Cybersecurity and GRC terminology: English to Mexican Spanish
Use this guide when translating cybersecurity, privacy, audit, and GRC content for professionals in Mexico. It describes professional usage, not word-for-word equivalence.
Edition 2026.3. The companion guide, Spanish to English, lives on the Spanish version of this page. If something here is not how you would say it, tell us.
Legal note: Legal terms are date-sensitive, and this guide is not legal advice. Verify the current official instrument, authority, and procedure before relying on a legal translation.
How to use this guide
The default register is formal Mexican professional writing: security policies, audit reports, regulatory material, technical documentation, and professional training. Team chat, job titles, product names, commands, and quoted interface text may retain more English.
- Translate: Mexican professional writing normally uses the Spanish term.
- Keep in English: The English borrowing is the normal specialist term in Mexico.
- Context-dependent: The correct form changes with technical sense, register, organization, or jurisdiction.
- Official name or acronym: Preserve the official name, designation, or working acronym.
- Legal term, date-sensitive: Use the wording of the governing instrument and verify the current official text.
Consistency applies to the same sense, register, jurisdiction, and grammatical use. It does not require different concepts to share one translation.
Quick lookup
Select a term, or search above, to see its full entry.
| English | Recommended Mexican Spanish | Guidance |
|---|---|---|
| access control | control de acceso | Translate |
| API | API; interfaz de programación de aplicaciones | Official name or acronym |
| API endpoint | endpoint de API; punto de consulta | Context-dependent |
| asset | activo | Translate |
| attack chain | cadena de ataque | Translate |
| audit | auditoría | Translate |
| backup | respaldo | Translate |
| backup copy | copia de respaldo | Translate |
| baseline | línea base | Translate |
| blue team | blue team; equipo azul | Context-dependent |
| botnet | botnet | Keep in English |
| calibration | calibración | Translate |
| calibration mirror | espejo de calibración | Translate |
| cloud | nube | Translate |
| cloud computing | cómputo en la nube | Translate |
| CNBV | CNBV; Comisión Nacional Bancaria y de Valores | Official name or acronym |
| competency map | mapa de competencias | Translate |
| compliance | cumplimiento normativo | Translate |
| control owner | responsable del control | Translate |
| controller-to-processor communication | remisión | Legal term, date-sensitive |
| corporate governance | gobierno corporativo | Translate |
| cryptographic key | llave criptográfica; clave criptográfica | Context-dependent |
| cyber intelligence | ciberinteligencia | Translate |
| Cyber Kill Chain | Cyber Kill Chain | Official name or acronym |
| cybersecurity posture | postura de ciberseguridad | Translate |
| data breach | vulneración de seguridad; vulneración de seguridad de datos personales; brecha de datos | Legal term, date-sensitive |
| data controller | responsable | Legal term, date-sensitive |
| data controller (EU GDPR) | responsable del tratamiento | Legal term, date-sensitive |
| data governance | gobierno de datos; gobernanza de datos | Context-dependent |
| data loss prevention | prevención de pérdida de datos | Translate |
| data processor | persona encargada | Legal term, date-sensitive |
| data processor (EU GDPR) | encargado del tratamiento | Legal term, date-sensitive |
| data subject | persona titular; titular | Legal term, date-sensitive |
| data subject (EU GDPR) | interesado | Legal term, date-sensitive |
| deficiency | deficiencia | Context-dependent |
| disclosure | divulgación | Context-dependent |
| DLP | DLP | Official name or acronym |
| EDR | EDR | Official name or acronym |
| correo electrónico | Translate | |
| encryption | cifrado | Translate |
| end-user device | dispositivo de usuario final | Translate |
| endpoint (endpoint security) | endpoint; punto final; dispositivo de punto final | Context-dependent |
| evidence coverage | cobertura de evidencia | Translate |
| evidence floor | piso de evidencia | Translate |
| exploit | exploit | Context-dependent |
| exploit code | código de explotación | Translate |
| finding | hallazgo | Context-dependent |
| firewall | firewall | Keep in English |
| framework; frameworks | framework; frameworks; marco de referencia | Keep in English |
| gap | brecha | Context-dependent |
| governance | gobernanza | Translate |
| hardening | hardening | Context-dependent |
| IAM | IAM; gestión de identidades y accesos | Official name or acronym |
| incident | incidente | Translate |
| information leakage prevention | prevención de fuga de información | Translate |
| innovative model (Mexican fintech law) | Modelo Novedoso | Legal term, date-sensitive |
| Insight Gallery | Galería de Evidencia | Translate |
| isolated environment | entorno aislado; ambiente aislado | Translate |
| IT | TI; tecnologías de la información | Translate |
| IT governance | gobernanza de TI; gobierno de TI | Context-dependent |
| Knowledge Statement | enunciado de conocimientos | Translate |
| least privilege | principio de mínimo privilegio | Translate |
| LFPDPPP | LFPDPPP; Ley Federal de Protección de Datos Personales en Posesión de los Particulares | Legal term, date-sensitive |
| LGPDPPSO | LGPDPPSO; Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados | Legal term, date-sensitive |
| log; logs | log; logs; registro; bitácora | Context-dependent |
| logging | generación de registros; registro | Context-dependent |
| malicious code | código malicioso | Translate |
| malware | malware; software malicioso | Context-dependent |
| MFA | MFA; autenticación multifactor | Official name or acronym |
| NOM | NOM; Norma Oficial Mexicana | Official name or acronym |
| observation | observación | Context-dependent |
| password | contraseña | Translate |
| patch | parche | Translate |
| patching | aplicación de parches | Translate |
| payload | payload; carga útil | Context-dependent |
| penetration test; pentest | prueba de penetración; pentest | Context-dependent |
| personal data | datos personales | Legal term, date-sensitive |
| personal-data processing | tratamiento de datos personales | Legal term, date-sensitive |
| personal-data transfer | transferencia de datos personales | Legal term, date-sensitive |
| phishing | phishing | Keep in English |
| PII | PII; información de identificación personal | Context-dependent |
| privacy notice | aviso de privacidad | Legal term, date-sensitive |
| provision (legal or regulatory) | disposición | Context-dependent |
| ransomware | ransomware | Keep in English |
| red team | red team; equipo rojo | Context-dependent |
| regulation | reglamento; regulación; disposición | Context-dependent |
| regulatory framework | marco regulatorio; marco normativo | Context-dependent |
| remediation | remediación | Translate |
| report (noun) | informe; reporte | Context-dependent |
| risk | riesgo | Translate |
| risk appetite | apetito de riesgo | Translate |
| risk tolerance | tolerancia al riesgo | Translate |
| roadmap | hoja de ruta; roadmap | Context-dependent |
| rule | regla; disposición; norma | Context-dependent |
| sandbox | sandbox | Context-dependent |
| scan (noun) | escaneo | Context-dependent |
| scope | alcance | Translate |
| scoping | definición del alcance | Translate |
| secure configuration | configuración segura | Translate |
| security awareness | concientización en seguridad | Translate |
| security awareness training | capacitación para la concientización en seguridad | Translate |
| security control | control de seguridad | Context-dependent |
| security event | evento de seguridad | Translate |
| security measure; safeguard | medida de seguridad | Legal term, date-sensitive |
| security posture | postura de seguridad | Translate |
| security training | capacitación en seguridad | Translate |
| SIEM | SIEM | Official name or acronym |
| Skill Statement | enunciado de habilidad | Translate |
| SOC | SOC; centro de operaciones de seguridad | Official name or acronym |
| spear phishing | spear phishing | Context-dependent |
| spoofing | spoofing | Context-dependent |
| standard | estándar | Translate |
| strength | fortaleza | Translate |
| supply chain | cadena de suministro | Translate |
| tabletop exercise | ejercicio de simulación en mesa; tabletop | Context-dependent |
| targeted phishing | phishing dirigido | Translate |
| Task Statement | enunciado de tarea | Translate |
| third party | tercero | Context-dependent |
| threat | amenaza | Translate |
| threat actor | actor de amenaza | Translate |
| threat hunting | threat hunting; caza de amenazas | Context-dependent |
| threat intelligence | inteligencia de amenazas | Translate |
| to inform | informar | Legal term, date-sensitive |
| to log | registrar | Translate |
| to notify; notification | notificar; notificación | Legal term, date-sensitive |
| to report | reportar | Context-dependent |
| to scan; scanning | escanear; escaneo | Translate |
| unauthorized disclosure | revelación no autorizada; divulgación no autorizada | Legal term, date-sensitive |
| vendor; supplier | proveedor | Context-dependent |
| VPN | VPN; red privada virtual | Official name or acronym |
| vulnerability | vulnerabilidad | Translate |
| XDR | XDR | Official name or acronym |
| Zero Trust | Zero Trust; modelo Zero Trust | Keep in English |
| zero-day | vulnerabilidad de día cero; zero-day; 0-day | Context-dependent |