Updated 1 Nov 2026 · 5 min read
On this page
By the end of this guide you will know what CompTIA's SY0-701 acronym list is, which groups of acronyms to learn first, what the key ones mean in plain English, and where the list repeats letters or spells a term differently from the standards sources. Plain meanings are taken from the NIST glossary unless stated.
What the list is and how to attack it
The acronym list is part of CompTIA's Security+ SY0-701 exam objectives document (version 6.0), placed after the five domains. CompTIA introduces it as "a list of acronyms that appears on the CompTIA Security+ SY0-701 exam" and encourages candidates "to review the complete list and attain a working knowledge of all listed acronyms as part of a comprehensive exam preparation program."
The list is alphabetical, which puts unrelated terms side by side. Learn it by topic instead, and start with the acronyms the objectives use in their own bullet points, because those are tied to a specific objective. Objective 1.4, for example, spells out PKI (public key infrastructure), TPM (Trusted Platform Module), HSM (hardware security module), CRL (certificate revocation list), OCSP (Online Certificate Status Protocol) and CSR (certificate signing request). The groups below are arranged by topic.
Cryptography
| Acronym | CompTIA's expansion | Plain meaning |
|---|---|---|
| AES | Advanced Encryption Standard | A symmetric block cipher that can encrypt and decrypt data |
| RSA | Rivest, Shamir, & Adleman | A public-key algorithm used for key establishment and for digital signatures |
| SHA | Secure Hashing Algorithm | A hash algorithm designed so you cannot feasibly find an input for a given digest, or two inputs with the same digest |
| PKI | Public Key Infrastructure | The framework used to issue, maintain and revoke public key certificates |
| PFS | Perfect Forward Secrecy | A new secret key from a new Diffie-Hellman exchange each time, so a compromised old key cannot be used against newer keys |
NIST's PFS definition is written for IPsec security associations, which is where the term is defined in SP 800-77 Rev. 1.
Identity and access
| Acronym | CompTIA's expansion | Plain meaning |
|---|---|---|
| MFA | Multifactor Authentication | Authentication using two or more factors: something you know, something you have, something you are |
| SSO | Single Sign-on | One account and its authenticators give seamless access to multiple applications |
| IdP | Identity Provider | In a federation, the party that creates an assertion about the user and sends it to the relying party |
| SAML | Security Assertions Markup Language | XML-based messages for exchanging security information, as assertions about subjects, between partners |
| RBAC | Role-based Access Control | Permitted actions are tied to roles rather than to individual identities |
NIST lists 2FA, which is also on CompTIA's list, as a synonym on its multi-factor authentication entry.
Network security
| Acronym | CompTIA's expansion | Plain meaning |
|---|---|---|
| IPSec | Internet Protocol Security | Adds security to IP to provide confidentiality and integrity services |
| TLS | Transport Layer Security | Privacy and data integrity between two communicating applications |
| VPN | Virtual Private Network | A protected link using tunnelling and security controls that gives the impression of a dedicated line |
| IDS / IPS | Intrusion Detection / Prevention System | An IDS automates intrusion detection. An IPS can also try to stop the activity |
| NAC | Network Access Control | Grants access based on the user's credentials and health checks on the device |
Governance, risk and resilience
| Acronym | CompTIA's expansion | Plain meaning |
|---|---|---|
| BIA | Business Impact Analysis | Analysing operational functions and the effect a disruption might have on them |
| RTO | Recovery Time Objective | How long systems can stay in recovery before the mission or business processes suffer |
| RPO | Recovery Point Objective | The point in time to which data must be recovered after an outage |
| SLA | Service-level Agreement | Defines the provider's responsibilities and sets the customer's expectations |
RTO and RPO are easy to mix up because the letters differ by one. RTO is a length of time: how long recovery can take. RPO is a point in time: the moment your recovered data must reach.
Threats and security operations
| Acronym | CompTIA's expansion | Plain meaning |
|---|---|---|
| APT | Advanced Persistent Threat | An adversary with sophisticated expertise and significant resources using multiple attack vectors |
| IoC | Indicators of Compromise | Artifacts suggesting an attack is imminent, under way or has already happened |
| TTP | Tactics, Techniques, and Procedures | The behaviour of an actor, from the highest-level tactic down to detailed procedures |
| XSS | Cross-site Scripting | A vulnerability that lets attackers inject malicious code into an otherwise benign website |
| SIEM | Security Information and Event Management | Centralised logging for a variety of log types |
| CVSS | Common Vulnerability Scoring System | A specification for describing vulnerabilities and measuring their relative severity |
Traps in the list: repeated letters and different spellings
Some letters stand for more than one thing on CompTIA's own list, so read the context before you expand them.
- MAC: Mandatory Access Control, Media Access Control and Message Authentication Code.
- PAM: Privileged Access Management and Pluggable Authentication Modules.
- RBAC: Role-based Access Control and Rule-based Access Control.
- RA: Recovery Agent and Registration Authority.
- SAN: Storage Area Network and Subject Alternative Name.
A few expansions on the list also differ from the name used in standards sources such as the NIST glossary and the IETF. Know CompTIA's version for the exam and the standard name for everything else.
| Acronym | CompTIA's list says | Name in the standards source |
|---|---|---|
| DES | Digital Encryption Standard | Data Encryption Standard (NIST) |
| CVE | Common Vulnerability Enumeration | Common Vulnerabilities and Exposures (NIST glossary) |
| DMARC | Domain Message Authentication Reporting and Conformance | Domain-based Message Authentication, Reporting, and Conformance (RFC 9989) |
| URL | Universal Resource Locator | Uniform Resource Locator (NIST glossary) |
| HMAC | Hashed Message Authentication Code | Keyed-Hash Message Authentication Code (NIST glossary) |
| ESP | Encapsulated Security Payload | Encapsulating Security Payload (NIST glossary) |
| ISO | International Standards Organization | International Organization for Standardization (NIST glossary) |
| FIM | File Integrity Management | File Integrity Monitoring (NIST glossary, and CompTIA's own objective 4.5) |
How this fits your exam
CompTIA Security+ SY0-701 (objectives version 6.0): the acronym list is part of the official objectives document, which CompTIA describes as listing acronyms that appear on the exam. Individual acronyms are also written out inside the objectives, for example PKI, TPM, HSM, CRL, OCSP and CSR in objective 1.4, "Explain the importance of using appropriate cryptographic solutions", and DMARC, DKIM and SPF under email security in objective 4.5, "Given a scenario, modify enterprise capabilities to enhance security". For how the domains are weighted and how to plan your study, read the Security+ SY0-701 exam guide.
Frequently asked questions
Do I need to learn every acronym on the list?
CompTIA encourages candidates to attain a working knowledge of all listed acronyms. Learning them by topic, starting with the ones written into the objectives, lets you learn each acronym alongside the concept it names.
Which expansion should I use when CompTIA's differs from the standard's?
Recognise both. CompTIA writes DES as Digital Encryption Standard, while NIST's name is Data Encryption Standard. The letters and the concept are the same, so a question about DES is about the same withdrawn cipher whichever expansion you have in your head.
Why is RBAC on the list twice?
Because CompTIA uses it for two different models: Role-based Access Control and Rule-based Access Control. In role-based access control, which NIST defines, permitted actions are tied to roles rather than to individual identities. Read the question for the word role or rule.
Sources
- CompTIA Security+ SY0-701 Certification Exam: Exam Objectives Version 6.0
- NIST CSRC Glossary
- NIST SP 800-175B Rev. 1: Guideline for Using Cryptographic Standards in the Federal Government: Cryptographic Mechanisms
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)
Check how well the acronyms have stuck with the free Security+ SY0-701 practice questions, then plan the rest of your revision with the Security+ SY0-701 guide.