Cybersecurity and GRC terminology: English to Mexican Spanish
Use this guide when translating cybersecurity, privacy, audit, and GRC content for professionals in Mexico. It describes professional usage, not word-for-word equivalence.
Edition 2026.3. The companion guide, Spanish to English, lives on the Spanish version of this page. If something here is not how you would say it, tell us.
Legal note: Legal terms are date-sensitive, and this guide is not legal advice. Verify the current official instrument, authority, and procedure before relying on a legal translation.
How to use this guide
The default register is formal Mexican professional writing: security policies, audit reports, regulatory material, technical documentation, and professional training. Team chat, job titles, product names, commands, and quoted interface text may retain more English.
- Translate: Mexican professional writing normally uses the Spanish term.
- Keep in English: The English borrowing is the normal specialist term in Mexico.
- Context-dependent: The correct form changes with technical sense, register, organization, or jurisdiction.
- Official name or acronym: Preserve the official name, designation, or working acronym.
- Legal term, date-sensitive: Use the wording of the governing instrument and verify the current official text.
Consistency applies to the same sense, register, jurisdiction, and grammatical use. It does not require different concepts to share one translation.
Terms
data breach
→vulneración de seguridad; vulneración de seguridad de datos personales; brecha de datosLegal term, date-sensitivePrivacy law and nonstatutory cyber writing
Vulneración de seguridad is the exact term of the current LFPDPPP (DOF, March 20, 2025). It appears there twice (vulneración a la seguridad appears zero times in that law) and the operative use is article 19 (las vulneraciones de seguridad ocurridas en cualquier fase del tratamiento). The LGPDPPSO uses both vulneración de seguridad and vulneración a la seguridad, with the breach taxonomy at articles 31 to 35. When citing law, preserve the instrument's exact wording. The longer vulneración de seguridad de datos personales appears in neither current statute; it derives from the 2011 Regulation, still officially listed as current, and remains a safe descriptive umbrella outside direct statutory citation. Brecha de datos is clear nonstatutory professional language; brecha de seguridad appears zero times in either law. Do not import another jurisdiction's notification rule.
Example: The controller documented the personal data breach. → El responsable documentó la vulneración de seguridad de datos personales.
Sources: Official DOF publication of March 20, 2025 (LFPDPPP and LGPDPPSO) · Current LFPDPPP, Chamber of Deputies · Current LGPDPPSO, Chamber of Deputies · 2011 LFPDPPP Regulation, officially listed as current
That is not how I would say it
NOM
→NOM; Norma Oficial MexicanaOfficial name or acronymMexican technical regulation
Preserve NOM, the full official identifier, and the Spanish title. Do not replace the designation with a generic norma mexicana. A NOM applies only within its stated scope. NOM-151-SCFI-2016 concerns conservation of data messages and digitization; it is not a general substitute for HIPAA, GDPR, or a cybersecurity law.
Sources: Quality Infrastructure Law · Official record for NOM-151-SCFI-2016
That is not how I would say it
tabletop exercise
→ejercicio de simulación en mesa; tabletopContext-dependentIncident response and business continuity
Ejercicio de simulación en mesa is a clear formal rendering. Mexican institutional writing also retains table-top or tabletop. Ejercicio de gabinete may be the broader controlled term in emergency-management programs. Follow the institution's exercise taxonomy.
Example: The team ran a tabletop exercise for the ransomware plan. → El equipo realizó un ejercicio de simulación en mesa sobre el plan contra ransomware.
Sources: Official 2025 Federal Public Administration Cybersecurity Policy