Glossary | CybrIQ

The method

Layer 1#: The physical layer of a network, where electrical signals travel across copper or fiber. The OSI model stacks six more on top: switching at Layer 2, IP routing at Layer 3, TCP at Layer 4, up to applications at Layer 7. Most security tools work at Layer 2 and above. Working at Layer 1 is how a device can be identified even when it disagrees with what it says about itself higher up.
Device DNA#: Our patent-pending signature for each connected device, derived from switch-side signals read with read-only access: link negotiation pattern, power draw and class, MAC OUI, LLDP and CDP announcements, port statistics, and the VLAN and topology context the switch already records. The signature does not depend on what the device says about itself, which is why it catches devices whose self-reported descriptors are wrong, spoofed or modified upstream.
Device fingerprint#: A signature derived from how a device behaves on the network, used to identify it. Behavioral fingerprinting reads behavior at higher layers. Layer 1 fingerprinting reads electrical behavior at the wire. The two are complementary.
Drift#: A change between the device previously known on a port and the device on it now. The codec was swapped, the port was repurposed, an unmanaged switch appeared, a contractor laptop showed up. Drift is found by comparing the current fingerprint to the prior one, and is surfaced as a discrete event somebody can act on.
Layer 1 record#: The continuously maintained, per-device, per-port output of the platform. Different scopes feed the same record: RoomIQ at room level, SpacesIQ across a building. The record is the fact base that the evidence pack, the drift events and the framework mappings all draw from.
Evidence pack#: The audit-defensible artifact: a per-device, per-port, dated record scoped to your environment and mapped in advance to the framework being audited. It is what you hand over.
Audit-defensible Layer 1 evidence#: A per-device, per-port, dated record of what was on the network and how its identity was verified, in a form an audit firm takes at face value. Different from operational status, which is the control system saying the room is green. An audit asks about the wire.
Working session#: A 30-minute scoped engagement: five minutes of scoping, twenty minutes running the platform against one of your environments, five minutes deciding. Whatever it produces stays with you either way.

The gap it closes

Visibility gap#: The space between what network access control, endpoint tooling and asset management can see, and what is on the network. Conference-room codecs, unmanaged switches, contractor gear, vendor-managed devices, sensors that ship without an agent. It is where audit findings come from.
Asset register#: The internal list of devices an organization believes it has. Built from procurement records, deployment tickets and biomedical inventories. Authoritative on day one and out of date by the next quarter, because the network changes faster than the spreadsheet does.
NAC#: Network Access Control. Tooling that decides which devices are allowed onto the network. It operates at Layer 2 and above and enforces admission policy there. It does not see Layer 1 behavior, which is why an unmanaged switch behind a single drop looks like one endpoint to it and four to us.
EDR#: Endpoint Detection and Response. An agent on managed endpoints such as laptops and servers. It sees what the agent sees, so devices that ship without an agent class are outside its coverage.
Agent#: Software installed on a device to monitor or manage it. Many security tools depend on one for their visibility. Codecs, sensors, biomedical gear and signage players usually cannot accept one. Nothing we ship requires an agent on a monitored endpoint.

Compliance frameworks

SOC 2#: An audit framework for service providers that store or process customer data, covering security, availability, processing integrity, confidentiality and privacy. A Type II report covers a sustained period, usually six to twelve months, and is the version enterprise buyers ask for. Layer 1 evidence maps to the CC6 logical access and CC7 system operations controls.
HIPAA#: The US regulation governing protected health information. Its Security Rule requires technical safeguards including access control, audit controls and integrity monitoring. The device-inventory and access-evidence layer is what the risk-analysis requirement increasingly assumes is present.
CMMC#: Cybersecurity Maturity Model Certification, a US Department of Defense framework for organizations handling Controlled Unclassified Information. Level 2, the most common requirement for federal contractors, maps to the NIST 800-171 control set. Continuous device inventory is required at Level 2 and above.
NIST 800-171#: A US federal control catalog for non-federal systems handling Controlled Unclassified Information, and the basis for CMMC Level 2. 110 controls across 14 families. The asset-management and configuration-management families require maintained inventories covering every device authorized to connect.
PCI DSS#: The Payment Card Industry Data Security Standard, required of any organization that stores, processes or transmits cardholder data. Version 4.0.1 added explicit requirements for asset-inventory completeness, continuous monitoring of in-scope systems, and network-device discovery.
ISO 27001#: The international standard for information security management systems. It defines a control framework and requires an asset register covering every information asset in scope. Often held alongside SOC 2 for global coverage.
SOX#: The Sarbanes-Oxley Act, which requires public companies to maintain internal controls over financial reporting. Section 404 audits review the IT general controls governing systems involved in that reporting, and access control and asset inventory are recurring deficiency categories.
GLBA#: The Gramm-Leach-Bliley Act, requiring financial institutions to protect customer financial information. Its Safeguards Rule, revised in 2023, requires a written security program, a designated qualified individual, and continuous monitoring of network assets.
NYDFS#: The New York Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500. Covered institutions must maintain accurate IT asset inventories recording owner, location, sensitivity, vendor-support expiration and recovery time objectives for every asset.
NDAA Section 889#: A US federal regulation prohibiting covered telecommunications equipment from named vendors in federal contractor environments. The products pick out covered equipment from its signals, so relabeling a device does not hide it.
FedRAMP#: The Federal Risk and Authorization Management Program, which standardizes security assessment for cloud services used by federal agencies. The six Cross products run only inside your environment. RoomIQ and SpacesIQ can run there too, instead of hosted by us, which is why most federal deployments do not need FedRAMP for them. We are not FedRAMP authorized.
OCR#: The Office for Civil Rights at the US Department of Health and Human Services, which enforces HIPAA and investigates healthcare breaches. Its closing letters increasingly cite asset-inventory and unmanaged-device findings as contributing factors.

Network terms

LLDP#: Link Layer Discovery Protocol. An IEEE standard by which network devices announce their identity, capabilities and neighbors at Layer 2. Most enterprise switches and AV devices speak it, and it is how a switch learns what is plugged into each port.
CDP#: Cisco Discovery Protocol, the proprietary equivalent of LLDP. Older Cisco-heavy networks rely on it. We read both.
MAC OUI#: Organizationally Unique Identifier: the first 24 bits of a MAC address, assigned by the IEEE to the manufacturer. It says who made the hardware, and on its own it is easily spoofed, which is why it is only one of several independent signals.
SNMP#: Simple Network Management Protocol, used to read status from network devices and optionally to write configuration. We use read-only access by default, scoped to the switch-fabric data needed for inventory and evidence. Nothing here uses traffic mirroring, SPAN ports or packet capture.
SIEM#: Security Information and Event Management: platforms that ingest logs and security events for correlation, alerting and search. Every alert resolves to an asset, so assets missing from the inventory mean alerts nobody can interpret.
VLAN#: Virtual LAN. A way to split one physical network into separate broadcast domains for security or operational separation. Access control enforces policy on them. We show what is on each one, including devices sitting on a VLAN they do not belong on.
Layer 2#: The data-link layer, where switches forward frames using MAC addresses. Network access control operates here and above. The gap we close is everything below it.

The terms, in plain English.

The method

The gap it closes

Compliance frameworks

Network terms

Where these words come from