TAISE key terms

The relevant model, data, retrieval, tools, identities and consumers considered in an actual use case, broader than a model’s weights alone.

Information overlap or other contamination reducing the independence of an evaluation, potentially overstating performance in the intended deployment context.

Adversarial instructions embedded in retrieved or otherwise external content that attempt to redirect an AI application beyond the authorized task.

An AI application’s overly broad functionality, permissions or autonomy that can enable damaging consequential actions under unexpected or manipulated behavior.

Review with relevant information, competence, authority and ability to intervene, rather than nominal approval without understanding or an enforced action boundary.

The remaining relevant uncertainty and potential harm after chosen controls, requiring accountable evaluation in the actual use context rather than a framework label.

The principle that users and systems should be granted only the minimum access rights necessary to perform their tasks, reducing the potential damage from accidents or malicious activity.

A control that divides critical tasks among different individuals so that no single person can complete a sensitive action alone, helping to prevent fraud and errors.

An access control model where permissions are assigned to roles rather than individual users, and users are assigned to roles based on their job responsibilities.

An authentication method that requires two or more independent credentials from different categories (something you know, have, or are) to verify a user's identity.

The process of verifying the identity of a user, device, or system, typically through credentials such as passwords, tokens, or biometrics.

The process of determining what actions or resources an authenticated entity is permitted to access, often enforced through access control policies.

A mechanism that allows a user to log in once and access multiple applications or systems without re-entering credentials, improving usability and centralizing access control.

The process of converting plaintext into ciphertext using an algorithm and a key, so that only authorized parties can read the original information.

An encryption method that uses the same secret key for both encryption and decryption, offering speed but requiring secure key distribution.

Encryption using a suitable public-key scheme and a corresponding private key for decryption. Authenticated key distribution and the specified padding/protocol remain essential; signatures and key agreement are distinct constructions.

A digest construction mapping input to an output under its defined algorithm, with cryptographic versions designed for appropriate resistance properties. Password storage needs a suitable salted password-hashing/KDF scheme rather than a bare fast digest.

An electronic signature that uses asymmetric cryptography to verify the authenticity and integrity of a message or document.

The policies and mechanisms that determine who can access which systems, data, or facilities and under what conditions.

A system that collects, aggregates, and analyzes log data from various sources to detect security incidents and support compliance reporting.

A structured approach to handling security incidents, typically including preparation, detection, containment, eradication, recovery, and lessons learned.

The process of identifying, analyzing, and evaluating risks to determine their potential impact and likelihood, often used to prioritize security controls.

The coordinated activities to direct and control an organization regarding risk, including risk assessment, treatment, acceptance, and communication.

A systematic examination of an organization's security controls, policies, and procedures to verify compliance with standards and identify areas for improvement.

The effect of uncertainty on objectives, usually described by the likelihood of an event and its potential impact.

The level of risk that exists before any controls or risk responses are applied to a process, asset, or activity.

The risk remaining after controls and risk responses have been implemented and their effectiveness has been considered.

The part of risk assessment that examines the nature, causes, likelihood, and impact of identified risks. It may use qualitative or quantitative methods.

The part of risk assessment that compares analysis results with risk criteria to decide whether risk is acceptable.

A structured record of identified risks, including owners, ratings, controls, responses, and status, used to monitor and manage risk.