Glossary

Last updated
Save as PDF

Page ID: 66743

$ \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } $

$ \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} $

$ \newcommand{\dsum}{\displaystyle\sum\limits} $

$ \newcommand{\dint}{\displaystyle\int\limits} $

$ \newcommand{\dlim}{\displaystyle\lim\limits} $

$ \newcommand{\id}{\mathrm{id}}$ $ \newcommand{\Span}{\mathrm{span}}$

( \newcommand{\kernel}{\mathrm{null}\,}\) $ \newcommand{\range}{\mathrm{range}\,}$

$ \newcommand{\RealPart}{\mathrm{Re}}$ $ \newcommand{\ImaginaryPart}{\mathrm{Im}}$

$ \newcommand{\Argument}{\mathrm{Arg}}$ $ \newcommand{\norm}[1]{\| #1 \|}$

$ \newcommand{\inner}[2]{\langle #1, #2 \rangle}$

$ \newcommand{\Span}{\mathrm{span}}$

$ \newcommand{\id}{\mathrm{id}}$

$ \newcommand{\Span}{\mathrm{span}}$

$ \newcommand{\kernel}{\mathrm{null}\,}$

$ \newcommand{\range}{\mathrm{range}\,}$

$ \newcommand{\RealPart}{\mathrm{Re}}$

$ \newcommand{\ImaginaryPart}{\mathrm{Im}}$

$ \newcommand{\Argument}{\mathrm{Arg}}$

$ \newcommand{\norm}[1]{\| #1 \|}$

$ \newcommand{\inner}[2]{\langle #1, #2 \rangle}$

$ \newcommand{\Span}{\mathrm{span}}$ $ \newcommand{\AA}{\unicode[.8,0]{x212B}}$

$ \newcommand{\vectorA}[1]{\vec{#1}} % arrow$

$ \newcommand{\vectorAt}[1]{\vec{\text{#1}}} % arrow$

$ \newcommand{\vectorB}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } $

$ \newcommand{\vectorC}[1]{\textbf{#1}} $

$ \newcommand{\vectorD}[1]{\overrightarrow{#1}} $

$ \newcommand{\vectorDt}[1]{\overrightarrow{\text{#1}}} $

$ \newcommand{\vectE}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash{\mathbf {#1}}}} $

$ \newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} } $

$\newcommand{\longvect}{\overrightarrow}$

$ \newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}} $

$\newcommand{\ket}[1]{\left| #1 \right>}$
$\newcommand{\bra}[1]{\left< #1 \right|}$
$\newcommand{\braket}[2]{\left< #1 \vphantom{#2} \right| \left. #2 \vphantom{#1} \right>}$
$\newcommand{\braopket}[3]{\left< #1 \vphantom{#2}\vphantom{#3} \right| #2 \vphantom{#1}\vphantom{#3} \left| #3 \vphantom{#1}\vphantom{#2} \right>}$
$\newcommand{\qmvec}[1]{\mathbf{\vec{#1}}}$
$\newcommand{\op}[1]{\hat{\mathbf{#1}}}$
$\newcommand{\expect}[1]{\langle #1 \rangle}$
$\newcommand{\dfn}[1]{\emph{\textbf{#1}}}$

$\newcommand{\avec}{\mathbf a}$ $\newcommand{\bvec}{\mathbf b}$ $\newcommand{\cvec}{\mathbf c}$ $\newcommand{\dvec}{\mathbf d}$ $\newcommand{\dtil}{\widetilde{\mathbf d}}$ $\newcommand{\evec}{\mathbf e}$ $\newcommand{\fvec}{\mathbf f}$ $\newcommand{\nvec}{\mathbf n}$ $\newcommand{\pvec}{\mathbf p}$ $\newcommand{\qvec}{\mathbf q}$ $\newcommand{\svec}{\mathbf s}$ $\newcommand{\tvec}{\mathbf t}$ $\newcommand{\uvec}{\mathbf u}$ $\newcommand{\vvec}{\mathbf v}$ $\newcommand{\wvec}{\mathbf w}$ $\newcommand{\xvec}{\mathbf x}$ $\newcommand{\yvec}{\mathbf y}$ $\newcommand{\zvec}{\mathbf z}$ $\newcommand{\rvec}{\mathbf r}$ $\newcommand{\mvec}{\mathbf m}$ $\newcommand{\zerovec}{\mathbf 0}$ $\newcommand{\onevec}{\mathbf 1}$ $\newcommand{\real}{\mathbb R}$ $\newcommand{\twovec}[2]{\left[\begin{array}{r}#1 \\ #2 \end{array}\right]}$ $\newcommand{\ctwovec}[2]{\left[\begin{array}{c}#1 \\ #2 \end{array}\right]}$ $\newcommand{\threevec}[3]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \end{array}\right]}$ $\newcommand{\cthreevec}[3]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \end{array}\right]}$ $\newcommand{\fourvec}[4]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}$ $\newcommand{\cfourvec}[4]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \end{array}\right]}$ $\newcommand{\fivevec}[5]{\left[\begin{array}{r}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}$ $\newcommand{\cfivevec}[5]{\left[\begin{array}{c}#1 \\ #2 \\ #3 \\ #4 \\ #5 \\ \end{array}\right]}$ $\newcommand{\mattwo}[4]{\left[\begin{array}{rr}#1 \amp #2 \\ #3 \amp #4 \\ \end{array}\right]}$ $\newcommand{\laspan}[1]{\text{Span}\{#1\}}$ $\newcommand{\bcal}{\cal B}$ $\newcommand{\ccal}{\cal C}$ $\newcommand{\scal}{\cal S}$ $\newcommand{\wcal}{\cal W}$ $\newcommand{\ecal}{\cal E}$ $\newcommand{\coords}[2]{\left\{#1\right\}_{#2}}$ $\newcommand{\gray}[1]{\color{gray}{#1}}$ $\newcommand{\lgray}[1]{\color{lightgray}{#1}}$ $\newcommand{\rank}{\operatorname{rank}}$ $\newcommand{\row}{\text{Row}}$ $\newcommand{\col}{\text{Col}}$ $\renewcommand{\row}{\text{Row}}$ $\newcommand{\nul}{\text{Nul}}$ $\newcommand{\var}{\text{Var}}$ $\newcommand{\corr}{\text{corr}}$ $\newcommand{\len}[1]{\left|#1\right|}$ $\newcommand{\bbar}{\overline{\bvec}}$ $\newcommand{\bhat}{\widehat{\bvec}}$ $\newcommand{\bperp}{\bvec^\perp}$ $\newcommand{\xhat}{\widehat{\xvec}}$ $\newcommand{\vhat}{\widehat{\vvec}}$ $\newcommand{\uhat}{\widehat{\uvec}}$ $\newcommand{\what}{\widehat{\wvec}}$ $\newcommand{\Sighat}{\widehat{\Sigma}}$ $\newcommand{\lt}{<}$ $\newcommand{\gt}{>}$ $\newcommand{\amp}{&}$ $\definecolor{fillinmathshade}{gray}{0.9}$

Accountability The principle that requires an organization to assign clear authority and responsibility for managing information assets, including oversight and consequences for non-compliance (ARMA Principles 2025). See Chapter 3.

AI Governance The framework for ethical, transparent, and compliant use of artificial intelligence systems, including bias mitigation, transparency logs, and human oversight (NIST AI RMF 2025). See Chapter 6 and Chapter 9.

Auto-Classification The use of AI and machine learning to automatically assign records to classes, sensitivity labels, or retention rules based on content analysis. See Chapter 8.

Bias Mitigation Processes to identify and reduce bias in training data and AI model outputs. See Chapter 3 and Chapter 10.

CCPA/CPRA California Consumer Privacy Act and its amendments granting consumers rights to access, delete, correct, and opt-out of sale of personal data.

Change Healthcare Ransomware Attack (2025) Major U.S. healthcare breach where attackers exploited remote access without MFA, stole 6 TB of data affecting 192 million people, and caused $2.3 billion in recovery costs. See Chapter 4.

Compliance Alignment with all applicable laws, regulations, standards, contracts, and ethical obligations (ARMA Principles). See Chapter 3.

Data Classification Assigning sensitivity levels (Public, Internal, Confidential, Restricted) to information for appropriate handling and protection. See Chapter 6 and Chapter 8.

Data Governance The subset of IG focused on data quality, usability, integrity, security, and lineage for analytics and AI (DAMA-DMBOK). See Chapter 2.

Defensible Disposition Secure deletion of information after its retention period with documented proof of compliance for legal or audit purposes. See Chapter 8.

Disposition The final stage of the records lifecycle involving destruction, transfer, or archiving when no longer needed (ISO 15489). See Chapter 8.

E-Discovery The process of identifying, preserving, collecting, processing, reviewing, and producing electronically stored information for litigation or investigation. See Chapter 7.

EU AI Act European Union regulation (full enforcement 2026) classifying AI systems by risk level and imposing mandatory requirements for high-risk systems (risk management, data governance, transparency, human oversight, accuracy, robustness, cybersecurity). Fines up to €35 million or 7% of global revenue. See Chapter 4 and Chapter 6.

GenAI Governance Rules governing the ethical, compliant, and secure use of generative AI tools, including prompt logging, output watermarking, and acceptable use policies. See Chapter 6 and Chapter 9.

IG Maturity Model A tool (ARMA, Gartner, DGI) to assess current IG capabilities on a 1–5 scale and plan improvements. See Chapter 5.

Incident Response The organized approach to addressing and managing security breaches or policy violations. See Chapter 4.

Information Governance (IG) The enterprise-wide framework of policies, processes, roles, standards, technologies, and metrics that ensures information is managed responsibly throughout its lifecycle (ARMA Principles). See Chapter 1 and Chapter 2.

Integrity Ensuring information remains accurate, authentic, reliable, and unaltered except by authorized processes (ARMA Principles). See Chapter 3.

IT Governance The subset of corporate governance focused on ensuring IT supports business strategy, manages risks, and optimizes resources (COBIT, ISO/IEC 38500). See Chapter 2.

Legal Hold A process that suspends normal disposition of records when litigation or investigation is reasonably anticipated. See Chapter 7.

NIST SP 800-30 Guide for Conducting Risk Assessments. See Chapter 4.

Post-Quantum Cryptography Quantum-resistant encryption algorithms (NIST PQC standards) to protect against future quantum attacks. See Chapter 9 and Chapter 10.

Privacy by Design Embedding privacy protections from the start of system development (data minimization, consent, etc.). See Chapter 10.

Records and Information Management (RIM) Operational management of records throughout their lifecycle (ISO 15489). See Chapter 8.

Retention Schedule Document specifying how long records must be kept based on legal, business, or operational needs. See Chapter 8.

Risk Appetite The amount and type of risk an organization is willing to accept to achieve objectives. See Chapter 4.

Risk Matrix Tool mapping likelihood and impact to prioritize risks (3x3 or 5x5). See Chapter 4.

Zero-Trust Architecture Security model that verifies every access request regardless of location or user (NIST). See Chapter 10.

(Full glossary contains 160+ terms extracted from the book with short definitions and chapter cross-references.)

Appendix A: Templates and Checklists

Sample IG Policy Template (Data Classification Policy) Purpose: To ensure all information is classified according to sensitivity and handled appropriately. Scope: All employees, contractors, and systems. Definitions: Public, Internal, Confidential, Restricted. Responsibilities: Data owners classify; employees follow handling rules. Rules: Restricted data requires encryption and restricted sharing. Exceptions: Approved by CIGO. Enforcement: Audits and disciplinary action. Revision Date: Annual.

Legal Hold Checklist

Identify custodians and data sources
Issue hold notice
Suspend disposition
Monitor compliance
Document hold scope and duration
Release hold when no longer needed

Risk Matrix Blank (5x5)

Likelihood \ Impact	1	2	3	4	5
5	5	10	15	20	25
4	4	8	12	16	20
3	3	6	9	12	15
2	2	4	6	8	10
1	1	2	3	4	5

Tools List

Microsoft Purview (classification, retention, e-discovery)
Relativity (e-discovery)
OneTrust (privacy management)
OpenText (intelligent capture)
NIST AI RMF Playbook

Appendix B: Tools and Resources

IBM Cost of a Data Breach Report 2025
NIST SP 800-30 Guide
EU AI Act Official Text
ARMA IG Maturity Model 2025
Gartner IG Maturity Model 2025

Case Studies Library (14 distinct real-world and hypothetical cases extracted directly from the PDF)

1. Healthcare Provider Using GenAI for Patient Summaries (Chapter 3) A large hospital deployed GenAI to summarize patient records. Full application of all 7 ARMA Principles (accountability through disposition) resulted in reduced physician burnout, improved compliance, and zero fines.

2. Financial Institution Using GenAI for Risk Assessment (Chapter 3) A bank used GenAI for credit-risk models. Proper accountability, transparency, integrity, protection, compliance, availability, and disposition produced improved accuracy, regulatory approval, and fewer bias complaints.

3. Change Healthcare Ransomware Attack (2025) (Chapter 4) Attackers exploited remote access without MFA, stole 6 TB of data affecting 192 million people, and caused $2.3 billion in recovery costs. Exposed failures in MFA, detection, legacy systems, and third-party oversight.

4. AI Model Bias in a Financial Institution (Hypothetical 2026) (Chapter 4) Biased loan-approval model led to EU AI Act fines. Highlighted need for high-quality training data, bias detection, and human review.

5. Third-Party Vendor Breach in Retail (Hypothetical 2026) (Chapter 4) Loyalty-program vendor compromise exposed customer data. Demonstrated importance of vendor security assessments and contractual controls.

6. Cloud Misconfiguration in a Government Agency (Hypothetical 2026) (Chapter 4) Exposed sensitive documents due to inconsistent cloud settings. Led to new policies, training, and automated scanning.

7. E-Discovery Failure Due to Unmanaged Collaboration Data (Chapter 7) Teams chats were missed during litigation hold; messages were auto-deleted. Fix: Include collaboration tools in hold scoping and use technical holds.

8. Legal Hold Success with Measurable Compliance (Chapter 7) Bank used targeted holds, questionnaires, and a central dashboard with escalation. Achieved full audit compliance.

9. AI-Generated Evidence and Chain-of-Custody Dispute (Chapter 7) AI-assisted memo challenged for hallucinations and missing provenance. Fix: Preserve prompts, model versions, and require documented human review.

10. TAR Success and Defensibility Challenge (Chapter 7) Active Learning reduced review volume but was challenged on defensibility. Fix: Document protocol, keep settings, perform validation/elusion testing.

11. AI System Privacy Failure (Hypothetical) (Chapter 10) GenAI customer-service assistant leaked personal data via inference. Root causes: unmasked training data, no differential privacy. Fix: DP training, curation, and pre-deployment audits.

12. Zero-Trust Implementation Success (Realistic) (Chapter 10) Healthcare provider segmented EHR, enforced MFA and continuous checks. Blocked lateral movement in a phishing attack; auditors praised evidence readiness.

13. Global Compliance Challenge (Multinational SaaS) (Chapter 10) SaaS provider faced GDPR, LGPD, DPDP, PIPL, and SCC gaps. Solved with encryption, DPO registration, and unified IG framework.

14. HIPAA NPP Update Failure (2025–2026) (Chapter 10) Health plan missed 42 CFR Part 2 updates in Notice of Privacy Practices. Led to OCR corrective action plan and redistribution.

Search

Text Color

Text Size

Margin Size

Font Type