Clateway Insights

Glossary for technology leaders

27 terms technology leaders search for, explained: NIS2, DORA, the Cyber Resilience Act, ISO 27001, SBOM, EPSS, fractional CIO, technology due diligence and more.

Regulation

  • NIS2 Directive: NIS2 (Directive (EU) 2022/2555) is the EU law that sets cybersecurity risk-management and incident-reporting obligations for medium and large organisations in critical sectors, and makes their management bodies accountable for cybersecurity.
  • DORA (Digital Operational Resilience Act): DORA (Regulation (EU) 2022/2554) is the EU regulation that requires financial entities to manage ICT risk, report major ICT incidents, test their digital operational resilience and control their ICT third-party providers; it has applied since 17 January 2025.
  • Cyber Resilience Act (CRA): The Cyber Resilience Act (Regulation (EU) 2024/2847) sets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU, covering their whole lifecycle from design to end of support.
  • GDPR: The GDPR (Regulation (EU) 2016/679) is the EU law that governs how organisations collect, use, store and protect personal data, and gives people rights over their data.

AI

  • EU AI Act: The EU AI Act (Regulation (EU) 2024/1689) is the EU law that regulates artificial intelligence by risk: it bans unacceptable-risk practices, sets strict requirements for high-risk AI systems and adds transparency duties for certain AI, including general-purpose AI models.
  • AI governance: AI governance is the set of policies, roles, controls and oversight that make sure an organisation uses AI lawfully, safely, transparently and in line with its values.

Risk & compliance

  • ISO 27001: ISO/IEC 27001 is the international standard for an information security management system (ISMS): a risk-based way to manage information security that an organisation can be certified against.
  • Statement of Applicability (SoA): A Statement of Applicability is the ISO 27001 document that lists every Annex A control, states whether it is applied or excluded, gives the justification and records its implementation status.
  • Risk register: A risk register is the record of an organisation's identified risks, with for each risk its owner, likelihood and impact, the controls in place, the treatment decision and the next review date.
  • Risk appetite: Risk appetite is the amount of risk an organisation is willing to accept in pursuit of its objectives, set by its board and used to decide which risks need treatment.
  • GRC (governance, risk and compliance): GRC (governance, risk and compliance) is the integrated way an organisation sets direction and accountability, manages its risks and meets its legal, regulatory and contractual obligations.
  • Third-party risk management (TPRM): Third-party risk management (TPRM) is the process of identifying, assessing, monitoring and reducing the risks that suppliers and service providers bring to an organisation, from cyber and data risks to operational and financial dependency.
  • Fourth-party risk: Fourth-party risk is the risk that comes from the suppliers of your suppliers: a failure or breach at a subcontractor of one of your vendors that affects your organisation.

Security

  • CVE and CVSS: A CVE (Common Vulnerabilities and Exposures) is the public identifier of a known security vulnerability, such as CVE-2021-44228, and CVSS is the 0–10 score that rates its technical severity.
  • EPSS (Exploit Prediction Scoring System): EPSS (Exploit Prediction Scoring System) is a model from FIRST that estimates, for every published CVE, the probability that it will be exploited in the wild in the next 30 days.
  • CISA KEV catalogue: The CISA Known Exploited Vulnerabilities (KEV) catalogue is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with evidence of active exploitation.
  • SBOM (software bill of materials): An SBOM (software bill of materials) is a machine-readable list of all components, libraries and versions a piece of software is built from, used to find which products are affected by a vulnerability.
  • CSAF (Common Security Advisory Framework): CSAF (Common Security Advisory Framework) is the OASIS standard for publishing security advisories in a machine-readable JSON format, so tools can automatically tell which products and versions are affected.

Leadership

  • Fractional CIO: A fractional CIO is an experienced Chief Information Officer who works for an organisation part time, typically one to three days a week, with the full mandate for IT strategy, budget, suppliers, security and the IT organisation.
  • Interim CIO: An interim CIO is an experienced Chief Information Officer who joins full time for a defined period to fill a sudden vacancy or lead a critical change, such as a merger, carve-out, turnaround or recovery after an incident.
  • Fractional CTO: A fractional CTO is a part-time Chief Technology Officer who owns technology strategy, architecture and engineering leadership for a company that does not yet need, or cannot yet justify, a full-time CTO.
  • Interim CTO: An interim CTO is an experienced Chief Technology Officer who leads engineering and technology full time for a defined period, for example during a vacancy, a platform rebuild, an acquisition or a carve-out.
  • Technology due diligence: Technology due diligence is an independent assessment of a target company's technology, software, cybersecurity, suppliers and technology organisation before an investment or acquisition, to find the risks and costs that affect the deal.

Architecture & delivery

  • Enterprise architecture: Enterprise architecture is the discipline of documenting and designing how an organisation's business processes, data, applications and technology fit together, so that change can be planned and its risks and costs controlled.
  • OKR (objectives and key results): OKR (objectives and key results) is a goal-setting method in which an objective describes what you want to achieve and two to five measurable key results describe how you will know you achieved it.
  • Obeya room: An Obeya (Japanese for 'big room') is a visual management space, physical or digital, where leaders see strategy, delivery, risks and decisions together on one wall and steer them in short, regular meetings.
  • Major incident management: Major incident management is the ITSM process for the highest-impact incidents: a dedicated manager and team, fast communication to stakeholders, child incidents linked to one major incident, and a review afterwards.