Glossary¶
HodeiShield's own terms and the compliance acronyms used across this documentation, each with a link to the page that explains it. The definitions of the frameworks are indicative: the binding text is always the regulation itself.
HodeiShield terms¶
- ALE (annualised loss expectancy)
- A vendor's financial exposure expressed as expected loss in euros per year. It is calculated with the FAIR method. See Risk engine.
- Compliance engine
- Measures your posture against the frameworks you declare and maps controls across frameworks. See Compliance.
- Composite score
- A vendor's risk score, from 0 to 100 (lower is better), with its severity band and the findings that explain it.
- Criticality
- The level (critical, high, medium or low) assigned to each vendor. It multiplies its risk score and decides how often it is rescanned. See Core concepts.
- FAIR (Factor Analysis of Information Risk)
- A method to translate risk into a financial loss that can be compared across very different vendors. See Risk engine.
- HodeiAI
- The platform's AI assistant. See HodeiAI.
- MSSP (managed security service provider)
- An organisation that runs a portfolio of client tenants from a single console. It is an organisation type, not a licence plan. See the MSSP guide.
- Radar
- The tenant's threat watch: global intelligence filtered by your sector and matched against your real exposure through vendors and assets. See Radar.
- Risk engine
- Combines scan, questionnaire and CVE signals into a 0 to 100 score per vendor and into its financial exposure. See Risk engine.
- Systemic risk
- The risk concentrated in a fourth party that several critical vendors depend on. See Core concepts.
- Tenant
- A client organisation's isolated space within HodeiShield, with its own vendors, users and data.
- TPRM (third-party risk management)
- The discipline of assessing and monitoring the risk that vendors and other third parties introduce.
- Trust Center
- A public page where an organisation publishes its security posture. See Publish your Trust Center and the visitor guide.
Frameworks and regulations¶
- DORA
- EU regulation on digital operational resilience for the financial sector.
- ENS (Esquema Nacional de Seguridad, Spain's National Security Framework)
- Spanish information-security framework for the public sector and its suppliers (Royal Decree 311/2022).
- GDPR
- The EU General Data Protection Regulation (RGPD in Spanish).
- ISO/IEC 27001
- International standard for information security management systems.
- ISO/IEC 42001
- International standard for artificial intelligence management systems.
- NIS2
- EU directive on the cybersecurity of essential and important entities.
The frameworks the platform supports are listed in Compliance.