Cyber risk and DPDP glossary.

Attack surface management

Attack surface management is the continuous discovery and monitoring of everything an attacker could reach, such as domains, servers, open ports, cloud storage and exposed software, so that unnecessary exposure can be closed before it is exploited.

Breach corpus

A breach corpus is a collection of credentials and records exposed in past data breaches. Checking whether a domain’s email addresses appear in one shows which accounts may need password resets and multi-factor authentication.

Business email compromise

Business email compromise is fraud in which an attacker impersonates an executive, supplier or customer by email to redirect a payment or steal data. Enforcing DMARC and multi-factor authentication reduces the risk.

CERT-In

CERT-In, the Indian Computer Emergency Response Team, is India’s national agency for cyber-security incidents. Its 2022 directions require covered organisations to report specified cyber incidents within six hours of noticing them.

Consent Manager

A Consent Manager under the DPDP Act 2023 is a registered entity that lets a Data Principal give, manage, review and withdraw consent through one accessible platform. Its provisions commence after the main Act’s notification, under the phased DPDP Rules.

Content Security Policy (CSP)

A Content Security Policy is an HTTP response header that tells browsers which sources of scripts, styles, images and frames a page may load. A strict CSP limits the damage of cross-site scripting.

CVE

A CVE (Common Vulnerabilities and Exposures) is a public identifier, such as CVE-2024-12345, for a specific publicly disclosed software vulnerability. Matching the software versions a site exposes against CVEs shows how well it is patched.

Cyber insurance underwriting

Cyber insurance underwriting is the process by which an insurer assesses a business’s cyber risk to decide whether to offer cover and on what terms. It often combines a proposal form with an outside-in security scan.

Cyber risk score

A cyber risk score is a single number that summarises how exposed an organisation appears to cyber attack, normally built from observable evidence such as configuration, exposed services, leaked credentials and reputation.

CyberScore

The RiskPulse CyberScore is a 0–850 rating of a business’s externally visible cyber risk. It combines ten parallel checks, such as TLS, email authentication, open ports and breach exposure, into one comparable number with five bands from Critical to Excellent.

Dark-web monitoring

Dark-web monitoring watches hidden marketplaces and forums for a business’s domain, credentials or data being offered or discussed, so the business can respond before the exposure is abused.

Data Fiduciary

A Data Fiduciary under the DPDP Act 2023 is any person or organisation that alone or with others decides the purpose and means of processing personal data. Most businesses that collect customer or employee data are Data Fiduciaries.

Data Principal

A Data Principal under the DPDP Act 2023 is the individual to whom the personal data relates, such as a customer, employee or website visitor. For children and certain persons with disabilities, the term includes a parent or lawful guardian.

Data Protection Board of India

The Data Protection Board of India is the body established under the DPDP Act 2023 to hear complaints and personal data breach reports, to direct remedial action and to impose penalties.

DKIM

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email. Receiving servers check it against a public key published in the sender’s DNS to confirm the message came from an authorised source and was not altered.

DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that fails SPF and DKIM alignment (none, quarantine or reject) and where to send reports.

DPDP Act 2023

The Digital Personal Data Protection Act 2023 is India’s law governing the processing of digital personal data. It sets duties for Data Fiduciaries, rights for Data Principals and penalties of up to ₹250 crore, with phased commencement under the DPDP Rules 2025.

External attack surface

An external attack surface is every internet-facing asset and weakness an attacker can find without any access to the organisation, including domains, certificates, DNS records, exposed services and software versions.

Grievance redressal

Grievance redressal under the DPDP Act 2023 is the mechanism a Data Fiduciary must provide so that Data Principals can raise complaints about how their personal data is handled, together with published business contact details for privacy questions.

HSTS

HSTS (HTTP Strict Transport Security) is a response header that instructs browsers to use only HTTPS for a site for a stated period, preventing downgrade and cookie-hijacking attacks over plain HTTP.

Multi-factor authentication

Multi-factor authentication (MFA) requires two or more independent proofs of identity, such as a password and a one-time code, so a stolen password alone cannot open an account.

Open port

An open port is a network entry point on an internet-facing system that is accepting connections. Ports for databases and remote desktop should not be open to the public internet because they are common ransomware entry points.

Significant Data Fiduciary

A Significant Data Fiduciary is a Data Fiduciary the Central Government notifies based on factors such as the volume and sensitivity of personal data processed. It carries extra duties, including appointing an India-based Data Protection Officer and conducting audits.

SPF

SPF (Sender Policy Framework) is a DNS record that lists the mail servers authorised to send email for a domain, letting receivers detect messages sent from unauthorised servers.

TLS (SSL)

TLS (Transport Layer Security), commonly still called SSL, is the protocol that encrypts traffic between a browser and a website. A valid certificate and modern protocol versions (TLS 1.2 or 1.3) are baseline requirements.

For the DPDP terms, see the DPDP Act checklist for small businesses. For email terms, read SPF, DKIM and DMARC explained. For score terms, read what a cyber risk score is.