Security+ Acronyms Cheat Sheet: 70 Terms Explained in Plain English
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Security+ uses acronyms constantly, and one unfamiliar abbreviation can sink a question. This cheat sheet groups about 70 common ones by theme, with the expansion and a plain-English meaning for each, and calls out the pairs that confuse people most. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
How to Use This Cheat Sheet
Security+ uses acronyms constantly, and a question can fail on one unfamiliar abbreviation. This sheet groups the common ones by theme with a plain-English meaning. These are our own study summaries of standard facts, not CompTIA's lists. The official CompTIA objectives document remains the authority for what is tested.
Identity and Access
| Acronym | Stands for | What it means |
|---|---|---|
| AAA | Authentication, Authorization, Accounting | Verify who you are, decide what you can do, record what you did |
| MFA | Multifactor authentication | Two or more different factors: something you know, have or are |
| SSO | Single sign-on | One login that gives access to several systems |
| SAML | Security Assertion Markup Language | XML standard for federated sign-in and single sign-on |
| OAuth | Open Authorization | Delegated access: an app gets limited access without the password |
| RBAC | Role-based access control | Access is granted by job role |
| ABAC | Attribute-based access control | Access depends on attributes such as department, device or time |
| DAC | Discretionary access control | The resource owner decides who gets access |
| MAC | Mandatory access control | A central policy with labels decides access, and users cannot change it |
| IAM | Identity and access management | The processes and tools that manage identities and their access |
| PAM | Privileged access management | Controls and records the use of powerful accounts |
| RADIUS | Remote Authentication Dial-In User Service | Central authentication for network access |
| TACACS+ | Terminal Access Controller Access-Control System Plus | Cisco-originated AAA protocol for device administration |
| LDAP | Lightweight Directory Access Protocol | Query and manage directory services |
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Cryptography and PKI
| Acronym | Stands for | What it means |
|---|---|---|
| AES | Advanced Encryption Standard | Widely used symmetric block cipher |
| RSA | Rivest, Shamir, Adleman | Asymmetric algorithm for encryption and signatures |
| ECC | Elliptic-curve cryptography | Asymmetric cryptography with smaller keys for similar strength |
| PKI | Public key infrastructure | CAs, certificates and processes that bind keys to identities |
| CA | Certificate authority | Issues and signs digital certificates |
| CRL | Certificate revocation list | List of certificates revoked before they expire |
| OCSP | Online Certificate Status Protocol | Real-time check of whether a certificate is revoked |
| CSR | Certificate signing request | Request sent to a CA to get a certificate |
| TLS | Transport Layer Security | Encrypts data in transit, such as HTTPS |
| HSM | Hardware security module | Tamper-resistant device that stores and uses keys |
| TPM | Trusted Platform Module | Chip that stores keys and supports measured boot and disk encryption |
| HMAC | Hash-based message authentication code | A keyed hash that proves integrity and authenticity |
| PFS | Perfect forward secrecy | Session keys are not exposed if a long-term key is compromised later |
Attacks, Vulnerabilities and Intelligence
| Acronym | Stands for | What it means |
|---|---|---|
| DoS, DDoS | Denial of service, distributed denial of service | Overwhelm a service so legitimate users cannot reach it |
| XSS | Cross-site scripting | Injecting script that runs in other users' browsers |
| SQLi | SQL injection | Injecting database commands through an input |
| CSRF | Cross-site request forgery | Tricking a logged-in user's browser into sending an unwanted request |
| SSRF | Server-side request forgery | Making a server send requests the attacker chooses |
| RCE | Remote code execution | Running attacker code on a remote system |
| APT | Advanced persistent threat | A skilled, well-funded actor with long-term access goals |
| IoC | Indicator of compromise | Evidence that a system may be compromised |
| OSINT | Open-source intelligence | Information gathered from public sources |
| CVE | Common Vulnerabilities and Exposures | Standard identifiers for publicly known vulnerabilities |
| CVSS | Common Vulnerability Scoring System | A 0 to 10 severity score for vulnerabilities |
Security Tools and Architecture
| Acronym | Stands for | What it means |
|---|---|---|
| IDS | Intrusion detection system | Detects suspicious activity and alerts |
| IPS | Intrusion prevention system | Detects and blocks suspicious activity inline |
| WAF | Web application firewall | Filters HTTP traffic to protect web apps |
| NGFW | Next-generation firewall | Firewall with application awareness and deeper inspection |
| SIEM | Security information and event management | Collects and correlates logs and alerts |
| SOAR | Security orchestration, automation and response | Automates response workflows |
| EDR | Endpoint detection and response | Monitors endpoints and supports investigation and response |
| XDR | Extended detection and response | EDR extended across endpoints, network, email and cloud |
| DLP | Data loss prevention | Detects and blocks sensitive data leaving the organization |
| CASB | Cloud access security broker | Enforces policy between users and cloud services |
| NAC | Network access control | Checks devices before allowing network access |
| MDM | Mobile device management | Manages and secures mobile devices |
| VPN | Virtual private network | Encrypted tunnel over an untrusted network |
| SASE | Secure access service edge | Cloud-delivered networking and security combined |
| ZTNA | Zero trust network access | Per-application access based on identity and context |
Governance, Risk, Recovery and Compliance
| Acronym | Stands for | What it means |
|---|---|---|
| BCP | Business continuity plan | Keeps critical operations running during a disruption |
| DRP | Disaster recovery plan | Restores IT systems after a disaster |
| BIA | Business impact analysis | Identifies critical functions and the impact of losing them |
| RTO | Recovery time objective | Maximum acceptable downtime |
| RPO | Recovery point objective | Maximum acceptable data loss, measured in time |
| MTTR | Mean time to repair | Average time to restore a failed system |
| MTBF | Mean time between failures | Average time a system runs between failures |
| SLE | Single loss expectancy | Asset value times exposure factor |
| ARO | Annualized rate of occurrence | How often a loss event is expected per year |
| ALE | Annualized loss expectancy | SLE times ARO |
| SLA | Service-level agreement | Contract that states the service level a provider must meet |
| AUP | Acceptable use policy | Rules for how people may use organizational systems |
| PII | Personally identifiable information | Data that can identify a person |
| GDPR | General Data Protection Regulation | EU privacy regulation |
| HIPAA | Health Insurance Portability and Accountability Act | US law protecting health information |
| PCI DSS | Payment Card Industry Data Security Standard | Security standard for payment card data |
| IR | Incident response | The process of handling a security incident |
Acronyms That Cause Confusion
Some abbreviations mean different things depending on context.
MAC
Mandatory access control in access control questions, and a media access control address in networking questions. Read the surrounding words.
IDS versus IPS
An IDS detects and alerts. An IPS sits inline and can block. The extra P is prevention.
RTO versus RPO
RTO is about time to recover and RPO is about how much data you can lose. Think T for time and P for point in time.
SLE, ARO and ALE
SLE times ARO equals ALE. A server worth $80,000 with a 40 percent exposure factor has an SLE of $32,000.
Turn Acronyms Into Flashcards
Reading a list does not make it stick. Make flashcards with the acronym on one side and the expansion plus meaning on the other, and review them over several days. DD Academy builds flashcards from the exam objectives with spaced review, free to start on iPhone and the web. See our objectives explained and practice questions for the concepts behind these terms.
The bottom line
Group acronyms by theme, learn the confusable pairs, and turn the list into flashcards you review over several days. Always check CompTIA's official acronym list in the objectives document for anything not covered here.
Frequently asked questions
How many acronyms do I need to know for Security+?
CompTIA publishes an acronym list as part of its objectives document, and it is long. You do not need to memorize every entry, but you should be comfortable with the common ones in each domain, like those in this cheat sheet.
What is the difference between IDS and IPS?
An intrusion detection system (IDS) detects suspicious activity and alerts, while an intrusion prevention system (IPS) sits inline and can also block it. Both can be network-based or host-based.
What does AAA stand for in security?
Authentication, authorization and accounting. Authentication verifies identity, authorization determines what an identity may do, and accounting records what it did.
What is the difference between RTO and RPO?
The recovery time objective (RTO) is the maximum acceptable downtime. The recovery point objective (RPO) is the maximum acceptable data loss, measured in time. RTO is about when service returns and RPO is about how much data you can lose.
What is the difference between SIEM and SOAR?
A SIEM collects and correlates logs and alerts to detect events. A SOAR orchestrates and automates the response, such as opening tickets or isolating a host. They are often used together.
How do I calculate ALE?
Annualized loss expectancy equals single loss expectancy times annualized rate of occurrence. Single loss expectancy is asset value times exposure factor. For example, an $80,000 asset with a 40 percent exposure factor has an SLE of $32,000, and if it is expected once every four years, the ARO is 0.25 and the ALE is $8,000.
Is this the official CompTIA acronym list?
No. It is our own selection of common acronyms with plain-English explanations. CompTIA's objectives document contains the official list, which you can download from its Security+ page.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
