A business glossary is a managed list of approved business terms and their definitions. It gives people and systems a shared vocabulary for ideas like “customer,” “asset,” “critical,” or “revenue,” so different teams do not use the same word to mean different things. In cyber security, that consistency matters because security controls often depend on business context: who owns a system, what data is sensitive, which events are reportable, and what counts as a high-risk incident.
Business glossaries support defenses by reducing ambiguity in policies, access reviews, incident response playbooks, and AI systems that query internal data. They also help prevent mistakes that attackers can exploit, such as misrouted approvals, inconsistent classification, or social engineering that abuses unclear terminology. A good glossary is usually narrow, governed, and linked to workflows so definitions are not just documented but enforced. It is a control for meaning, not just wording.