to assess reliability and maintenance performance. |
| mTLS | Mutual Transport Layer Security: A connection-security method in which both client and server authenticate with certificates, strengthening service-to-service and partner integrations. |
| MTTA | Mean Time to Acknowledge: The average time between an alert or incident being raised and a responsible team beginning formal response. |
| MTTD | Mean Time to Detect: The average elapsed time before a failure, security event, or service incident is identified. |
| MTTR | Mean Time to Repair: The average time required to correct a failed component or software defect and return it to working condition. |
| MTTR | Mean Time to Resolution: The average time needed to fully resolve an incident or customer-support case, including diagnosis, remediation, and closure. |
| MTTR | Mean Time to Restore: The average time required to restore service after an interruption, regardless of whether the underlying cause has been permanently repaired. |
| MVC | Model-View-Controller: A software design pattern that separates data and business logic, presentation, and input-handling responsibilities. |
| MVP | Minimum Viable Product: The smallest usable product version designed to test critical customer, market, or solution assumptions with limited initial investment. |
| MVVM | Model-View-ViewModel: A user-interface architecture that separates presentation from business logic through an intermediary representation of view state and behavior. |
| N | |
| NDR | Net Dollar Retention: The percentage of recurring revenue retained from an existing customer cohort after expansion, contraction, and churn. |
| NFR | Non-Functional Requirement: A requirement defining how a system must perform, including security, availability, scalability, accessibility, maintainability, or response-time expectations. |
| NIS2 | Second Network and Information Systems Directive: European Union cybersecurity legislation imposing risk-management, incident-reporting, governance, and supply-chain obligations on covered entities. |
| NIST | National Institute of Standards and Technology: A U.S. government agency that publishes cybersecurity, privacy, artificial-intelligence, cryptography, and risk-management standards and guidance. |
| NLP | Natural Language Processing: Technologies that enable software to analyze, interpret, search, classify, translate, or generate human language. |
| NoSQL | Not Only Structured Query Language: A broad category of non-relational databases designed for data models such as documents, key-value pairs, graphs, or wide-column stores. |
| NPS | Net Promoter Score: A customer-loyalty measure derived from willingness to recommend, calculated as the percentage of promoters minus the percentage of detractors. |
| NRR | Net Revenue Retention: The percentage of recurring revenue retained from an existing customer cohort after accounting for expansion, contraction, and churn. |
| O | |
| OAuth | Open Authorization: A delegated-authorization framework that lets applications obtain limited access to protected resources without receiving a user’s password. |
| ODBC | Open Database Connectivity: A standard interface that allows applications and analytics tools to access different database systems through compatible drivers. |
| OIDC | OpenID Connect: An identity layer built on delegated authorization standards that enables applications to authenticate users and obtain standardized identity claims. |
| OLA | Operational Level Agreement: An internal agreement defining how teams or service components support the performance commitments made to customers. |
| OLAP | Online Analytical Processing: Technology optimized for multidimensional analysis, aggregations, and complex queries used in reporting and business intelligence. |
| OLTP | Online Transaction Processing: Systems optimized for high volumes of short, reliable business transactions such as orders, payments, and account updates. |
| ORM | Object-Relational Mapping: A software technique that maps application objects to relational database tables, reducing the need for manually written data-access code. |
| OSI | Open Source Initiative: The organization that maintains the Open Source Definition and approves licenses that satisfy its open-source criteria. |
| OSS | Open Source Software: Software made available under a license granting defined rights to inspect, use, modify, and redistribute source code. |
| OWASP | Open Worldwide Application Security Project: A nonprofit foundation that publishes application-security guidance, tools, testing resources, and widely used vulnerability classifications. |
| P | |
| PaaS | Platform as a Service: A cloud service model providing managed application runtimes, development services, and supporting components without requiring customers to operate the underlying infrastructure. |
| PAM | Privileged Access Management: Controls and tools for securing, approving, monitoring, and auditing elevated access to sensitive systems and administrative functions. |
| PCI DSS | Payment Card Industry Data Security Standard: A security standard for organizations that store, process, or transmit payment-card data or can affect the security of that environment. |
| PHI | Protected Health Information: Individually identifiable health information protected under U.S. healthcare privacy rules when held or transmitted by regulated organizations and their business associates. |
| PII | Personally Identifiable Information: Information that identifies or can reasonably be linked to an individual, requiring appropriate privacy, security, retention, and access controls. |
| PIM | Product Information Management: Software that centralizes, enriches, governs, and distributes product data across sales, commerce, catalog, and partner channels. |
| PIR | Post-Incident Review: A structured evaluation of an outage or security event covering impact, timeline, contributing factors, response effectiveness, and corrective actions. |
| PKI | Public Key Infrastructure: The certificates, keys, authorities, policies, and processes used to establish digital identities, encrypt communications, and create signatures. |
| PLG | Product-Led Growth: A go-to-market model in which product use drives acquisition, activation, conversion, retention, and expansion, often through trials or self-service adoption. |
| PLM | Product Lifecycle Management: Enterprise software for governing product designs, specifications, bills of material, changes, compliance records, and collaboration from concept through retirement. |
| POC | Proof of Concept: A limited evaluation used to demonstrate that a proposed product can satisfy specified technical or business requirements before a broader commitment. |
| POV | Proof of Value: A structured evaluation designed to demonstrate measurable business outcomes, not merely technical feasibility, before purchase or expansion. |
| PQL | Product-Qualified Lead: A prospect whose product usage and fit signals indicate meaningful value realization and a higher likelihood of purchasing or expanding. |
| PRD | Product Requirements Document: A document defining a capability’s objectives, users, requirements, constraints, acceptance criteria, and expected outcomes. |
| PSA | Professional Services Automation: Software for managing project staffing, time, expenses, delivery, utilization, billing, and profitability in services organizations. |
| PWA | Progressive Web Application: A web application using modern browser capabilities to provide app-like performance, installation, responsiveness, and selected offline functionality. |
| Q | |
| QA | Quality Assurance: Processes and controls designed to prevent defects and verify that software meets functional, performance, security, and usability expectations. |
| QBR | Quarterly Business Review: A periodic customer meeting used to assess outcomes, adoption, service performance, risks, priorities, roadmap alignment, and expansion opportunities. |
| R | |
| RAG | Retrieval-Augmented Generation: An artificial-intelligence architecture that retrieves relevant external information and supplies it to a generative model to improve contextual accuracy and grounding. |
| RASP | Runtime Application Self-Protection: Security technology embedded in or attached to a running application to detect and block attacks using runtime context. |
| RBAC | Role-Based Access Control: An authorization model that grants permissions according to assigned job or functional roles, simplifying access administration at enterprise scale. |
| RCA | Root Cause Analysis: A structured investigation of the underlying technical and organizational contributors to a defect, outage, or recurring operational problem. |
| RCE | Remote Code Execution: A severe vulnerability class that allows an attacker to execute commands or code on a target system from another location. |
| RDBMS | Relational Database Management System: Database software that organizes data into related tables and generally supports transactional consistency and structured querying. |
| REST | Representational State Transfer: An architectural style for networked applications that uses resources, standard operations, stateless interactions, and transferable representations. |
| RFI | Request for Information: A procurement document used to gather preliminary information about vendor capabilities, approaches, security, and market options. |
| RFP | Request for Proposal: A formal buyer solicitation asking vendors to propose solutions, pricing, implementation plans, contractual terms, and responses to detailed requirements. |
| RLS | Row-Level Security: A database or analytics control that restricts which records a user can access, often supporting tenant and departmental data isolation. |
| RPA | Robotic Process Automation: Software that automates repetitive, rules-based user-interface tasks by mimicking actions such as data entry, navigation, and reconciliation. |
| RPC | Remote Procedure Call: A communication pattern that lets one program invoke a function in another process or system as though it were local. |
| RPO | Recovery Point Objective: The maximum acceptable amount of data loss measured in time, which determines backup, replication, and recovery design requirements. |
| RPO | Remaining Performance Obligations: Contracted revenue not yet recognized because the related goods or services have not yet been delivered, providing visibility into future revenue. |
| RTO | Recovery Time Objective: The target maximum time for restoring a service or business process after disruption. |
| RUM | Real User Monitoring: Performance monitoring based on actual user sessions, providing evidence about page speed, errors, and experience across devices and locations. |
| S | |
| SaaS | Software as a Service: A delivery model in which customers access vendor-operated software, generally through a subscription, rather than installing and maintaining it independently. |
| SAML | Security Assertion Markup Language: An XML-based standard for exchanging authentication and authorization assertions, widely used for enterprise single sign-on. |
| SAST | Static Application Security Testing: Analysis of source code, bytecode, or binaries without executing the application to identify potential security weaknesses early in development. |
| SBOM | Software Bill of Materials: A structured inventory of software components and dependencies used to manage vulnerabilities, licensing obligations, and software supply-chain risk. |
| SCA | Software Composition Analysis: Tools and processes that identify open-source and third-party components, licenses, known vulnerabilities, and dependency risks in software products. |
| SCC | Standard Contractual Clauses: European Commission-approved contract terms used as a safeguard for certain international transfers of personal data. |
| SCIM | System for Cross-domain Identity Management: A standard protocol for automating user and group provisioning, updates, and deprovisioning between identity systems and applications. |
| SCM | Supply Chain Management: Enterprise software supporting planning, sourcing, production, inventory, logistics, order fulfillment, and supplier collaboration. |
| SDK | Software Development Kit: A packaged set of libraries, tools, documentation, examples, and utilities that helps developers build on or integrate with a platform. |
| SDLC | Software Development Life Cycle: The structured process for planning, designing, building, testing, releasing, operating, and retiring software. |
| SDR | Sales Development Representative: A sales role focused on outbound or inbound prospect qualification and creating opportunities for closing representatives. |
| SFTP | SSH File Transfer Protocol: A secure protocol for transferring and managing files over an encrypted connection, commonly used for batch enterprise integrations. |
| SIEM | Security Information and Event Management: Technology that centralizes, correlates, analyzes, and alerts on security logs and events from applications and infrastructure. |
| SIG | Standardized Information Gathering Questionnaire: A widely used third-party risk questionnaire for assessing vendor controls across security, privacy, resilience, and related domains. |
| SIT | System Integration Testing: Testing that verifies whether connected modules, applications, interfaces, and data flows work correctly together. |
| SLA | Service-Level Agreement: A contractual commitment defining measurable service standards such as availability, support response, resolution, and remedies for nonperformance. |
| SLG | Sales-Led Growth: A go-to-market model in which sales teams play the primary role in qualifying, demonstrating, negotiating, and closing customer purchases. |
| SLI | Service-Level Indicator: A quantitative measure of service behavior, such as successful request rate or latency, used to evaluate reliability. |
| SLO | Service-Level Objective: An internal reliability target for a measured service indicator, typically set more tightly than the external contractual commitment. |
| SOA | Service-Oriented Architecture: A software architecture that organizes business capabilities as reusable, loosely coupled services with defined interfaces. |
| SOAP | Simple Object Access Protocol: An XML-based messaging protocol used in structured web-service integrations, especially in established enterprise environments. |
| SOC 1 | System and Organization Controls 1: An independent attestation report addressing controls at a service organization that are relevant to customers’ internal control over financial reporting. |
| SOC 2 | System and Organization Controls 2: An independent attestation report evaluating controls relevant to security, availability, processing integrity, confidentiality, or privacy under the Trust Services Criteria. |
| SOC 3 | System and Organization Controls 3: A general-use assurance report covering Trust Services Criteria without the detailed system description and control-testing information contained in a restricted-use report. |
| SOW | Statement of Work: A contract document specifying project scope, deliverables, responsibilities, assumptions, schedule, fees, and acceptance criteria for implementation or services. |
| SOX | Sarbanes-Oxley Act: A U.S. law governing public-company financial reporting and internal controls, affecting software used in financially significant processes and vendor controls supporting them. |
| SPA | Single-Page Application: A web application that dynamically updates a single loaded page rather than requesting a full new page for each interaction. |
| SPDX | Software Package Data Exchange: An open standard for communicating software-component, license, copyright, provenance, and security information, including bills of materials. |
| SQL | Sales Qualified Lead: A prospect accepted by sales as sufficiently well matched and purchase-ready to justify direct opportunity development. |
| SQL | Structured Query Language: A standard language for defining, querying, modifying, and controlling data in relational database systems. |
| SQLi | Structured Query Language Injection: An application vulnerability in which untrusted input alters a database command, potentially exposing or modifying data and compromising systems. |
| SSDLC | Secure Software Development Life Cycle: A development lifecycle that integrates security requirements, threat analysis, testing, review, remediation, and governance throughout product delivery. |
| SSL | Secure Sockets Layer: A legacy encrypted-communications protocol whose name remains common in certificate terminology even though modern services use Transport Layer Security. |
| SSO | Single Sign-On: An authentication capability allowing users to access multiple applications through one centrally managed login session. |
| SSP | Standalone Selling Price: The price at which a distinct good or service would be sold separately, used to allocate contract consideration among performance obligations. |
| SSPL | Server Side Public License: A source-available license with service-related disclosure obligations that is not approved as open source by the Open Source Initiative. |
| SSRF | Server-Side Request Forgery: A vulnerability that lets an attacker induce a server to make unintended requests, potentially reaching internal services or protected resources. |
| T | |
| TCO | Total Cost of Ownership: The complete economic cost of a software solution, including subscriptions or licenses, implementation, integration, administration, support, training, change, and retirement. |
| TCV | Total Contract Value: The full value committed over a contract’s term, which may include recurring subscriptions, services, support, and one-time fees under a defined company policy. |
| TLS | Transport Layer Security: The standard cryptographic protocol used to authenticate endpoints and protect data in transit between applications, browsers, and services. |
| TMS | Transportation Management System: Enterprise software for planning, procuring, executing, tracking, and settling freight transportation. |
| ToS | Terms of Service: Contractual provisions governing access to and use of an online product, including user obligations, restrictions, warranties, and liability terms. |
| TOTP | Time-Based One-Time Password: A short-lived authentication code generated from a shared secret and the current time, commonly used as an additional authentication factor. |
| TSC | Trust Services Criteria: The American Institute of Certified Public Accountants’ criteria for evaluating controls related to security, availability, processing integrity, confidentiality, and privacy. |
| TTR | Time to Resolution: The elapsed time from the opening or detection of an issue until it is resolved, used in support and incident-performance reporting. |
| TTV | Time to Value: The period between a customer’s purchase or start of implementation and realization of the first meaningful business outcome. |
| U | |
| UAT | User Acceptance Testing: Validation performed by representative business users to confirm that software supports agreed requirements and is ready for operational use. |
| UI | User Interface: The screens, controls, visual elements, and interaction mechanisms through which users operate a software product. |
| UML | Unified Modeling Language: A standardized visual language for representing software structures, behavior, interactions, and system designs. |
| UX | User Experience: The overall quality of a user’s interaction with a product, including usability, accessibility, efficiency, clarity, and perceived value. |
| V | |
| VAR | Value-Added Reseller: A channel partner that resells software while adding implementation, configuration, integration, support, or industry-specific services. |
| VPAT | Voluntary Product Accessibility Template: A standardized template used to document how a technology product conforms to accessibility standards for enterprise and public-sector procurement. |
| W | |
| WAF | Web Application Firewall: A security control that monitors and filters web traffic to block malicious requests and common application-layer attacks. |
| WAU | Weekly Active Users: The number of distinct users performing a defined qualifying action during a week, used to assess recurring product engagement. |
| WCAG | Web Content Accessibility Guidelines: Internationally recognized recommendations for making web content perceivable, operable, understandable, and robust for people with disabilities. |
| WFM | Workforce Management: Software for forecasting labor demand, scheduling employees, tracking time and attendance, and optimizing workforce capacity. |
| WMS | Warehouse Management System: Software that controls inventory movement, storage, picking, packing, replenishment, and fulfillment operations within warehouses. |
| WSDL | Web Services Description Language: An XML-based format describing a web service’s operations, messages, endpoints, and binding requirements for system integration. |
| X | |
| XaaS | Anything as a Service: An umbrella term for technology capabilities delivered and consumed as managed, subscription-based services rather than customer-operated products. |
| XML | Extensible Markup Language: A structured text format for representing and exchanging hierarchical data, widely used in enterprise documents, configuration, and integrations. |
| XSS | Cross-Site Scripting: A web vulnerability that allows malicious scripts to execute in users’ browsers within the context of a trusted application. |