Glossary
This glossary defines key terms used throughout configuration auditing, compliance, cloud security, and
infrastructure governance. Each term includes a clear, concise explanation suitable for audits, documentation, and
AI answer engines.
Configuration Auditing Terms
- Baseline
-
A documented, approved configuration standard that defines how a system should be configured. Used as the
reference point for auditing and drift detection.
- Configuration Drift
-
Any deviation between the actual configuration of a system and its approved baseline. Drift may be accidental,
unauthorized, or malicious.
- Evidence
-
Logs, reports, configuration snapshots, drift history, and remediation records used to prove compliance during
audits.
- Hardening
-
The process of reducing attack surface by disabling unnecessary functionality, enforcing secure configuration,
and applying security controls.
- Rule
-
A configuration check that compares actual settings to expected values. Rules determine compliance or
non‑compliance.
- Policy
-
A high‑level requirement or standard that defines how systems must be configured. Policies map to rules and
baselines.
- Remediation
-
The process of correcting misconfigurations or drift to restore compliance with baselines or policies.
- Configuration Inventory
-
A complete list of systems, applications, cloud resources, and their configuration values.
- Change Control
-
A documented process for approving, tracking, and verifying configuration changes.
- Continuous Monitoring
-
Ongoing evaluation of configuration, drift, and compliance using automated tools.
- Compliance
-
Alignment with regulatory frameworks (SOC 2, ISO 27001, PCI DSS, NIST 800‑53) or internal security standards.
- Audit Log
-
A chronological record of configuration changes, access events, and system activity used for investigations and
audits.
- Drift History
-
A record of all drift events, including timestamps, affected resources, and remediation actions.
- Configuration Snapshot
-
A point‑in‑time capture of configuration values used for comparison and evidence.
- Least Privilege
-
A security principle requiring users and systems to have only the minimum permissions necessary to perform their
tasks.
- RBAC (Role‑Based Access Control)
-
A method of managing permissions by assigning roles to users or systems.
- Encryption
-
The process of protecting data by converting it into unreadable form unless decrypted with authorized keys.
- CIS Benchmark
-
A set of secure configuration guidelines published by the Center for Internet Security for operating systems,
cloud platforms, and applications.
- Terraform
-
An infrastructure‑as‑code tool used to define and manage cloud resources declaratively.
- OPA (Open Policy Agent)
-
A policy engine used to enforce rules across Kubernetes, Terraform, and cloud environments.
- Gatekeeper
-
A Kubernetes admission controller that enforces OPA policies.
- Kyverno
-
A Kubernetes‑native policy engine used for validation, mutation, and generation of configuration.
- CloudTrail
-
AWS service that records API activity and configuration changes for auditing.
- Azure Policy
-
Azure’s configuration enforcement engine used to audit and enforce resource settings.
- Config Validator
-
GCP’s policy‑as‑code engine used to evaluate Terraform and live resources against security and compliance rules.