My CIO Coach glossary

This glossary explains the roles, credentials, management terms and governance frameworks that come up most often on the path to IT leadership. Definitions are written in plain English and checked against official sources such as NIST, CISA, the SEC, the Bureau of Labor Statistics and the bodies that issue each certification. Use it alongside our guides on becoming a CIO, building IT leadership skills, and technology strategy and governance.

AI Governance: The policies, roles, oversight and controls an organization uses to make sure its use of artificial intelligence is lawful, safe, fair and aligned with its goals. It typically covers approved uses, data handling, testing, human review and monitoring after deployment.; Related:NIST AI Risk Management Framework (AI RMF)Data Governance IT Governance
BATNA: Best Alternative to a Negotiated Agreement: what you will do if the current negotiation fails, such as staying with an existing supplier or choosing a competitor. Knowing your BATNA, and estimating the other side's, tells you when to walk away and strengthens your position.; Related:Vendor Management Request for Proposal (RFP)
Board Reporting: The regular briefing of a board of directors, or its audit or risk committee, on technology performance, major projects, risks and cybersecurity. Effective board reporting translates technical detail into business impact, risk exposure and decisions the board needs to make.; Related:Risk Appetite SEC Cybersecurity Disclosure Rules Key Performance Indicator (KPI)
Business Continuity: An organization's ability to keep delivering critical products and services during and after a disruption. Business continuity planning identifies critical processes, their dependencies and how they will continue, while disaster recovery focuses on restoring the technology.; Related:Disaster Recovery (DR)Recovery Time Objective (RTO)Incident Response Plan
Capital Expenditure (CapEx): Spending on long-lived assets, such as hardware, facilities or qualifying software development, that is recorded on the balance sheet and expensed over time through depreciation or amortization. Exact rules on what can be capitalized come from the applicable accounting standards and the organization's finance policies.; Related:Operating Expenditure (OpEx)IT Budget Total Cost of Ownership (TCO)
Change Management: In IT operations, the process of assessing, approving and scheduling changes to systems to reduce the risk of disruption; ITIL 4 calls this practice change enablement. The same term is also used for organizational change management, which helps people adopt new ways of working.; Related:IT Service Management (ITSM)Digital Transformation
Chief Data Officer (CDO): An executive responsible for how an organization governs, manages and gets value from its data, including data quality, data governance policies and analytics. The CDO abbreviation is also used for chief digital officer, a separate role focused on digital products and transformation, so it is worth checking which one a job posting means.; Related:Data Governance AI Governance Chief Information Officer (CIO)
Chief Information Officer (CIO): The senior executive responsible for an organization's information technology, including its strategy, budget, systems, staff and service delivery. The U.S. Bureau of Labor Statistics counts CIOs among computer and information systems managers, who "plan, coordinate, and direct computer-related activities in an organization," and its Occupational Outlook Handbook is a common official source for pay and job outlook.; Related:Chief Technology Officer (CTO)Chief Information Security Officer (CISO)IT Strategy
Chief Information Security Officer (CISO): The executive accountable for an organization's information security and cybersecurity program, including risk management, security operations, incident response and reporting to leadership and the board. The CISO may report to the CIO, the CEO, or another executive depending on the organization.; Related:Chief Information Officer (CIO)Cybersecurity Risk Management CISM
Chief Technology Officer (CTO): An executive who leads an organization's technology direction, often focusing on engineering, product technology and emerging technologies. In some organizations the CTO looks outward at products and customers while the CIO looks inward at business systems; in others the two roles are combined.; Related:Chief Information Officer (CIO)Enterprise Architecture
CIRCIA: The Cyber Incident Reporting for Critical Infrastructure Act of 2022, a U.S. law directing CISA to require covered critical infrastructure entities to report covered cyber incidents and ransom payments. The law sets reporting windows of 72 hours for covered incidents and 24 hours for ransom payments, but reporting is not required until CISA's final rule takes effect; as of October 2026, CISA had proposed the rule but not yet issued it in final form.; Related:Incident Response Ransomware SEC Cybersecurity Disclosure Rules
CISM: Certified Information Security Manager, a credential issued by ISACA for people who manage, design and oversee information security programs. Its four domains are information security governance, information security risk management, information security program, and incident management, and certification requires at least five years of information security management work experience across at least three of the four domains, gained within the 10 years before applying.; Related:CISSP COBIT Chief Information Security Officer (CISO)
CISSP: Certified Information Systems Security Professional, a security credential issued by ISC2. Candidates need a minimum of five years of cumulative, full-time paid work experience in two or more of the eight domains of the CISSP exam outline; a qualifying degree or approved credential can substitute for one year, and those who pass the exam without enough experience can become an Associate of ISC2 while they earn it.; Related:CISM Chief Information Security Officer (CISO)
Cloud Computing: NIST Special Publication 800-145 defines cloud computing as "a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources" that can be rapidly provisioned and released with minimal management effort or service provider interaction. Common service models are software as a service, platform as a service and infrastructure as a service.; Related:Operating Expenditure (OpEx)Total Cost of Ownership (TCO)Zero Trust
COBIT: A framework from ISACA for the governance and management of enterprise information and technology. It separates governance objectives from management objectives and provides components, such as processes and organizational structures, for building a governance system tailored to the enterprise.; Related:IT Governance ISO/IEC 38500 CISM
Cybersecurity Risk Management: The ongoing process of identifying, assessing, prioritizing and responding to risks that cyber threats pose to an organization's operations, assets and people. Responses include reducing, transferring (for example through insurance), avoiding or accepting a risk within the organization's risk appetite.; Related:NIST Cybersecurity Framework (CSF) 2.0 Risk Appetite Third-Party Risk Management
Data Governance: The framework of policies, roles, standards and processes that determines how an organization's data is defined, owned, protected, shared and kept accurate. It assigns accountability for data and supports privacy, security and reliable reporting.; Related:Chief Data Officer (CDO)AI Governance
Digital Transformation: The use of digital technology to substantially change how an organization operates, serves customers or creates value, rather than simply automating existing processes. Successful programs usually involve changes to processes, skills and culture as well as technology.; Related:IT Strategy Run-Grow-Transform Technical Debt
Disaster Recovery (DR): The plans, processes and technology used to restore IT systems and data after a major outage, cyberattack or disaster. DR plans are usually designed around recovery time and recovery point objectives and should be tested regularly.; Related:Business Continuity Recovery Time Objective (RTO)Recovery Point Objective (RPO)
Enterprise Architecture: The practice of describing and planning how an organization's business processes, information, applications and technology fit together, now and in a target future state. It helps leaders reduce duplication, manage complexity and guide investment decisions.; Related:Technology Roadmap Technical Debt IT Strategy
Incident Response: The organized approach to preparing for, detecting, containing, eradicating and recovering from cybersecurity incidents, and learning from them afterward. NIST SP 800-61 Revision 3 (April 2025) frames incident response as part of overall cybersecurity risk management using CSF 2.0.; Related:Incident Response Plan NIST Cybersecurity Framework (CSF) 2.0 Tabletop Exercise
Incident Response Plan: A documented plan that sets out roles, decision authority, communication paths and steps for handling a cybersecurity incident. It should cover who to notify internally and externally, including regulators, insurers and law enforcement where required.; Related:Incident Response Tabletop Exercise Business Continuity
ISO/IEC 38500: An international standard that gives guiding principles to boards and governing bodies on the effective, efficient and acceptable use of IT in their organizations. The current edition, ISO/IEC 38500:2024, applies to public and private organizations of all sizes.; Related:IT Governance COBIT Board Reporting
IT Budget: The planned spending on technology for a period, usually a fiscal year, covering staff, hardware, software, cloud services, contractors and projects. IT budgets are commonly split into capital and operating spending and into running existing services versus funding change.; Related:Capital Expenditure (CapEx)Operating Expenditure (OpEx)Run-Grow-Transform
IT Governance: The system by which an organization's use of IT is directed and controlled, so that technology supports objectives, delivers value and manages risk. Governance sets direction and oversight, while management plans and runs the day-to-day work.; Related:COBIT ISO/IEC 38500 IT Steering Committee
IT Portfolio Management: Managing an organization's technology projects, applications and investments as a single portfolio, so that funding goes to the work that best supports strategy within available capacity. It includes prioritizing, balancing risk and retiring low-value items.; Related:Return on Investment (ROI)Technology Roadmap IT Steering Committee
IT Service Management (ITSM): The activities an organization uses to design, deliver, manage and improve the IT services it provides to users. Common ITSM practices include incident management, change enablement, service request management and service level management.; Related:ITIL 4 Service Level Agreement (SLA)Change Management
IT Steering Committee: A group of senior business and IT leaders that sets technology priorities, approves major investments and oversees progress. It gives the business a formal voice in IT decisions and is a common part of IT governance.; Related:IT Governance IT Portfolio Management
IT Strategy: A plan that sets out how technology will support and shape an organization's goals over the next several years, including priorities, investments, capabilities and the operating model for IT. It is typically turned into a roadmap of initiatives and reviewed as business needs change.; Related:Technology Roadmap IT Governance Digital Transformation
ITIL: A widely used framework of good practice for IT service management, describing how to plan, deliver, support and improve IT services. The current release is ITIL (Version 5), and certifications start at the Foundation level; many practitioners still hold ITIL 4 credentials.; Related:ITIL 4 IT Service Management (ITSM)Service Level Agreement (SLA)
ITIL 4: The fourth version of the ITIL framework, since succeeded by ITIL (Version 5) but still widely held as a certification. It is built around a service value system that describes how an organization's components and activities work together to co-create value. Its elements include guiding principles, governance, a service value chain, practices and continual improvement.; Related:ITIL IT Service Management (ITSM)Service Level Agreement (SLA)
Key Performance Indicator (KPI): A metric chosen to show how well an organization, team or service is performing against an important goal. Good IT KPIs connect to business outcomes, such as service availability, project delivery or cost per user, rather than just activity counts.; Related:Service Level Objective (SLO)Board Reporting
Materiality: In securities disclosure, whether information is important enough that a reasonable investor would consider it significant to an investment decision. Under the SEC's cybersecurity rules, the four-business-day clock for an incident disclosure starts when the company determines the incident is material, which it must do without unreasonable delay.; Related:SEC Cybersecurity Disclosure Rules Board Reporting
NIST AI Risk Management Framework (AI RMF): Voluntary guidance from NIST, released as version 1.0 in January 2023, to help organizations manage risks from designing, developing, deploying and using artificial intelligence systems. Its core is organized into four functions, Govern, Map, Measure and Manage, and NIST added a Generative AI Profile (NIST AI 600-1) in July 2024.; Related:NIST Cybersecurity Framework (CSF) 2.0 AI Governance Risk Appetite
NIST Cybersecurity Framework (CSF) 2.0: Voluntary guidance from the U.S. National Institute of Standards and Technology to help organizations of any size understand, assess, prioritize and communicate their cybersecurity risks. Released in 2024, version 2.0 organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover, with Govern newly added.; Related:Cybersecurity Risk Management Incident Response NIST AI Risk Management Framework (AI RMF)
Operating Expenditure (OpEx): Ongoing spending on day-to-day operations, such as salaries, subscriptions, maintenance and most cloud services, that is expensed in the period it is incurred. The move to subscription and cloud services has shifted much IT spending from CapEx to OpEx.; Related:Capital Expenditure (CapEx)IT Budget Cloud Computing
PMP: Project Management Professional, a project management certification issued by the Project Management Institute. Eligibility combines a set amount of experience leading projects, which depends on the candidate's level of education, with formal project management training, followed by an exam.; Related:IT Portfolio Management ITIL
Ransomware: Malicious software that encrypts or steals an organization's data and demands payment for its release or to prevent publication. CISA and its partners advise maintaining offline, tested backups and an incident response plan as core defenses.; Related:Incident Response Disaster Recovery (DR)Tabletop Exercise
Recovery Point Objective (RPO): The maximum amount of data, measured as a span of time, that an organization can accept losing after a disruption. An RPO of one hour, for example, means backups or replication must capture data at least hourly.; Related:Recovery Time Objective (RTO)Disaster Recovery (DR)
Recovery Time Objective (RTO): The target maximum time a system or process can be unavailable after a disruption before the impact becomes unacceptable. Shorter RTOs usually require more investment in redundancy and recovery capability.; Related:Recovery Point Objective (RPO)Disaster Recovery (DR)
Request for Proposal (RFP): A formal document an organization issues to invite suppliers to propose how they would meet a defined need, and at what price. RFPs set out requirements and evaluation criteria so that responses can be compared consistently.; Related:Vendor Management BATNA Total Cost of Ownership (TCO)
Return on Investment (ROI): A measure of the benefit an investment produces relative to its cost, usually shown as a percentage. For IT projects, benefits may include cost savings, revenue, reduced risk or time saved, and should be estimated with clear assumptions.; Related:Total Cost of Ownership (TCO)IT Portfolio Management
Risk Appetite: The amount and type of risk an organization is willing to accept in pursuit of its objectives, typically set by senior leadership and the board. A clear risk appetite helps IT and security leaders decide which risks to fix, accept or escalate.; Related:Cybersecurity Risk Management Board Reporting
Run-Grow-Transform: A common way to classify IT spending into running the business (keeping existing services operating), growing the business (improving or expanding current capabilities), and transforming the business (new capabilities or business models). It helps leaders show how much of the budget goes to change versus maintenance.; Related:IT Budget Digital Transformation
SEC Cybersecurity Disclosure Rules: Rules adopted by the U.S. Securities and Exchange Commission in July 2023 for public companies. A material cybersecurity incident must be disclosed under Form 8-K Item 1.05, which is generally due "four business days after a registrant determines that a cybersecurity incident is material," and annual reports must describe cybersecurity risk management, strategy and governance under Regulation S-K Item 106.; Related:Materiality Board Reporting Incident Response
Service Level Agreement (SLA): An agreement between a service provider and a customer that defines the service to be delivered and the measurable levels it must meet, such as availability, response time or resolution time. SLAs with external suppliers often include remedies, such as service credits, when targets are missed.; Related:Service Level Objective (SLO)Vendor Management IT Service Management (ITSM)
Service Level Objective (SLO): A specific, measurable target for one aspect of a service, such as 99.9% monthly availability. SLOs are the individual targets that an SLA is built from, and teams also use them internally without a formal agreement.; Related:Service Level Agreement (SLA)Key Performance Indicator (KPI)
Tabletop Exercise: A discussion-based exercise in which leaders and staff walk through a realistic scenario, such as a ransomware attack, to test plans and decision-making without touching live systems. CISA publishes free tabletop exercise packages that organizations can adapt.; Related:Incident Response Plan Ransomware Business Continuity
Technical Debt: The future cost of rework created when quicker or easier technology choices are made now instead of better long-term ones, such as postponed upgrades, shortcuts in code or aging systems. Like financial debt, it accrues interest in the form of slower change, higher maintenance costs and greater risk until it is paid down. Aging legacy systems that are hard to change or no longer supported are a common source.; Related:Enterprise Architecture Technology Roadmap
Technology Roadmap: A time-based plan showing which technology initiatives, upgrades and retirements will happen and in what order. It turns the IT strategy into a sequence of work that stakeholders can follow and fund.; Related:IT Strategy IT Portfolio Management Enterprise Architecture
Third-Party Risk Management: Identifying and managing the risks that come from suppliers, service providers and other outside parties with access to an organization's systems, data or operations. NIST CSF 2.0 addresses this under cybersecurity supply chain risk management in its Govern function.; Related:Vendor Management Cybersecurity Risk Management NIST Cybersecurity Framework (CSF) 2.0
Total Cost of Ownership (TCO): The full cost of a technology over its life, including purchase or subscription, implementation, integration, training, support, staffing, upgrades and eventual retirement. Comparing TCO rather than price alone gives a fairer picture when choosing between options.; Related:Return on Investment (ROI)Capital Expenditure (CapEx)Request for Proposal (RFP)
Vendor Management: The practice of selecting, contracting with, monitoring and managing relationships with outside suppliers of technology products and services. It covers performance against agreed service levels, cost control, risk and renewal decisions.; Related:Service Level Agreement (SLA)Third-Party Risk Management Request for Proposal (RFP)
Zero Trust: A security approach that grants no implicit trust to users or devices based only on their network location or on who owns the device, and instead authenticates and authorizes each access request before a session is established. NIST SP 800-207 describes zero trust architecture for enterprises.; Related:Cybersecurity Risk Management Cloud Computing