Glossary

Third Party Assessment Organization

An independent organization accredited to perform security assessments of cloud service providers seeking FedRAMP authorization. 3PAOs validate that CSPs meet required security controls.

Accessibility (numeronym)

A numeronym for 'accessibility' (a + 11 letters + y). Refers to the practice of making technology usable by people with disabilities, including visual, auditory, motor, and cognitive impairments.

Digital Accessibility (a11y)

The practice of designing products, services, and environments so that people with disabilities can perceive, understand, navigate, and interact with them. In web development, governed by WCAG, Section 508, and the ADA.

Accessibility Statement

A public document describing an organization's commitment to accessibility, the level of conformance achieved, known limitations, and contact information for accessibility feedback.

Accessibility Conformance Report

A completed VPAT documenting how a specific product version conforms to accessibility standards. This is the actual filled-out assessment that procurement officers review.

Architecture Decision Record

A short document capturing an important architectural decision, its context, the options considered, and the rationale for the choice made. Creates a decision trail for future developers.

Advanced Encryption Standard

A symmetric block cipher adopted by the U.S. government (FIPS 197) for encrypting classified and sensitive data. Uses 128-, 192-, or 256-bit keys and is the most widely used encryption algorithm worldwide.

Agentic Artificial Intelligence

AI systems that can autonomously plan, execute, and adapt multi-step workflows to achieve goals. Unlike chatbots, agentic AI takes actions, uses tools, and makes decisions with minimal human oversight.

Agile Software Development

An iterative development methodology that delivers working software in short cycles (sprints), with frequent feedback and adaptation. Frameworks include Scrum and Kanban.

Artificial Intelligence

Technology that enables machines to simulate human intelligence, including learning, reasoning, and decision-making. In government and enterprise contexts, AI adoption requires careful governance around ethics, bias, and data privacy.

Artificial Intelligence Agent

An autonomous software entity that perceives its environment, makes decisions, and takes actions to achieve specific goals. In agentic AI systems, agents can plan multi-step tasks, use tools, and collaborate with other agents.

Visual motion effects applied to UI elements through CSS transitions, keyframes, or JavaScript. Must respect the prefers-reduced-motion media query to remain accessible (WCAG 2.3.3).

ARIA Authoring Practices Guide

A W3C guide providing design patterns and examples for building accessible web components using WAI-ARIA. Covers menus, dialogs, tabs, trees, and other interactive patterns.

Application Programming Interface

A set of defined rules and protocols that allows different software applications to communicate with each other. REST APIs use HTTP methods (GET, POST, PUT, DELETE) to perform operations.

Software Architecture

The high-level structure of a software system, defining components, their relationships, and the principles governing their design and evolution. Documented through Architecture Decision Records (ADRs).

Accessible Rich Internet Applications

A set of HTML attributes (roles, states, and properties) defined by WAI-ARIA that make dynamic web content and user interface components more accessible to assistive technologies like screen readers.

Application Security Verification Standard

An OWASP framework that defines three levels of security verification requirements for web applications. Level 2 (Standard) is appropriate for most applications handling sensitive data.

Authority to Operate

A formal declaration by an authorizing official that a system is approved to operate at an acceptable level of risk. Required before any federal system can go live.

Atomic Design Methodology

A methodology for creating design systems in five levels: Atoms (basic elements) → Molecules (simple groups) → Organisms (complex groups) → Templates (page layouts) → Pages (final designs).

The process of verifying the identity of a user, device, or system. Common methods include passwords, multi-factor authentication (MFA), certificates (PIV/CAC), and OAuth tokens.

The process of determining what actions an authenticated user or system is permitted to perform. Implemented through role-based access control (RBAC), attribute-based policies, or capability lists.

The use of scripts, pipelines, and tools to perform repetitive tasks without manual intervention. In software development, this includes CI/CD, testing, deployment, and infrastructure provisioning.

axe-core Accessibility Testing Engine

An open-source accessibility testing library by Deque Systems that automatically detects common WCAG violations. Can run in browsers, CI/CD pipelines, and testing frameworks.

Business Continuity Plan

A documented strategy ensuring that critical business functions can continue during and after a disaster or disruption. Required by many compliance frameworks including FedRAMP and FISMA.

bcrypt Password Hashing

A password hashing algorithm designed to be computationally expensive, making brute-force attacks impractical. Includes automatic salting and configurable cost factors.

Block Element Modifier

A CSS naming convention that creates clear, strict relationships between HTML and CSS. Format: block__element--modifier (e.g., card__title--highlighted).

Breadcrumb Navigation

A secondary navigation pattern showing the user's location within a site hierarchy (e.g., Home > Resources > Glossary). Improves wayfinding and satisfies WCAG 2.4.8 (Location). Often marked up with schema.org BreadcrumbList.

Web Browser

A software application for accessing the World Wide Web. Renders HTML, CSS, and executes JavaScript. Major engines include Chromium (Blink), Firefox (Gecko), and Safari (WebKit).

Module Bundler

A build tool that combines multiple JavaScript modules and assets into optimized bundles for production deployment. Examples include Vite, Webpack, Rollup, and esbuild.

The practice of storing copies of data in a temporary storage location (cache) so future requests can be served faster. Includes browser caching, CDN caching, service worker cache, and server-side caching.

California Consumer Privacy Act

A California state privacy law granting consumers rights over their personal data, including the right to know, delete, and opt out of data sales. Often considered alongside GDPR for privacy compliance.

Content Delivery Network

A geographically distributed network of servers that delivers web content to users from the nearest location, improving load times and reducing server load.

Contract Data Requirements List

A list that identifies all data deliverables required under a government contract. Each item references a Data Item Description (DID) specifying format and content requirements.

Change Log

A file containing a chronologically ordered list of notable changes for each version of a project. Follows the Keep a Changelog format with Added, Changed, Deprecated, Removed, Fixed, Security sections.

Continuous Integration / Continuous Deployment

An automated software development practice where code changes are automatically built, tested, and deployed. CI validates every commit; CD pushes validated code to production.

Cybersecurity and Infrastructure Security Agency

A U.S. federal agency under DHS responsible for protecting critical infrastructure from cybersecurity threats. CISA publishes advisories, vulnerability alerts, and security best practices.

Cumulative Layout Shift

A Core Web Vital metric measuring visual stability by quantifying how much page content shifts unexpectedly during loading. A low CLS score indicates a more stable, user-friendly experience.

Cybersecurity Maturity Model Certification

A DoD certification framework that measures a contractor's cybersecurity practices across three levels. Required for defense contractors handling CUI (Level 2) or classified information (Level 3).

Capability Maturity Model Integration

A process improvement framework that helps organizations improve performance. Five maturity levels from Initial (chaotic) to Optimizing (continuous improvement).

Content Management System

Software that enables users to create, manage, and publish digital content without requiring deep technical knowledge. In government, CMS platforms must meet accessibility and security requirements.

A measure of how well source code adheres to coding standards, best practices, and maintainability metrics. Enforced through linters (ESLint), formatters (Prettier), type checkers, and code reviews.

CodeQL Static Analysis

A semantic code analysis engine by GitHub that treats code as data, querying it like a database to find security vulnerabilities and code quality issues.

Cognitive and Learning Disabilities Accessibility

W3C guidelines for making web content accessible to people with cognitive and learning disabilities. Recommendations include clear language, consistent navigation, error prevention, and reduced complexity.

WCAG Color Contrast Ratio

The ratio of luminance between foreground text and background color. WCAG AA requires 4.5:1 for normal text and 3:1 for large text. WCAG AAA requires 7:1 and 4.5:1.

Regulatory Compliance

Adherence to laws, regulations, standards, and policies that govern how organizations operate. In federal IT, key frameworks include FedRAMP, CMMC, FISMA, Section 508, and NIST 800-171.

A collection of reusable, documented UI components that implement a design system. Ensures visual consistency, accessibility compliance, and development efficiency across an application.

Continuous Monitoring

The ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. Required by FedRAMP and FISMA for maintaining an ATO.

Government Contracting

The process by which federal agencies procure goods and services, governed by the Federal Acquisition Regulation (FAR) and agency-specific supplements like DFARS. Includes requirements for accessibility (Section 508) and cybersecurity (CMMC).

HTTP Cookie

A small piece of data stored by the browser and sent with subsequent HTTP requests. Used for session management, authentication tokens, and user preferences. Security flags include HttpOnly, Secure, and SameSite.

Contracting Officer Representative

A government employee designated by the contracting officer to assist in managing and monitoring contractor performance on a specific contract.

Cross-Origin Resource Sharing

A browser security mechanism that controls how web pages in one domain can request resources from another domain. Configured via HTTP headers (Access-Control-Allow-Origin).

Code Coverage

A metric measuring the percentage of source code executed during automated testing. Includes line, branch, function, and statement coverage. Tools include V8 (built into Vitest), Istanbul/NYC, and c8.

Create, Read, Update, Delete

The four basic operations for persistent data storage. Most web application features map to CRUD operations on database records via API endpoints.

Content Security Policy

An HTTP response header that restricts which resources (scripts, styles, images, etc.) a browser is allowed to load for a page. A critical defense against cross-site scripting (XSS) attacks.

Cross-Site Request Forgery

An attack that tricks a user's browser into making unwanted requests to a site where they're authenticated. Prevented with anti-CSRF tokens or SameSite cookie attributes.

Cascading Style Sheets

A stylesheet language for controlling the visual presentation of HTML documents — layout, colors, typography, animations, and responsive design.

Controlled Unclassified Information

Government-created or -owned information that requires safeguarding or dissemination controls consistent with applicable laws, regulations, and government-wide policies. Defined by 32 CFR Part 2002.

Common Vulnerabilities and Exposures

A standardized system for identifying and naming publicly known cybersecurity vulnerabilities. Each CVE ID (e.g., CVE-2024-1234) uniquely identifies a specific vulnerability.

Common Vulnerability Scoring System

A standardized framework for rating the severity of security vulnerabilities on a 0-10 scale. Used to prioritize remediation efforts (Critical: 9.0-10.0, High: 7.0-8.9).

Common Weakness Enumeration

A community-developed list of software and hardware weakness types. Unlike CVEs (specific vulnerabilities), CWEs categorize classes of weaknesses (e.g., CWE-79: XSS).

CycloneDX SBOM Standard

An OWASP standard for creating Software Bills of Materials in XML or JSON format. Captures component details, licenses, vulnerabilities, and dependency relationships.

Dynamic Application Security Testing

Automated security testing that analyzes a running application by sending crafted requests and observing responses. Finds vulnerabilities that only appear at runtime.

An organized collection of structured data stored electronically. Types include relational (SQL), document (NoSQL), key-value, and graph databases. This project uses SQLite via sql.js.

Distributed Denial of Service

An attack that overwhelms a server with traffic from many sources simultaneously, making the service unavailable to legitimate users. Mitigated with rate limiting, CDNs, and WAFs.

Software Dependencies

External packages or libraries that a project relies on to function. Managed via package managers (npm, pip). Must be audited for vulnerabilities and tracked in an SBOM for supply chain security.

Reusable solutions to commonly occurring problems in software design. Includes creational (factory, singleton), structural (adapter, decorator), and behavioral (observer, strategy) patterns.

Design System

A collection of reusable components, design tokens (colors, spacing, typography), and guidelines that ensure consistency across a product. Think of it as a visual vocabulary for your application.

Design Tokens

Named values (colors, spacing, typography, shadows) that represent the visual atoms of a design system. Stored as CSS custom properties, JSON, or YAML and consumed across platforms.

Desktop Application

A software application that runs natively on a computer's operating system (Windows, macOS, Linux). Modern approaches like Tauri and Electron allow building desktop apps with web technologies.

Development and Operations

A set of practices combining software development (Dev) and IT operations (Ops) to shorten the development lifecycle through automation, continuous delivery, and collaborative culture.

Development, Security, and Operations

An approach that integrates security practices into every phase of the software development lifecycle, rather than treating security as an afterthought. Essential for government and compliance-driven projects.

Defense Federal Acquisition Regulation Supplement

Supplemental acquisition regulations specific to the Department of Defense. DFARS 252.204-7012 requires defense contractors to implement NIST 800-171 controls and report cyber incidents within 72 hours.

Department of Homeland Security

The federal department responsible for public security. Publishes the Trusted Tester conformance process for Section 508 accessibility testing.

Data Item Description

A standardized document template that specifies the format, content, and preparation instructions for a data deliverable required by a government contract.

Defense Information Systems Agency

A DoD combat support agency that provides IT and communications support. Publishes STIGs and manages the DoD Information Network (DoDIN).

DomainKeys Identified Mail

An email authentication method that uses cryptographic signatures to verify that a message was sent by the domain it claims to be from and was not altered in transit.

Domain-based Message Authentication, Reporting, and Conformance

An email authentication protocol that builds on SPF and DKIM to protect domains from spoofing and phishing. Federal agencies are required to implement DMARC under BOD 18-01.

Domain Name System

The internet's phone book — translates human-readable domain names (example.com) into IP addresses that computers use to route traffic.

Digital Document

An electronic file containing structured or unstructured information. Accessible document formats include tagged PDF (PDF/UA), HTML, and structured Word documents with proper heading hierarchies.

Written materials that describe a software system's architecture, APIs, usage, and processes. Includes READMEs, ADRs, changelogs, API docs, user guides, and compliance documentation.

Department of Defense

The executive branch department responsible for national security and the United States Armed Forces. Sets cybersecurity and acquisition standards for all defense contractors.

Department of Defense Information Network

The globally interconnected information infrastructure operated by the DoD, including networks, computing resources, and services. DISA manages DoDIN security through STIGs and continuous monitoring.

Document Object Model

A programming interface that represents an HTML or XML document as a tree of objects. JavaScript uses the DOM API to dynamically read and modify page content.

Digital Operational Resilience Act

An EU regulation requiring financial entities to ensure they can withstand, respond to, and recover from ICT-related disruptions. DORA establishes requirements for risk management, incident reporting, and third-party oversight.

Disaster Recovery Plan

A documented process for recovering IT systems and data after a catastrophic event. DRPs define recovery time and recovery point objectives to minimize downtime and data loss.

End-to-End

Refers to processes or testing that covers the entire workflow from start to finish. In development, E2E testing validates complete user flows; in security, E2E encryption ensures data is protected throughout transmission.

Export Administration Regulations

U.S. regulations administered by the Bureau of Industry and Security governing the export of dual-use commercial items, software, and technology. Often relevant alongside ITAR for defense and technology contractors.

Vector Embeddings

Numerical representations (arrays of numbers) that capture the semantic meaning of text, images, or other data. Similar items have similar embeddings, enabling semantic search.

Data Encryption

The process of converting plaintext data into an unreadable format (ciphertext) using a cryptographic algorithm and key. Data should be encrypted both at rest (stored) and in transit (transmitted).

Executive Order 14028: Improving the Nation's Cybersecurity

A 2021 executive order mandating enhanced cybersecurity practices for federal agencies and their software suppliers, including SBOM requirements, zero trust architecture, and enhanced logging.

ESLint JavaScript Linter

A static analysis tool that identifies problematic patterns in JavaScript code. Enforces coding standards, catches bugs early, and improves code quality through configurable rules.

ECMAScript Modules

The official JavaScript module system using import/export syntax. Supported natively in modern browsers and Node.js. Replaces CommonJS (require/module.exports) in modern code.

Expo React Native Framework

A framework and platform for building React Native mobile apps with simplified configuration, OTA updates, and managed build services for iOS and Android.

Express.js Web Framework

A minimal, flexible Node.js web framework that provides HTTP utilities and middleware for building web applications and APIs. The most popular Node.js framework.

Federal Acquisition Regulation

The primary set of rules governing federal government procurement. Establishes uniform policies and procedures for acquiring supplies and services by executive agencies.

Federal Risk and Authorization Management Program

A government-wide program that standardizes the security assessment, authorization, and continuous monitoring of cloud products and services used by federal agencies.

Family Educational Rights and Privacy Act

A federal law protecting the privacy of student education records. Organizations handling educational data must comply with FERPA requirements for data access, disclosure, and consent.

Federal Information Processing Standards

Standards issued by NIST for use in federal computer systems. FIPS 140-2/3 validates cryptographic modules; FIPS 199 categorizes information systems by impact level.

Federal Information Security Modernization Act

A federal law requiring agencies to develop, document, and implement an information security program to protect their information and information systems.

Keyboard Focus Management

The practice of controlling which element receives keyboard focus during user interactions, especially in dynamic UIs (modals, menus, SPAs). Critical for keyboard and screen reader users.

Freedom of Information Act

A federal law granting the public the right to request access to records from any federal agency. FOIA is a cornerstone of government transparency and open data initiatives.

Code Formatting

The automatic application of consistent coding style rules (indentation, spacing, line length, quotes) to source code. Prettier is the standard formatter for JavaScript/TypeScript projects.

General Data Protection Regulation

The European Union's comprehensive data privacy regulation establishing strict requirements for how organizations collect, store, process, and transfer personal data of EU residents. Non-compliance can result in significant fines.

Git Version Control System

A distributed version control system that tracks changes to files and enables collaboration. The industry standard for source code management.

A cloud-based platform for version control and collaboration using Git. Provides repositories, pull requests, issues, Actions (CI/CD), Packages, and Copilot AI assistance.

GitHub Actions CI/CD

GitHub's built-in CI/CD platform that automates build, test, and deployment workflows directly from your repository. Triggered by events like pushes and pull requests.

U.S. Federal Government

The national governing body of the United States, comprising executive agencies and departments that procure technology solutions subject to regulations like FedRAMP, Section 508, FISMA, and CMMC.

Government Publishing Office Style Manual

The official style guide for U.S. government publications covering capitalization, abbreviations, numbers, punctuation, and document formatting conventions.

Governance, Risk, and Compliance

An integrated approach to managing an organization's governance structure, risk exposure, and regulatory compliance obligations. GRC platforms help streamline audits, policy management, and control assessments.

Cryptographic Hashing

A one-way function that converts input data into a fixed-length string. Used for password storage (bcrypt) and data integrity verification. Unlike encryption, hashing cannot be reversed.

Helmet.js Security Headers

An Express.js middleware that sets various HTTP security headers including Content-Security-Policy, X-Content-Type-Options, Strict-Transport-Security, and others.

Human Interface Guidelines

Platform-specific design guidelines published by Apple (iOS/macOS) and Google (Material Design/Android) that define conventions for app design, interaction patterns, and visual style.

Health Insurance Portability and Accountability Act

A U.S. federal law establishing national standards for protecting sensitive patient health information. Organizations handling protected health information (PHI) must implement administrative, physical, and technical safeguards.

HTTP Strict Transport Security

A web security policy mechanism that forces browsers to interact with a site only over HTTPS, preventing protocol downgrade attacks and cookie hijacking. Required by many federal security baselines.

HyperText Markup Language

The standard markup language for creating web pages. HTML5 added semantic elements (header, nav, main, footer), form controls, multimedia, and accessibility features.

HyperText Transfer Protocol

The foundational protocol for data communication on the web. HTTP/2 adds multiplexing and header compression; HTTP/3 uses QUIC for improved performance.

HyperText Transfer Protocol Secure

HTTP encrypted with TLS (Transport Layer Security). Required for all government websites and any site handling sensitive data. Prevents eavesdropping and tampering.

Information Architecture

The structural design of shared information environments — organizing, labeling, and navigating content so users can find what they need. The blueprint for a website's structure.

Identity and Access Management

A framework of policies and technologies ensuring the right individuals have appropriate access to technology resources. IAM encompasses authentication, authorization, and user lifecycle management.

Information and Communications Technology

An umbrella term for all technologies used to handle information and enable communication. Section 508 applies to all ICT procured or used by federal agencies.

Integrated Development Environment

A software application providing comprehensive tools for software development, typically including a code editor, debugger, build automation, and version control integration in a single interface.

FIPS 199 Impact Level

A categorization (Low, Moderate, High) of potential impact if a security breach occurred. Determines which security controls apply. Most CUI systems are Moderate impact.

IT Infrastructure

The foundational technology components—servers, networks, storage, and cloud services—that support software applications. Infrastructure as Code (IaC) manages these resources through version-controlled configuration files.

Injection Attack

A class of attacks where untrusted data is sent to an interpreter as part of a command or query (SQL injection, command injection, LDAP injection). #1 on OWASP Top 10 for years.

Mobile Operating Systems

The two dominant mobile operating systems. iOS (Apple) and Android (Google) power smartphones and tablets. Cross-platform frameworks like React Native and Expo allow targeting both from a single codebase.

ISO/IEC 27001 Information Security

An international standard for information security management systems (ISMS). Provides a systematic approach to managing sensitive company information to ensure it remains secure.

International Traffic in Arms Regulations

U.S. regulations controlling the export and import of defense-related articles and services on the United States Munitions List. ITAR compliance is mandatory for organizations handling defense technologies.

Inverted Triangle CSS

A CSS architecture methodology that organizes styles from generic to specific in layers: Settings → Tools → Generic → Elements → Objects → Components → Utilities. Prevents specificity wars.

Joint Authorization Board

The primary governance body for FedRAMP, comprising CIOs from DHS, DoD, and GSA. The JAB reviews and grants provisional authorities to operate (P-ATOs) for cloud service providers.

A high-level, interpreted programming language that is one of the core technologies of the World Wide Web. Used for client-side interactivity, server-side development (Node.js), and full-stack applications.

JavaScript Object Notation

A lightweight, human-readable data interchange format that uses key-value pairs and arrays. The standard format for API responses and configuration files.

JSON for Linking Data

A method of encoding structured data using JSON. The preferred format by Google for embedding Schema.org markup in web pages via <script type='application/ld+json'> tags.

JSON Web Token

A compact, URL-safe token format used for securely transmitting claims between parties. Commonly used for stateless authentication in web applications.

Kanban Method

A visual workflow management method that uses boards and cards to track work items through stages (To Do → In Progress → Done). Emphasizes continuous flow and limiting work in progress.

The ability to operate all interactive elements of a web page using only the keyboard. Required by WCAG 2.1.1 (Keyboard) and essential for users of screen readers, switch devices, and those with motor impairments.

Key Performance Indicator

A measurable value demonstrating how effectively an organization is achieving key business objectives. In government contracting, KPIs track project delivery, compliance milestones, and service quality.

Largest Contentful Paint

A Core Web Vital metric measuring the time it takes for the largest visible content element to render on screen. A fast LCP (under 2.5 seconds) indicates good perceived loading performance.

Software License

A legal instrument governing the use, modification, and distribution of software. Common open-source licenses include MIT, Apache 2.0, GPL, and BSD. SPDX identifiers provide standard license naming.

Google Lighthouse

An open-source tool that audits web pages for performance, accessibility, best practices, SEO, and PWA compliance. Scores each category 0-100 and provides actionable improvement suggestions.

Static Code Analysis

The automated process of analyzing source code for potential errors, style violations, and anti-patterns without executing it. ESLint is the standard linter for JavaScript/TypeScript projects.

ARIA Live Region

An HTML element with aria-live attribute that announces dynamic content changes to screen readers without requiring focus change. Used for status messages, errors, and notifications.

Large Language Model

An AI model trained on vast amounts of text data that can understand and generate human-like text. Examples include GPT-4, Claude, and Gemini. The foundation for modern AI assistants.

Web App Manifest

A JSON file (manifest.json) that provides metadata about a Progressive Web App—name, icons, theme color, display mode, and start URL. Required for PWA installability.

Material Design System

Google's design system providing comprehensive guidelines, components, and tools for creating consistent, high-quality digital experiences across Android, web, and other platforms.

Mission-Based Agentic Intelligence

A methodology framework that combines traditional MBA strategic principles with AI-driven agentic workflows. The core intellectual property of the Structured for Growth platform.

CSS Media Queries

CSS rules that apply styles conditionally based on device characteristics such as viewport width, orientation, color scheme preference, and reduced-motion preference. Foundation of responsive design.

Mega Menu Navigation Pattern

A large dropdown navigation panel that displays multiple groups of links in a structured layout. Useful when a site has many sections that need to be organized into categories.

HTML Meta Elements

HTML elements in the <head> section that provide metadata about a web page—description, viewport settings, character encoding, Open Graph properties, and Twitter Card data.

A structured system of practices, techniques, and principles used to guide software development. Includes Agile, Scrum, Kanban, and domain-specific approaches like MBAi for AI-augmented workflows.

Multi-Factor Authentication

An authentication method requiring two or more verification factors (something you know, have, or are). Required by NIST 800-171 and CMMC Level 2 for all CUI access.

Middleware Function

A function that sits between a request and response in a web application, performing tasks like authentication, logging, error handling, or data transformation before passing control to the next function.

Military Standard for Software Development and Documentation

A DoD standard that establishes uniform requirements for software development and documentation. Defines 15 Data Item Descriptions (DIDs) for software lifecycle deliverables.

Mobile Development

The creation of applications for smartphones and tablets. Approaches include native (Swift/Kotlin), hybrid (React Native/Expo), and progressive web apps (PWAs) that work across platforms.

Mobile-First Design

A design strategy that starts with the smallest screen size and progressively enhances for larger viewports. Ensures core content and functionality are available on all devices.

Data Model

A representation of data structures and their relationships used by an application. In MVC architecture, the model manages data, business logic, and database interactions.

National Archives and Records Administration

The federal agency responsible for preserving government records and maintaining the CUI Registry. NARA defines CUI categories and marking requirements.

North Atlantic Treaty Organization

An intergovernmental military alliance of 32 member states. In technology contexts, NATO standards and phonetic alphabet conventions are frequently referenced in defense and government systems.

Website Navigation

The system of menus, links, and wayfinding elements that help users find content within a website. Must be consistent (WCAG 3.2.3), have multiple ways to find pages (WCAG 2.4.5), and be fully keyboard accessible.

Computer Networking

The practice of connecting computing devices to share resources and communicate. Includes protocols (HTTP, DNS, TLS), infrastructure (CDN, load balancers), and security (firewalls, WAF, zero trust).

National Institute of Standards and Technology

A federal agency within the U.S. Department of Commerce that develops technology standards, measurement methods, and cybersecurity frameworks used across government and industry.

Protecting Controlled Unclassified Information in Nonfederal Systems

Defines 110 security requirements for protecting CUI in nonfederal systems. The security baseline for CMMC Level 2 and DFARS 252.204-7012 compliance.

Zero Trust Architecture

A NIST publication defining the principles and deployment models for Zero Trust Architecture. Mandated by EO 14028 for federal agencies.

NIST Special Publication 800-53: Security and Privacy Controls

A comprehensive catalog of security and privacy controls for federal information systems. Contains over 1,000 controls organized into 20 families. The foundation for FedRAMP and most federal security frameworks.

Natural Language Processing

A branch of artificial intelligence focused on enabling computers to understand, interpret, and generate human language. Underpins chatbots, sentiment analysis, translation, and large language models.

Node.js JavaScript Runtime

A JavaScript runtime built on Chrome's V8 engine that allows running JavaScript on servers. Powers the backend of this platform using the Express.js framework.

Node Package Manager

The default package manager for Node.js that manages project dependencies. The npm registry hosts over 2 million packages of reusable JavaScript code.

National Vulnerability Database

A NIST-maintained repository of security vulnerability data enriched with CVSS severity scores, CWE classifications, and affected product information.

Open Authorization

An authorization framework that enables third-party applications to obtain limited access to a web service without exposing user credentials. OAuth 2.0 is the current version.

Office for Civil Rights

The division within the U.S. Department of Health and Human Services responsible for enforcing HIPAA privacy and security rules. OCR investigates complaints and conducts compliance reviews.

Offline Support

The ability of a web application to function without a network connection using cached assets and data. Implemented through service workers, Cache API, and IndexedDB in Progressive Web Apps.

Office of Management and Budget

A White House office that issues policy guidance to federal agencies. OMB M-24-08 mandated WCAG 2.1 AA compliance for all federal websites by June 2025.

Open Graph Protocol

A protocol (og:title, og:description, og:image) that controls how URLs are displayed when shared on social media. Essential for professional social sharing appearance.

OpenAPI Specification

A standard, language-agnostic format for describing REST APIs. Version 3.0+ enables auto-generation of documentation (Swagger UI), client SDKs, and server stubs.

WCAG Principle: Operable

The second WCAG principle — UI components and navigation must be operable by all users. Covers keyboard access, sufficient time, seizure prevention, and navigation aids.

WCAG Principle: Operable

The second WCAG principle requiring that user interface components and navigation must be operable. Covers keyboard access, sufficient time, seizure prevention, and navigability.

Object-Relational Mapping

A programming technique that maps database tables to objects in code, allowing developers to interact with databases using their programming language instead of raw SQL.

Open Security Controls Assessment Language

A standardized, machine-readable format developed by NIST for expressing security control catalogs, baselines, system security plans, and assessment results.

Open Worldwide Application Security Project

A nonprofit foundation that publishes security guidelines, tools, and the widely-referenced OWASP Top 10 list of critical web application security risks.

Zed Attack Proxy

An open-source dynamic application security testing (DAST) tool maintained by OWASP. Automatically finds security vulnerabilities in web applications by intercepting and analyzing HTTP traffic.

Provisional Authority to Operate

A conditional authorization granted by the JAB allowing a cloud service provider to operate within the federal government. Agencies can leverage a P-ATO to issue their own ATOs more efficiently.

The manifest file for Node.js projects that defines project metadata, scripts, dependencies, and configuration. Central to the npm ecosystem and used by tools like Vite, ESLint, and Prettier.

A secret string used for authentication. Best practices include minimum 12 characters, bcrypt hashing with salt, breach database checking, and pairing with multi-factor authentication per NIST SP 800-63B.

Payment Card Industry Data Security Standard

A set of security standards ensuring that organizations accepting, processing, or storing credit card information maintain a secure environment. PCI DSS compliance is mandatory for payment-handling systems.

PDF Universal Accessibility

An ISO standard (ISO 14289) for creating accessible PDF documents with proper tagging, reading order, alternative text, and navigation structure.

Penetration Testing

An authorized simulated cyberattack performed to evaluate the security of a system. Required annually for FedRAMP systems and recommended for any system handling sensitive data.

WCAG Principle: Perceivable

The first WCAG principle — information and UI components must be presentable to users in ways they can perceive. Covers text alternatives, captions, adaptable content, and distinguishable colors.

WCAG Principle: Perceivable

The first WCAG principle requiring that information and interface components must be presentable in ways users can perceive. Covers text alternatives, captions, adaptable layout, and distinguishable content.

Web Performance

The speed and responsiveness of a web application as measured by metrics like Largest Contentful Paint (LCP), First Input Delay (FID), Cumulative Layout Shift (CLS), and Time to Interactive (TTI).

Personally Identifiable Information

Any data that could identify a specific individual, such as names, Social Security numbers, or biometric records. Protecting PII is central to HIPAA, GDPR, CCPA, and federal privacy requirements.

Personal Identity Verification / Common Access Card

Smart-card credential systems used by U.S. federal agencies (PIV, FIPS 201) and the Department of Defense (CAC) for physical and logical access control. Provides multi-factor authentication via certificate-based identity.

Public Key Infrastructure

A framework for managing digital certificates and public-key encryption that enables secure electronic communication. PKI underpins TLS, code signing, email encryption, and PIV/CAC authentication in government systems.

Plain Writing Act of 2010

A U.S. federal law requiring government agencies to write public documents in clear, concise, well-organized language. Applies to regulations, guidance, forms, and web content.

Plan of Action and Milestones

A document identifying tasks to correct security weaknesses, the resources required, and a scheduled completion timeline. Required for any system with known security deficiencies seeking or maintaining an ATO.

Prettier Code Formatter

An opinionated code formatter that enforces consistent style by parsing and reprinting code. Supports JavaScript, TypeScript, HTML, CSS, JSON, and Markdown.

The systematic approach to enhancing organizational workflows, reducing waste, and increasing quality. Frameworks include CMMI, Six Sigma, Lean, and continuous improvement (Kaizen) methodologies.

Prompt Engineering

The practice of designing and optimizing input prompts to get desired outputs from LLMs. Techniques include few-shot examples, chain-of-thought reasoning, and system prompts.

Progressive Web App

A web application that uses modern browser features (service workers, manifests, caching) to deliver app-like experiences including offline access, push notifications, and home screen installation.

Software Quality

The degree to which a software product meets specified requirements and user expectations. Encompasses functional correctness, reliability, performance efficiency, security, maintainability, and accessibility.

Retrieval-Augmented Generation

A technique that enhances LLM responses by first retrieving relevant documents from a knowledge base, then using them as context for generation. Reduces hallucinations and keeps responses grounded in facts.

API Rate Limiting

A technique that controls the number of requests a client can make to an API within a time window. Prevents abuse, brute-force attacks, and ensures fair resource usage.

Role-Based Access Control

An access control method where permissions are assigned to roles, and users are assigned to roles. Simplifies permission management compared to assigning permissions directly to users.

A JavaScript framework for building native mobile applications using React. Allows sharing business logic across iOS and Android while rendering native platform UI components.

A measure of how easy text is to read and understand, assessed by formulas like Flesch-Kincaid, Gunning Fog, and SMOG. Federal plain-language guidelines target 6th–8th grade reading level.

The systematic control of records throughout their lifecycle—creation, maintenance, use, and disposition. Federal agencies must comply with NARA regulations (36 CFR 1220-1239) for electronic records.

Software Release

A specific version of software made available for use. Follows semantic versioning (SemVer) conventions and is documented in changelogs. CI/CD pipelines automate the build, test, and deploy steps.

Responsive Web Design

An approach to web design that makes pages render well on a variety of devices and screen sizes using fluid grids, flexible images, and CSS media queries.

Responsive Web Design

A design approach where web pages automatically adjust their layout, images, and content to fit different screen sizes and devices. Uses CSS media queries, flexible grids, and fluid images.

Representational State Transfer

An architectural style for designing web services that uses standard HTTP methods and stateless communication. RESTful APIs are the most common approach for web application backends.

Google Rich Results

Enhanced search engine results that display additional information (ratings, FAQs, breadcrumbs, events) extracted from structured data markup (schema.org JSON-LD) embedded in web pages.

Row-Level Security

A database feature that restricts data access at the row level based on user identity or role. RLS is critical for multi-tenant applications and systems handling sensitive government or health data.

Risk Management Framework

A NIST framework (SP 800-37) for managing security and privacy risk through six steps: Categorize, Select, Implement, Assess, Authorize, Monitor.

WCAG Principle: Robust

The fourth WCAG principle — content must be robust enough to be interpreted by a wide variety of user agents, including assistive technologies. Covers valid markup and name/role/value.

WCAG Principle: Robust

The fourth WCAG principle requiring that content must be robust enough to be interpreted by a wide variety of user agents, including assistive technologies. Covers proper parsing and ARIA usage.

Return on Investment

A financial metric measuring the profitability of an investment relative to its cost. In government IT, ROI analysis helps justify technology modernization and compliance spending.

A JavaScript module bundler that compiles small pieces of code into larger, optimized bundles. Used internally by Vite for production builds. Excels at tree-shaking to eliminate dead code.

Recovery Point Objective

The maximum acceptable amount of data loss measured in time. RPO defines how far back in time data must be recoverable after a disruption, driving backup frequency decisions.

Recovery Time Objective

The maximum acceptable duration for restoring a system or service after a disruption. RTO drives infrastructure and disaster recovery architecture decisions.

A systems programming language focused on safety, speed, and concurrency. Used by Tauri for building lightweight desktop applications and by many security-critical tools due to its memory safety guarantees.

Security Assertion Markup Language

An XML-based standard for exchanging authentication and authorization data between identity providers and service providers. SAML enables single sign-on for enterprise and government applications.

Static Application Security Testing

Automated analysis of source code to find security vulnerabilities without executing the program. Tools like CodeQL and Semgrep scan code for known vulnerability patterns.

Software Bill of Materials

A formal, machine-readable inventory of all software components, libraries, and dependencies in a product. Required by Executive Order 14028 for software sold to the federal government.

Security Content Automation Protocol

A suite of NIST specifications for automating vulnerability management, security measurement, and compliance evaluation. SCAP enables standardized communication of security configuration and vulnerability data.

Schema.org Structured Data

A collaborative vocabulary for structured data markup on web pages. Search engines use it to understand page content and generate rich results (star ratings, FAQs, breadcrumbs).

Software Configuration Management

The discipline of tracking and controlling changes in software, including version control, build management, and release engineering. SCM ensures traceability and reproducibility required by compliance frameworks.

Screen Reader Assistive Technology

Software that converts on-screen text and interface elements into speech or braille output. Popular screen readers include JAWS, NVDA (Windows), and VoiceOver (macOS/iOS).

Scrum Framework

An Agile framework using fixed-length iterations (sprints, typically 2 weeks) with defined roles (Product Owner, Scrum Master, Developers) and ceremonies (standups, reviews, retrospectives).

Software Development Life Cycle

The process of planning, creating, testing, and deploying software. Common models include Waterfall, Agile, and DevOps. Security should be integrated at every phase (shift-left).

Section 508 of the Rehabilitation Act

A federal law requiring all information and communications technology (ICT) developed, procured, maintained, or used by federal agencies to be accessible to people with disabilities.

Information Security

The practice of protecting information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Encompasses confidentiality, integrity, and availability (CIA triad).

HTTP Security Headers

HTTP response headers that enhance web application security. Includes Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.

The process of identifying vulnerabilities in software through static analysis (SAST), dynamic analysis (DAST), penetration testing, and dependency scanning. Required by CMMC and FedRAMP.

Semantic HTML Elements

HTML elements that carry meaning about the content they contain (header, nav, main, article, section, aside, footer). Improves accessibility, SEO, and code readability compared to generic divs.

Semantic Versioning

A versioning scheme using MAJOR.MINOR.PATCH format. MAJOR = breaking changes, MINOR = new features (backward-compatible), PATCH = bug fixes. Example: 2.1.0.

Search Engine Optimization

The practice of improving a website's visibility in search engine results through technical optimization, content quality, and link building. Includes meta tags, structured data, and page speed.

Service Worker API

A JavaScript script that runs in the background, separate from a web page. Enables features like offline caching, push notifications, and background sync for PWAs.

Shift-Left Testing

The practice of performing testing, security analysis, and quality checks earlier in the development process rather than waiting until deployment. Catches issues when they're cheapest to fix.

Security Information and Event Management

A platform that aggregates and analyzes security event data from across an organization's infrastructure in real time. SIEM systems are essential for threat detection, incident response, and compliance reporting.

XML Sitemap

A file that lists all important pages of a website to help search engines discover and index content. Also refers to the visual representation of a site's information architecture.

Skip Navigation Link

A hidden link at the top of a page that becomes visible on focus, allowing keyboard users to skip repetitive navigation and jump directly to the main content.

Service Level Agreement

A contract defining the expected level of service between a provider and a customer, including uptime guarantees, response times, and performance metrics. SLAs are standard in government IT contracts.

Security Operations Center

A centralized facility where security analysts monitor, detect, and respond to cybersecurity incidents. SOC also refers to SOC 2 audit reports, which verify a service provider's security controls and practices.

Sarbanes-Oxley Act

A U.S. federal law mandating strict financial reporting and internal control requirements for public companies. SOX compliance requires IT controls around data integrity, access management, and audit trails.

Single-Page Application

A web application that loads a single HTML page and dynamically updates content without full page reloads. Provides app-like experience but requires careful SEO and accessibility handling.

Software Package Data Exchange

A Linux Foundation standard for communicating software component information including licenses, copyrights, and security references. An alternative to CycloneDX for SBOMs.

Sender Policy Framework

An email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on their behalf. SPF helps prevent email spoofing and phishing attacks.

Sprint (Scrum)

A fixed time period (usually 1-4 weeks) during which a Scrum team commits to completing a set of work items. At the end, the team demonstrates working software.

Supplier Performance Risk System

A DoD web application where defense contractors submit their NIST 800-171 self-assessment scores. Required before contract award for contracts requiring DFARS 252.204-7019/7020.

Structured Query Language

A standard language for managing and querying relational databases. Common operations include SELECT (read), INSERT (create), UPDATE (modify), and DELETE (remove).

SQLite Embedded Database

A self-contained, serverless, zero-configuration relational database engine stored in a single file. Ideal for embedded applications, mobile apps, and development databases.

Secure Software Development Framework

NIST SP 800-218 — a set of practices for producing secure software. Required by EO 14028 for software suppliers to federal agencies. Covers governance, design, implementation, and response.

Secure Sockets Layer / Transport Layer Security

Cryptographic protocols that provide secure communication over a network. SSL is deprecated; TLS 1.2+ is the current standard. Enables HTTPS by encrypting data between client and server.

Single Sign-On

An authentication scheme allowing users to log in once and access multiple applications without re-entering credentials. SSO improves security and user experience in enterprise and government environments.

System Security Plan

A formal document describing how security controls are implemented in an information system. The cornerstone document for any ATO package.

Server-Side Rendering

Rendering web pages on the server before sending them to the browser. Improves initial load time and SEO compared to client-side rendering. Used by Next.js, Nuxt, and SvelteKit.

State Risk and Authorization Management Program

A nonprofit program modeled after FedRAMP that standardizes cloud security verification for state and local government. StateRAMP provides a consistent framework for assessing cloud service provider security.

Security Technical Implementation Guide

Configuration standards published by DISA for hardening IT systems to meet DoD security requirements. STIGs exist for operating systems, databases, web servers, network devices, and applications.

Security Technical Implementation Guides

Configuration standards published by DISA that provide technical guidance for hardening information systems. Cover operating systems, databases, web servers, and applications.

Swagger API Documentation

A set of tools for designing, building, and documenting RESTful APIs. Swagger UI provides an interactive API explorer generated from an OpenAPI specification.

Tauri Desktop Framework

A Rust-based framework for building desktop applications using web technologies. Produces smaller, faster, more secure apps than Electron by using the OS's native webview.

Software Testing

The process of evaluating software to detect defects and verify that it meets requirements. Includes unit tests, integration tests, end-to-end tests, accessibility tests, and security tests.

The system for applying consistent visual styling across an application using design tokens (CSS custom properties). Supports multiple themes (dark/light mode) through token value overrides.

Transport Layer Security

A cryptographic protocol that provides secure communication over a network. TLS 1.2 is the minimum for government systems; TLS 1.3 is recommended.

Time-Based One-Time Password

An algorithm that generates a short-lived numeric code from a shared secret and the current time. Used with authenticator apps (Google Authenticator, Authy) for MFA.

Transformer Architecture

A deep learning model architecture based on self-attention mechanisms, introduced in the 2017 paper 'Attention Is All You Need.' Foundation for GPT, BERT, T5, and all modern large language models.

DHS Trusted Tester Process

A DHS-developed conformance testing process for Section 508 that provides standardized, repeatable procedures for evaluating ICT accessibility. Testers must pass a certification exam.

Meta tags (twitter:card, twitter:title, twitter:description, twitter:image) that control how a URL appears when shared on Twitter/X. Types include summary, summary_large_image, and player.

A programming language feature that prevents type errors by enforcing rules about how data types are used. TypeScript adds optional static type checking to JavaScript, catching bugs at compile time.

TypeScript Programming Language

A strict superset of JavaScript that adds static type checking. Catches type errors at compile time, improves IDE support, and makes large codebases more maintainable.

User Interface

The visual elements through which a user interacts with a software application — buttons, forms, menus, icons, typography, and layout.

WCAG Principle: Understandable

The third WCAG principle — information and operation of the UI must be understandable. Covers readable text, predictable behavior, and input assistance.

WCAG Principle: Understandable

The third WCAG principle requiring that information and the operation of the user interface must be understandable. Covers readable text, predictable behavior, and input assistance.

United States Army Corps of Engineers

A major command of the U.S. Army that provides engineering and construction services for military and civilian infrastructure. One of the largest public engineering organizations in the world.

U.S. Web Design System

A design system created by the U.S. government providing accessible, mobile-friendly components and design patterns for federal websites. USWDS ensures consistent user experience and Section 508 compliance.

User Experience

The overall experience a person has when interacting with a product, encompassing usability, accessibility, performance, design aesthetics, and emotional response.

Vector Database

A database optimized for storing and querying high-dimensional vectors (embeddings). Used in RAG systems to find semantically similar documents. Examples: Pinecone, Weaviate, Chroma.

A system for recording changes to files over time so specific versions can be recalled later. Git is the de facto standard, enabling branching, merging, and collaborative development workflows.

View Transitions API

A browser API that enables smooth animated transitions between different states of a web page or between pages. Creates native-app-like transition effects without JavaScript animation libraries.

Vite Build Tool

A modern frontend build tool that provides instant dev server startup using native ES modules and optimized production builds using Rollup. Significantly faster than Webpack.

Vitest Testing Framework

A Vite-native testing framework that provides a fast, modern alternative to Jest. Supports unit testing, integration testing, and code coverage with a Jest-compatible API.

Voluntary Product Accessibility Template

A document that explains how a technology product or service conforms to Section 508 accessibility standards. Required by federal procurement officers to evaluate whether a product meets accessibility requirements.

Virtual Private Network

A technology creating encrypted tunnels over public networks to provide secure remote access to private resources. VPNs are widely used in government and enterprise environments for secure connectivity.

Security Vulnerability

A weakness in a system that can be exploited by a threat actor to perform unauthorized actions. Tracked using CVE identifiers and scored using CVSS. Managed through patching, WAFs, and vulnerability scanning.

World Wide Web Consortium

An international community that develops open standards (HTML, CSS, WCAG, ARIA, etc.) to ensure the long-term growth and interoperability of the World Wide Web.

Web Application Firewall

A security device that monitors, filters, and blocks HTTP traffic to and from a web application. Protects against XSS, SQL injection, and other OWASP Top 10 attacks.

Web Content Accessibility Guidelines

A set of guidelines published by the W3C Web Accessibility Initiative that define how to make web content more accessible to people with disabilities. WCAG 2.1 AA is the current federal standard.

A system component that allows applications to display web content within a native app window. Tauri uses the OS WebView (WebView2 on Windows, WebKit on macOS) for rendering, resulting in tiny app bundles.

Cross-Site Scripting

A type of security vulnerability where an attacker injects malicious scripts into a trusted website, which then executes in other users' browsers. Consistently in the OWASP Top 10.

YAML Ain't Markup Language

A human-friendly data serialization format commonly used for configuration files (CI/CD pipelines, Kubernetes manifests, Ansible playbooks). Supports comments unlike JSON.

Zero Trust Architecture

A security model that assumes no implicit trust for any user, device, or network, whether inside or outside the organization's perimeter. Every access request must be verified.

Zero Trust Architecture

A security model requiring strict identity verification for every person and device attempting to access resources, regardless of network location. ZTA implements the principles defined in NIST SP 800-207.