Cybersecurity and GRC terminology: English to Mexican Spanish

All professional registers

Control de acceso is the standard form in Mexican security, privacy, and audit writing. Use controles de acceso in the plural.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Technical and regulatory writing

Keep the working acronym API. When an expansion helps the reader, write interfaz de programación de aplicaciones (API) on first mention. Do not invent a Spanish acronym.

Example: The API validates the request. → La API valida la solicitud.

Sources: Official DOF text of the CNBV standardized API provisions

Generic threat analysis

Use cadena de ataque for a generic sequence of attacker actions. Do not capitalize it or rename it Cyber Kill Chain unless the source means that named model.

Evidence basis: Professional usage judgment; no legal force is claimed.

Audit and assurance

Auditoría is the normal formal term. Do not use this entry for audit trail, which may be pista de auditoría or registro de auditoría depending on the artifact.

Evidence basis: Professional usage judgment; no legal force is claimed.

IT operations and continuity

Use respaldo for the process or result and respaldar as the verb. Copia de seguridad is valid general Spanish, but respaldo is particularly natural in Mexican IT practice.

Sources: Official DOF security provisions for financial-technology institutions

Security engineering and governance

Use línea base de seguridad for a security baseline. A configuration baseline may be línea base de configuración or configuración de referencia, depending on whether the text describes a measured baseline or a prescribed configuration.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Technical and practitioner writing

Mexican technical writing normally retains botnet. An explanatory first mention may add red de bots. In Spanish, la botnet and plural botnets are natural.

Evidence basis: Professional usage judgment; no legal force is claimed.

Measurement and assessment

Use calibración. In assessment work, specify calibración del instrumento or calibración de reactivos when needed. This is measurement terminology, not a cybersecurity-specific borrowing.

Evidence basis: Professional usage judgment; no legal force is claimed.

All professional registers

A per-area, descriptive comparison of self-view and demonstrated results. Mirror language keeps it a self-check; it is never a validated risk signal.

Formal technical writing

Use nube or a scoped phrase such as servicio en la nube in running prose. Preserve cloud in official product names, certifications, and job titles.

Sources: Official DOF security provisions for financial-technology institutions

Mexican financial regulation

When the source names the Mexican authority, preserve the official Spanish name and acronym rather than substituting a generic regulator label. CNBV is not automatically the correct regulator for every Mexican financial entity; identify the entity and governing instrument first.

Sources: National Banking and Securities Commission Law

Formal GRC and regulatory writing

Cumplimiento normativo is the clearest formal default; cumplimiento is sufficient once the regulatory context is established. Compliance remains common in multinational department names and job titles.

Evidence basis: Professional usage judgment; no legal force is claimed.

GRC, internal control, and audit

Responsable del control identifies accountability without the awkward literal forms dueño del control or propietario del control.

Evidence basis: Professional usage judgment; no legal force is claimed.

Mexican privacy law

Use the defined Mexican term remisión for a controller-to-processor communication where the governing instrument uses it. Preserve and define the Spanish term in legal citations. Do not translate it as bare remittance, which normally means a money transfer.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current

Broader institutional intelligence

Use ciberinteligencia for the broader cyber-intelligence function. Do not narrow it automatically to the threat-intelligence function.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Named threat-analysis model

Preserve the named model in English. Do not translate it as cadena de eliminación. A generic attack chain is a different phrase.

Evidence basis: Professional usage judgment; no legal force is claimed.

Cybersecurity governance and assessment

Use postura de ciberseguridad when the narrower cyber domain must be explicit.

Evidence basis: Professional usage judgment; no legal force is claimed.

Privacy law and nonstatutory cyber writing

Vulneración de seguridad is the exact term of the current LFPDPPP (DOF, March 20, 2025). It appears there twice (vulneración a la seguridad appears zero times in that law) and the operative use is article 19 (las vulneraciones de seguridad ocurridas en cualquier fase del tratamiento). The LGPDPPSO uses both vulneración de seguridad and vulneración a la seguridad, with the breach taxonomy at articles 31 to 35. When citing law, preserve the instrument's exact wording. The longer vulneración de seguridad de datos personales appears in neither current statute; it derives from the 2011 Regulation, still officially listed as current, and remains a safe descriptive umbrella outside direct statutory citation. Brecha de datos is clear nonstatutory professional language; brecha de seguridad appears zero times in either law. Do not import another jurisdiction's notification rule.

Example: The controller documented the personal data breach. → El responsable documentó la vulneración de seguridad de datos personales.

Sources: Official DOF publication of March 20, 2025 (LFPDPPP and LGPDPPSO) · Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current

Privacy law

For Mexican law, use the statutory term responsable. Responsable del tratamiento is usual EU GDPR terminology and is not the Mexican statutory label. Do not use the literal controlador de datos.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

EU privacy law in Spanish

Use responsable del tratamiento for the EU GDPR role. In Mexican statutory citations, the corresponding defined role is normally responsable; do not mix the jurisdictional labels without explanation.

Sources: Official Spanish text of the EU GDPR · Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

Data governance and GRC

Both forms occur in professional Mexican usage. Follow the organization's controlled vocabulary and do not shorten either to bare gobierno.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Data-security product terminology

Prevención de pérdida de datos is the direct expansion used by many DLP products in their Spanish materials. Do not substitute prevención de fuga de información, which emphasizes a narrower disclosure or exfiltration problem.

Evidence basis: Professional usage judgment; no legal force is claimed.

Privacy law

Current Mexican law uses persona encargada. Encargado del tratamiento is usual EU GDPR terminology and is not the Mexican statutory label. Do not translate the role literally as procesador de datos.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

Privacy law

Use persona titular or titular for Mexican privacy law. Interesado is usual EU GDPR terminology and may mean an interested party or applicant in Mexican legal prose. Sujeto de datos is a literal calque, not the Mexican statutory term.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

EU privacy law in Spanish

Use interesado for the EU GDPR role. In Mexican legal or administrative prose, bare interesado may instead mean an interested party or applicant; current Mexican privacy statutes use persona titular or titular.

Sources: Official Spanish text of the EU GDPR · Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

Audit and control evaluation

Use deficiencia when an audit, control framework, or regulator classifies a weakness as a deficiency. Do not soften a defined deficiency into the more general brecha.

Sources: 2011 LFPDPPP Regulation, officially listed as current

Vulnerability handling, privacy, and legal writing

Use divulgación for vulnerability disclosure and many general disclosure contexts. Do not use it as a universal privacy-law mapping: transferencia, remisión, and an unauthorized revelación describe different acts. A non-disclosure agreement is an acuerdo de confidencialidad.

Example: The policy defines coordinated vulnerability disclosure. → La política define la divulgación coordinada de vulnerabilidades.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy · Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

Formal security and regulatory writing

Cifrado is the formal Mexican regulatory default. Encriptación is common and intelligible in Mexico, especially in consumer and conversational contexts, but it should not replace cifrado in a controlled formal vocabulary.

Sources: Official DOF text of the CNBV standardized API provisions · Official DOF security provisions for financial-technology institutions

General device and asset terminology

Use this descriptive term when the source means a user's device rather than the endpoint-security category.

Evidence basis: Professional usage judgment; no legal force is claimed.

Endpoint security and EDR

Retain endpoint in product names and common practitioner prose. Mexican institutional and procurement writing also uses punto final, puntos finales, and dispositivo de punto final; follow the source and the organization's controlled vocabulary. Do not treat every end-user device as an endpoint-security term.

Example: The EDR agent protects every endpoint. → El agente EDR protege cada punto final.

Sources: Telmex endpoint-security service · SCJN managed cybersecurity-service procurement

All professional registers

How much of a role's measurable set has been answered and how much evidence sits behind each area. Coverage counts are facts and carry no quality judgment.

All professional registers

The minimum number of counted answers before a value is shown (four per area, three per statement type). Below the floor a view says it cannot read the area fairly, rather than guessing.

Technical and vulnerability-management writing

Retain exploit as the usual specialist noun. The verb is explotar una vulnerabilidad. In Spanish, un exploit and plural exploits are standard.

Sources: UNAM-CERT security bulletin

Formal vulnerability explanation

Use código de explotación when the source specifically refers to code. The broader practitioner noun remains exploit.

Sources: UNAM-CERT security bulletin

Practitioner and enterprise security writing

Mexican practitioners normally retain firewall. Cortafuegos is valid and appears in formal and educational material, often as an explanatory equivalent. In Spanish, use el firewall and plural firewalls.

Evidence basis: Professional usage judgment; no legal force is claimed.

Governance, software, and official titles

Keep the noun in English, masculine, with the English plural: el framework, los frameworks. In compounds the noun stays English: framework de seguridad, framework de cumplimiento, framework de controles, framework de gestión de riesgos, framework de ciberseguridad. Preserve official names such as NIST Cybersecurity Framework unless an authoritative translated title applies. A legal or regulatory framework is a different concept and stays marco regulatorio or marco normativo. Also correct in formal writing: marco de referencia, then marco. Prefer framework, and use one term for the same thing throughout a text.

Example: The organization adopted a risk framework. → La organización adoptó un framework de gestión de riesgos.

Capability, control, and privacy assessment

Use a complement: brecha de habilidades, brecha de capacidades, or análisis de brecha. Avoid bare brecha where readers could confuse it with a data breach. Do not translate a defined audit deficiencia as gap.

Sources: 2011 LFPDPPP Regulation, officially listed as current

Incident management and regulation

Use incidente. Keep it distinct from evento: an event becomes an incident only when the applicable criteria are met.

Sources: Official DOF text of the CNBV standardized API provisions · Official 2025 Federal Public Administration Cybersecurity Policy

Information-security controls

Use this form when the control specifically addresses information leakage, unauthorized disclosure, or exfiltration. Do not treat it as an automatic expansion of every DLP product.

Sources: PRODECON information-leakage prevention example

Mexican financial regulation

Preserve the statutory term Modelo Novedoso in legal citations. A descriptive English gloss such as innovative model may help, but do not rename it as a generic technical sandbox.

Sources: Financial Technology Institutions Law

All professional registers

The Aramis:Insight progressive results surface. Spanish leads with evidencia because the gallery is a set of views over cumulative evidence; a literal galeria de insight reads as untranslated marketing.

Networks, testing, and runtime isolation

Use entorno aislado or ambiente aislado for a network, test, or runtime environment described only by its isolation; in Mexican practice ambiente is the everyday word for computing environments (ambiente de pruebas, ambiente de producción). Use sandbox only when the source also implies constrained execution, testing, or effects.

Evidence basis: Professional usage judgment; no legal force is claimed.

Formal professional writing

Use TI and expand it as tecnologías de la información. Use TIC only when communications are part of the source concept. Preserve IT inside official English titles.

Evidence basis: Professional usage judgment; no legal force is claimed.

IT governance frameworks

Use gobernanza de TI when following Mexican NMX or ISO terminology. Gobierno de TI remains current in COBIT and some corporate vocabularies. Follow the named framework.

Sources: Declaration for NMX-I-38502-NYCE-2019 · Official 2025 Federal Public Administration Cybersecurity Policy

NIST NICE and competency frameworks

This NICE construct describes what a person needs to know. Keep it separate from task and skill statements.

Sources: NIST NICE glossary · CONOCER competency guidance

Mexican private-sector privacy law

The acronym remains current. A new law with the same title was published on March 20, 2025; it took effect on March 21 and abrogated the 2010 enactment. Cite the current consolidated law for current matters. Use the 2010 text for historical facts or transition-governed proceedings. INAI is no longer the current authority, but its historical acts remain relevant. The current law defines the Secretaría Anticorrupción y Buen Gobierno as la Secretaría.

Sources: Current LFPDPPP, Chamber of Deputies

Mexican public-sector privacy law

Preserve the official title and acronym. A new law with the same title was published on March 20, 2025, replacing the 2017 enactment. It allocates authority between the Secretaría and the applicable Autoridad garante, depending on the subject and jurisdiction.

Sources: Current LGPDPPSO, Chamber of Deputies

Operations, audit, and legal records

Keep the noun in English, masculine, with the English plural: el log, los logs. In compounds the noun stays English and the modifier follows in Spanish: log de auditoría, log de eventos, log del sistema, log de acceso, log de autenticación, log del firewall, archivo de log, entrada de log, modo solo log. As the object of a process: gestión de logs, retención de logs, reenvío de logs, correlación de logs, análisis de logs. The verb is registrar (never loguear), and logging as a practice is registro. Product names stay as written (VPC Flow Logs), and where a law names its own record, quote it as written, such as bitácora de vulneraciones. Also correct and widely understood: registro and bitácora (registro de auditoría, bitácora de acceso). Prefer log, and use one term for the same thing throughout a text.

Example: The system records every administrative event in the audit log. → El sistema registra cada evento administrativo en el log de auditoría.

Sources: Current LGPDPPSO, Chamber of Deputies · Official DOF security provisions for financial-technology institutions

Operations and monitoring

Use generación de registros when the activity must be explicit. Registro may work when grammar and context already identify the process.

Sources: Official DOF security provisions for financial-technology institutions

Code-specific security writing

Use this literal form when the source specifically means code rather than malicious software generally.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Technical, policy, and general-audience writing

Retain malware in technical and practitioner prose. Use software malicioso in formal policy or general-audience explanations. In Spanish, el malware normally functions as a mass noun. Keep a narrower código malicioso distinct.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Mexican technical regulation

Preserve NOM, the full official identifier, and the Spanish title. Do not replace the designation with a generic norma mexicana. A NOM applies only within its stated scope. NOM-151-SCFI-2016 concerns conservation of data messages and digitization; it is not a general substitute for HIPAA, GDPR, or a cybersecurity law.

Sources: Quality Infrastructure Law · Official record for NOM-151-SCFI-2016

Defined audit categories

Use observación when the audit methodology defines an observation as its own category. Do not substitute it automatically for every hallazgo.

Evidence basis: Professional usage judgment; no legal force is claimed.

All professional registers

Use contraseña. Do not use clave indiscriminately because it may mean a cryptographic key, passcode, identifier, or other credential.

Evidence basis: Professional usage judgment; no legal force is claimed.

Vulnerability and change management

Use aplicación de parches in formal prose. Parcheo is common technical speech but is less suitable in policies and audit reports.

Sources: Official DOF security provisions for financial-technology institutions

Malware tooling, APIs, and protocol writing

Retain payload in malware tooling, exploit modules, commands, and quoted interface labels. Use carga útil for an API or message body and where formal protocol prose uses that term. Mexican sources use both forms, so neither is inherently translationese.

Example: The API rejects a payload with an invalid signature. → La API rechaza una carga útil con una firma no válida.

Sources: Official DOF text of the CNBV standardized API provisions · UNAM-CERT fileless-attack analysis

Formal security testing and practitioner usage

Use prueba de penetración in formal prose. Pentest and pentester remain natural in job titles, team dialogue, and quoted artifacts.

Sources: Official DOF text of the CNBV standardized API provisions

Mexican privacy law

Datos personales is the current Mexican statutory term. It is not automatically coextensive with every US framework's definition of PII.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

Privacy law

Use transferencia de datos personales for a communication to a recipient other than the data subject, controller, or processor, subject to the governing instrument. Do not use it for the separately defined controller-to-processor remisión.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current

All cybersecurity registers

Mexican professional and institutional writing retains phishing. Suplantación de identidad may explain part of the technique but is not an exact replacement and also overlaps with spoofing and identity fraud. In Spanish, use el phishing.

Sources: CONDUSEF fraud guidance

US frameworks and cross-jurisdiction privacy work

When PII is a named US or NIST construct, retain PII and, if needed, explain it as información de identificación personal. Do not silently replace it with Mexican datos personales; the scopes are not automatically identical.

Sources: NIST CSRC glossary entry for PII · Current LFPDPPP, Chamber of Deputies

Mexican privacy law

Use the Mexican statutory term aviso de privacidad. Do not substitute política de privacidad or the literal advertencia de privacidad unless the source names a different instrument.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

All cybersecurity registers

Mexican technical and institutional writing retains ransomware. Secuestro de datos describes a possible effect but is not a reliable replacement term. In Spanish, use el ransomware.

Evidence basis: Professional usage judgment; no legal force is claimed.

Practitioner teams, exercises, and audit prose

Retain red team for team names, roles, and practitioner dialogue. Formal explanatory or audit prose may use equipo rojo or ejercicio de equipo rojo. The team and the exercise are related but not identical.

Sources: Superior Audit Office red-team example

Legal and regulatory writing

Use reglamento for an instrument formally titled as such, regulación for the field or activity of regulation, and disposición when that is the instrument's form. Preserve official titles and verify legal effect.

Evidence basis: Professional usage judgment; no legal force is claimed.

Cybersecurity, audit, and GRC

Remediación is established in Mexican cyber and GRC work. Keep it distinct from mitigación, which reduces risk or impact without necessarily removing the cause, and from acción correctiva where an audit framework uses that defined term.

Sources: Official DOF security provisions for financial-technology institutions

Enterprise risk and financial GRC

Use apetito de riesgo for the broad amount and type of risk an organization is willing to pursue or retain. Keep it distinct from risk tolerance.

Evidence basis: Professional usage judgment; no legal force is claimed.

Enterprise risk and financial GRC

Use tolerancia al riesgo for acceptable variation or limits around objectives or risk-taking. Keep it distinct from the broader risk appetite.

Evidence basis: Professional usage judgment; no legal force is claimed.

Policy, technical, and legal writing

Use regla for an ordinary or system rule. In legal and regulatory material, disposición or a formally named norma may be required. Preserve the official title and legal status instead of choosing by dictionary equivalence.

Evidence basis: Professional usage judgment; no legal force is claimed.

Vulnerability management and network operations

Use escaneo for the technical scan. Escaneo de vulnerabilidades is a vulnerability scan; evaluación de vulnerabilidades is the broader assessment and must not be reduced to scanning. Barrido may apply to a narrower network sweep.

Sources: Official DOF security provisions for financial-technology institutions

Audit, assessment, and project work

Use definición del alcance for the activity of establishing boundaries and inclusions.

Evidence basis: Professional usage judgment; no legal force is claimed.

Formal controls, policies, and audit

Use configuración segura for the formal control or configuration standard. A first mention may add (hardening) only when that practitioner label genuinely helps.

Example: The standard defines secure configuration requirements. → El estándar define requisitos de configuración segura.

Sources: Official DOF text of the CNBV standardized API provisions · Official DOF security provisions for financial-technology institutions · Official 2025 Federal Public Administration Cybersecurity Policy

Organizational security

Use concientización en seguridad for awareness as an organizational objective or program. Mexican institutional writing also uses sensibilización en ciberseguridad. Do not use capacitación unless the source means training.

Sources: Mexican federal cybersecurity-awareness campaign · Official 2025 Federal Public Administration Cybersecurity Policy · 2011 LFPDPPP Regulation, officially listed as current

Awareness-building instruction

Use the purpose-linked form capacitación para la concientización en seguridad for training intended to build security awareness. If the source names awareness and skills training as two coordinated activities, translate both separately.

Sources: Mexican federal cybersecurity-awareness campaign · 2011 LFPDPPP Regulation, officially listed as current

Security frameworks and privacy law

Use control de seguridad for a security-framework control. Do not replace a legally defined privacy medida de seguridad with this term.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Monitoring and incident management

Use evento de seguridad. Keep it distinct from incidente de seguridad; not every observable event meets the criteria for an incident.

Sources: Official DOF text of the CNBV standardized API provisions

Mexican privacy law

Mexican privacy law uses medida de seguridad for administrative, physical, and technical safeguards. Preserve this category rather than silently changing it to a framework control.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current

Security governance and assessment

Use postura de seguridad. Avoid bare postura when the security domain is not already clear.

Evidence basis: Professional usage judgment; no legal force is claimed.

Organizational training

Use capacitación en seguridad for structured instruction, courses, and skills development. It is related to awareness but is not its synonym.

Sources: 2011 LFPDPPP Regulation, officially listed as current

NIST NICE and competency frameworks

This NICE construct describes the capacity to perform an observable action. Keep it separate from a task statement.

Sources: NIST NICE glossary · CONOCER competency guidance

Network, email, and fraud terminology

Retain spoofing as the technical umbrella. Translate by mechanism in formal explanatory prose: suplantación del remitente, suplantación de dirección IP, or suplantación de DNS. Bare suplantación may instead mean impersonation or identity misuse.

Example: The control detects sender spoofing. → El control detecta la suplantación del remitente.

Evidence basis: Professional usage judgment; no legal force is claimed.

Technical, organizational, and legal writing

Use estándar for a technical or industry standard. Preserve the official title of a named legal or normative instrument rather than replacing norma automatically.

Sources: Quality Infrastructure Law · Official 2025 Federal Public Administration Cybersecurity Policy

Assessment, control, and audit reporting

Use fortaleza. In developmental feedback, área de oportunidad can frame an improvement area. In audit and control work, debilidad and deficiencia are legitimate terms and may have defined meanings; do not replace them automatically with softer language.

Evidence basis: Professional usage judgment; no legal force is claimed.

Incident response and business continuity

Ejercicio de simulación en mesa is a clear formal rendering. Mexican institutional writing also retains table-top or tabletop. Ejercicio de gabinete may be the broader controlled term in emergency-management programs. Follow the institution's exercise taxonomy.

Example: The team ran a tabletop exercise for the ransomware plan. → El equipo realizó un ejercicio de simulación en mesa sobre el plan contra ransomware.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Descriptive attack language

Use this descriptive mapping when the source emphasizes that phishing is directed at a target without necessarily invoking the fixed specialist label spear phishing.

Evidence basis: Professional usage judgment; no legal force is claimed.

NIST NICE and competency frameworks

This NICE construct describes work to be done. Do not replace it with the broader práctica or with a skill statement.

Sources: NIST NICE glossary · CONOCER competency guidance

Threat intelligence and financial security

Use singular actor de amenaza and plural actores de amenaza. This construction appears in current Banco de México financial-sector reporting. Agente de amenaza also occurs, but should not be mixed into a controlled vocabulary without a reason.

Sources: Banco de México Financial Stability Report, June 2026

SOC practice and formal explanatory writing

Retain threat hunting in SOC roles, team dialogue, and procedure names. Use caza de amenazas in formal explanatory or government prose. Mexican official material uses the Spanish form, so it is not merely marketing translation.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Intelligence and security operations

Use inteligencia de amenazas for threat intelligence tied to indicators, adversary behavior, and defensive decisions. Do not replace it with the potentially broader ciberinteligencia.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy · Banco de México Financial Stability Report, June 2026

Legal and regulatory obligations

Notificar and notificación are common formal renderings, but preserve the governing instrument's exact verb. Mexican privacy statutes may use informar for a duty commonly described in English as notification. Avoid casual reportar when it would change the recipient or legal effect.

Sources: Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies

Operational and tool-generated reporting

Use reportar where established operational usage calls for it. In formal or legal prose, the source verb may instead require informar or notificar; preserve the recipient and legal effect.

Evidence basis: Professional usage judgment; no legal force is claimed.

Vulnerability management and network operations

Use escanear as the technical verb and escaneo for the activity. Do not expand the term into the broader evaluación de vulnerabilidades unless the source means an assessment.

Sources: Official DOF security provisions for financial-technology institutions

All cybersecurity registers

Use vulnerabilidad. Keep it distinct from privacy-law vulneración, which denotes a breach or violation rather than a technical weakness.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy · Official DOF security provisions for financial-technology institutions

Architecture, identity, and access management

Mexican professional and federal policy writing retains Zero Trust. On first mention, an explanatory gloss such as modelo Zero Trust, basado en nunca confiar y siempre verificar may help. Do not force confianza cero as the name of the model.

Sources: Official 2025 Federal Public Administration Cybersecurity Policy

Formal explanation, technical feeds, and offensive security

Use vulnerabilidad de día cero, exploit de día cero, or ataque de día cero in formal explanatory prose. Retain zero-day or 0-day in technical feeds, tool output, and offensive-security dialogue. Both patterns are current in Mexico.

Example: The vendor patched a zero-day vulnerability. → El proveedor corrigió una vulnerabilidad de día cero.

Sources: UNAM-CERT zero-day bulletin