Glossary

The terms, defined.

One term per page: a one-sentence definition, an extended definition, where it appears in Performance Data work, and related terms. Entity pages anchor the vocabulary of security assurance, infrastructure resilience, governance and growth performance.

A

AI Mode: AI Mode is Google’s conversational search experience in which the entire response is generated, follow-up questions are expected and sources are shown within and alongside the answer.
AI Overviews: AI Overviews are generated summaries that Google shows at the top of some search results pages, with cited sources, above the conventional results.
AI search: AI search is any search experience in which a generated answer, rather than a list of results, is the primary response to a query.
Answer engine: An answer engine is a system that responds to a question with a generated answer, citing or naming the sources it drew on, rather than with a ranked list of links.
Assurance: Assurance is independent, evidence-based confirmation that a control, system or program exists and operates as claimed.
Audit readiness: Audit readiness is the state in which an organization’s controls, documentation and evidence are organized so that an auditor or assessor can examine them without delay or surprise.
Authority content: Authority content is a program of pages, each answering one defined question from a named expert’s knowledge, verified against sources, signed, dated and refreshed on a schedule.

B

Backup validation: Backup validation is the regular, documented restoration of data and systems from backup copies to confirm they are complete, usable and recoverable within the required time.
Business continuity: Business continuity is the discipline of keeping an organization’s critical processes operating during a disruption, through planned workarounds, alternate resources and defined decision authority, while technology is restored.

C

Canonical URL: A canonical URL is the single address an organization declares as the authoritative version of a page, so that engines consolidate signals there rather than across duplicates.
Citation: A citation is an explicit reference by an answer engine to a specific page as a source for part of its answer, usually shown as a link.
ClaudeBot: ClaudeBot is the web crawler Anthropic uses to collect content for its Claude models, identified by its user agent and governed by robots.txt.
Click-through rate: Click-through rate is the proportion of people who click a link, advertisement or result after seeing it.
CMMC: The Cybersecurity Maturity Model Certification is the US Department of Defense program that verifies contractors protect Federal Contract Information and Controlled Unclassified Information at the level their contracts require.
Control: A control is a measure, technical, procedural or physical, put in place to reduce a specific risk to an acceptable level.
Control validation: Control validation is the testing of a security control under realistic conditions to confirm it operates as designed and produces the intended effect.
Core Web Vitals: Core Web Vitals are three Google-defined measures of page experience: Largest Contentful Paint for loading, Interaction to Next Paint for responsiveness, and Cumulative Layout Shift for visual stability.
Cost per click: Cost per click is the amount an advertiser pays each time someone clicks a paid advertisement, set by auction among competing advertisers.
Cost per qualified inquiry: Cost per qualified inquiry is the spend, by source, divided by the number of inquiries from that source that the business would recognize as genuine prospects.
Crawl budget: Crawl budget is the number of pages a crawler will fetch from a site in a given period, determined by the site’s capacity to serve requests and the crawler’s assessment of what is worth fetching.
CUI: Controlled Unclassified Information is information the US federal government creates or possesses, or that a contractor handles on its behalf, that requires safeguarding under law, regulation or policy but is not classified.
Cumulative Layout Shift: Cumulative Layout Shift measures how much visible content moves unexpectedly during a page’s life, such as text jumping when an image or advertisement loads above it.

D

Data classification: Data classification is the assignment of sensitivity levels to information, such as public, internal, confidential and restricted, so that handling, access and protection rules can follow the level.
Data protection impact assessment: A data protection impact assessment is a structured analysis, performed before a new or changed use of personal data goes live, of the risks to the individuals concerned and the measures that reduce them.
DefinedTerm schema: DefinedTerm schema is structured data that marks a page as the definition of a specific term, placed within a DefinedTermSet that represents the glossary it belongs to.
Device posture: Device posture is the security state of a laptop, phone or server at the moment it requests access: whether it is managed, patched, encrypted, running endpoint protection and free of known compromise.
Digital PR: Digital PR is the placement of an organization’s expertise, research and commentary in third-party sources that engines and buyers already trust, such as trade press, associations, directories and podcasts.
Disaster recovery: Disaster recovery is the technology discipline of restoring systems and data after a disruption, in a defined order, from defined copies, within the time and data-loss limits the business has set.

E

Edge delivery: Edge delivery is serving a website from servers distributed around the world, close to each visitor, rather than from a single origin.
Endpoint protection: Endpoint protection is the set of controls on laptops, desktops, servers and mobile devices that prevent, detect and respond to malicious activity on the device itself.
Entity: An entity is a distinct thing, such as an organization, a person, a product or a place, that search and answer engines recognize, identify and connect facts to.
Evidence: Evidence is the record, artifact or observation that demonstrates a control existed and operated at a given time, in a form a third party can examine.
Evidence preservation: Evidence preservation is the handling of logs, images, communications and artifacts during an incident so that they remain complete, unaltered and admissible for investigation, insurance, regulatory and legal purposes.

F

FAQPage schema: FAQPage schema is structured data that marks a page’s questions and answers explicitly, so engines can read each pair as a unit.
Flat-fee media management: Flat-fee media management is paid advertising management for a fixed fee unrelated to the advertising budget, so the manager has no financial interest in increasing spend.

G

Gap assessment: A gap assessment is a structured comparison of an organization’s current controls and evidence against the requirements of a framework, standard or contract, producing a list of what is missing or deficient.
Generative engine optimization (GEO): Generative engine optimization is the practice of making an organization and its content retrievable, citable and accurately described by answer engines.
Google-Extended: Google-Extended is a robots.txt token that controls whether a site’s content may be used to train Google’s Gemini models; it does not affect crawling for Google Search or AI features in search.
GPTBot: GPTBot is the web crawler OpenAI uses to collect content that may be used to improve its models; a separate crawler, OAI-SearchBot, fetches pages for ChatGPT’s search results.

H

hreflang: hreflang is an HTML and sitemap annotation that tells search engines which language and regional version of a page serves which audience.

I

Identity and access management: Identity and access management is the discipline of establishing who a user or system is, what it is permitted to do, and enforcing and recording that across the organization’s systems.
Incident response: Incident response is the organized process of detecting, containing, investigating, eradicating and recovering from a security incident, and of meeting the notification obligations it triggers.
Independent assurance: Independent assurance is confirmation of controls or results by a party that had no role in designing, implementing or operating them and has no stake in the outcome.
Interaction to Next Paint: Interaction to Next Paint measures how quickly a page responds visually to user interactions such as taps and clicks, across the whole visit.
ISO/IEC 27001: ISO/IEC 27001 is the international standard for an information security management system, against which an accredited certification body audits an organization and issues a certificate.
ISO/IEC 42001: ISO/IEC 42001 is the international standard, published in 2023, for an artificial intelligence management system, against which an organization can be certified.

K

Knowledge graph: A knowledge graph is a structured database of entities and the relationships between them that search and answer engines use to understand who and what a query refers to.

L

Largest Contentful Paint: Largest Contentful Paint is the time from the start of page load until the largest visible content element, usually a heading, image or block of text, has rendered.
llms.txt: llms.txt is a plain-text file at the root of a website that describes the organization and lists its most important pages in a form intended for large language models and their crawlers.

M

Mention: A mention is an appearance of an organization’s name inside a generated answer without a linked citation to one of its pages.
MFA: Multi-factor authentication requires a user to present two or more independent proofs of identity, such as a password and a code from a device, before access is granted.

N

Network segmentation: Network segmentation divides a network into zones with controlled traffic between them, so that a compromise in one zone cannot spread freely to the others.
NIST AI RMF: The NIST AI Risk Management Framework is a voluntary framework, published in 2023, that organizes the management of AI risk into four functions: Govern, Map, Measure and Manage.
NIST CSF 2.0: The NIST Cybersecurity Framework version 2.0, published in 2024, is a voluntary framework that organizes a cybersecurity program into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
NIST SP 800-171: NIST Special Publication 800-171 specifies the security requirements for protecting Controlled Unclassified Information in non-federal systems and organizations.

O

Organization schema: Organization schema is the structured data block that identifies the organization behind a website, stating its name, legal name, address, founding date, founder, logo, areas of expertise and sameAs profiles.
Original research: Original research is a published study that produces data nobody else has, such as a survey, benchmark or log analysis, with its method stated so that others must attribute the finding to its source.

P

Penetration test: A penetration test is an authorized, time-boxed attempt by skilled testers to achieve defined objectives against a defined scope, reported as what was reached and how.
PerplexityBot: PerplexityBot is the crawler Perplexity uses to index pages for its answer engine, which cites sources on nearly every answer it gives.
Person schema: Person schema is the structured data block that identifies an individual, typically an author or leader, with their name, job title, employer, areas of expertise and sameAs profiles.
Phishing-resistant authentication: Phishing-resistant authentication uses credentials, such as FIDO2 security keys and passkeys, that are bound to the legitimate site and cannot be entered on a fake page or relayed through a proxy.
Privileged access management: Privileged access management is the control of accounts that can change systems, read everything or grant access to others, through vaulting, just-in-time elevation, session recording and review.
Prompt set: A prompt set is the defined, versioned collection of buyer questions against which an organization’s AI visibility is measured.

R

Ransomware readiness: Ransomware readiness is the demonstrated ability to prevent, detect, contain and recover from an attack that encrypts systems and demands payment, including recovery from isolated backups without paying.
Recovery time objective: A recovery time objective is the maximum time a system or process may be unavailable after a disruption before the consequence to the business becomes unacceptable.
Refresh cycle: A refresh cycle is the scheduled review of every published page at a defined interval, after which the page is confirmed current, revised with a new revision date, or retired.
Remediation: Remediation is the work of fixing an identified security finding so that the risk it represents is removed or reduced, and verifying that the fix holds.
Remote hands: Remote hands is the service by which on-site technicians at a data center or facility perform physical tasks, such as reboots, cable changes and hardware swaps, on behalf of an organization that is not present.
Render: To render a page is to execute its scripts and styles to produce the final content a user sees; a crawler that does not render sees only the HTML the server returned.
Retrieval-augmented generation: Retrieval-augmented generation is the method by which an answer engine fetches relevant documents at query time and composes its answer from them, rather than from its training data alone.
Risk acceptance: Risk acceptance is a documented decision by an accountable owner to live with an identified risk, for a stated period and with stated reasoning, rather than remediate it.

S

sameAs: sameAs is a schema.org property that links an entity on a web page to its profiles on other sites, declaring that they describe the same organization or person.
Schema markup: Schema markup is structured data added to a web page, using the vocabulary published at schema.org, that states what the page and its contents are in a form machines can read.
Secure enclave: A secure enclave is a defined, isolated environment within an organization’s systems in which sensitive workloads and data are processed under stricter controls than the rest of the estate.
Secure maintenance window: A secure maintenance window is a scheduled period for changes to systems or infrastructure, governed so that the access it opens, the monitoring it suspends and the configuration it alters are all restored and verified when it closes.
Secure remote access: Secure remote access is the controlled means by which staff, partners and vendors reach an organization’s systems from outside its premises, with identity, device and context verified and activity recorded.
Security posture: Security posture is the overall state of an organization’s security: the controls in place, how well they operate, the exposures that remain and the ability to detect and respond.
Share of voice (AI): AI share of voice is the percentage of answers, across a defined set of prompts and answer engines, in which a given organization is mentioned or cited.
SIEM: A security information and event management system collects logs and events from across an organization’s systems, correlates them and raises alerts for conditions that may indicate an attack.
SOC 2: SOC 2 is an attestation framework from the AICPA under which a CPA firm examines a service organization’s controls against the Trust Services Criteria and issues a confidential report.
Static site: A static site is a website generated in advance from content files by a build step and served as finished HTML, with no content management system, database or server-side application behind it.
Structured data: Structured data is information on a web page organized in a defined, machine-readable format, most commonly JSON-LD using the schema.org vocabulary.

T

Tabletop exercise: A tabletop exercise is a facilitated discussion in which the people who would respond to an incident walk through a realistic scenario, make the decisions they would make and discover where the plan breaks.
Technology due diligence: Technology due diligence is an independent examination of a company’s technology, security, data obligations, dependencies and technical debt, performed for a buyer, investor, lender or the company itself ahead of a transaction.
Third-party risk: Third-party risk is the exposure an organization carries through the vendors, partners and service providers that access its systems, hold its data or deliver its critical services.

V

Vendor security assessment: A vendor security assessment is an examination of a specific supplier’s security controls, in proportion to the consequence of its failure, using questionnaires, evidence review and where warranted independent testing.
Vulnerability management: Vulnerability management is the continuous process of discovering security weaknesses across an organization’s systems, prioritizing them by exposure, fixing them within defined timelines and verifying closure.

W

White-label delivery: White-label delivery is work performed by a partner under a provider’s own brand, in its formats and to an agreed standard, invisible to the client and bound not to compete for the relationship.

Z

Zero trust: Zero trust is a security model in which no user, device or connection is trusted by virtue of its location on the network; every request is evaluated on identity, device state and context before access is granted.
Zero-click search: A zero-click search is a query that ends without the user clicking any result, because the answer was satisfied on the results page or inside a generated answer.