In your plant, agree the terminology before you agree the technology

This is part 1 of 12 of the “Common language” series on industrial cybersecurity; it continues with part 2, safety or security.

In an industrial plant a word decides what gets tested, what gets bought and what gets reported. The problem is not poor communication; it is that the ambiguity lands somewhere expensive. In an engineering specification, a term carrying two meanings produces the wrong technical solution. In an audit, it changes the scope assessed. In a supplier contract, it becomes a dispute about what was agreed.

Industrial programmes agree the technology first — architecture, platform, supplier — and the terminology late, if ever. That is the wrong order: an asset inventory, an access policy, an incident procedure are each a sentence built out of terms, and none is more precise than the terms it uses.

Where the same word splits

• Between trades. Two functions use the same word and mean different things by it. Everyone knows they are translating, so someone usually asks. Safety and security are the pair — inseparable since IEC 61511-1 required a security risk assessment of the safety instrumented system (clause 8.2.4), and still not the same.
• Inside one trade. Worse, because nobody checks it: two engineers of the same discipline do not suspect a translation is happening. Two auditors can both report the scope was covered and be describing different systems.
• Across languages. A group writes its standard once in English, and every site reads it back into its own language, unreviewed, because officially that translation does not exist. Degrees of obligation travel as badly — the subject of part 4.

One cause behind the three: the meaning is decided locally, repeatedly, by whoever happens to be writing.

Four examples of what it costs

These come from documents a site already has on the shelf. They are not the subject of this article, only the evidence that it matters.

1. Separation, isolation, segmentation, segregation. The four appear interchangeably in architecture documents and describe four different states of the same boundary. NIST SP 800-82 Rev. 3 uses them without distinguishing them; a site that copies those words copies the ambiguity with them.

The line worth putting in the entry itself: a VLAN on its own does not provide segregation. What each state costs is the subject of the companion article on VLANs and zones.

2. Media, or device? The glossary of NIST SP 800-88r2 (2025) defines medium/media as material on which data may be recorded — including paper. Wider than anyone intends: a procedure written around media to control USB sticks has taken in every printed batch record on the site. The same glossary carries electronic media one page away, and the paper is gone.

3. A word that starts a legal clock. Under NIS 2, an incident meeting the threshold of significant obliges the entity to send an early warning within 24 hours and a fuller notification within 72 hours, counted from becoming aware of it; under the GDPR a personal data breach must be notified within 72 hours of awareness. Neither clock starts when the investigation concludes. The directive defines incident and near miss (Articles 6(6) and 6(5)) and sets the significant threshold separately (Article 23(3)); the word event, on which the ladder rests, it does not define. While the facts are uncertain the term should say so — without postponing the decision that matters, whether this is an incident.

4. Shall, should, may, can. The ISO/IEC drafting rules fix four verbal forms: shall is a requirement, should a recommendation, may a permission, can a possibility. Four lines in the reference, and a pile of prose becomes auditable. Skipping them is how strongly recommended means “do it” on one site and “optional” on another.

The deliverable is a controlled document

A glossary at the back of a standard changes nothing, because nobody has to follow it. What works is narrower: a controlled document that owns the meaning of the words, and a rule that no other document may define them itself. It carries a number, an owner, a revision and a change-control route, like any procedure. Two attributes are specific to it: each entry is individually citable, numbered so a procedure refers to it as it refers to a clause; and each entry carries its source, which lets a reviewer check it.

Ownership turns the document into a reference. Each term has an owner, answerable for the meaning, and a steward who keeps the entry accurate as systems and standards move. Every term travels the same four steps — proposal, review by the stewards, approval, publication under version control — and one that has not completed them is not a definition anyone can be held to.

Where the definitions come from

For the people on site, the company glossary is the first reference and the one that prevails — the standards are cited inside it, not instead of it. Almost nothing has to be invented: IEC’s own drafting guide tells its committees to check existing terms before defining a new one.

Level 4 is not a failure; it is the normal outcome for a real site, provided the entry is labelled internal so a reader knows whose authority it carries.

A found definition does not always settle the matter: it can be circular, written for another audience, or narrower than the site needs. Stay as close to the standard’s wording as it allows — and when that is not clear enough, prefer clarity. Three moves are legitimate, each marked in the entry: clarify, same scope, clearer wording; complete, adding as a separate sentence the case the standard leaves out; restrict, narrowing the scope and saying so. One move is not: changing what the term means while still citing the standard as its source.

How to write an entry that holds

The rules come from ISO 704 and ISO 10241-1, what standards drafters are held to themselves.

• The substitution test. A definition must be able to replace the term in context. Take a sentence from a procedure, swap the term for the definition, read it aloud. If it stops making sense, the definition is wrong, not the sentence.
• Say what kind of thing it is, then what makes it different. Name the broader concept, then the characteristics that delimit it. “A way of managing communication risk” names neither.
• No circles, and no requirements inside the sentence. An entry that uses the term it defines, or that only says what the concept excludes, leaves the reader where they started; an entry that says what must be done is a requirement hidden where nobody will audit it.
• One concept, one preferred term — and the old words kept. The words that lost stay in the entry, marked deprecated, so a search for the old word lands on the right concept. But a word people confuse with your term is not another designation of it; it is a different concept, and it belongs in the cross-reference field, never among the synonyms.

Where two functions already use a term differently, drafting alone will not settle it. One short session with both fixes four things at once: the meaning, the scope and what it excludes, the criterion where there is one, and the synonyms that stay acceptable.

One glossary per domain

A single company-wide glossary looks tidy and fails structurally: the same word legitimately carries different meanings in different fields. Asset is the clean case — ISO 55000 defines it around value to an organisation, ISA/IEC 62443-4-1 around objects inside an industrial control system. One puts a lease in your inventory, the other a firmware image.

So the reference is a set: one glossary per domain, each with a stated scope and a competent owner. Do not open them all at once — start where disagreement costs the most, usually the regulated vocabulary, then the terms that appear in more than one system. Three rules keep the set usable.

• Every entry belongs to exactly one glossary, and a term used in two domains gets an entry in each, cross-referenced, with one line on how they differ.
• One index says which glossary owns which term. The only part of the set that is company-wide.
• A second column in the working language, where the people who apply the requirement do not work in the language of head office. It is a designation of the same concept, not a fresh translation.

What a page of it looks like

Seven entries. The first four come straight from standards the site already follows; the last three had to be written internally, because no standard it follows defines them clearly enough.

Four standards on one page — and the three terms that cause the most arguments are the three nobody had defined.

Where to keep it: a document, a page, or a platform

The format is not the decision — the number, the owner and the revision are. But it decides whether anyone can cite a single entry.

• A controlled document in the quality system, on the same route as any procedure. Everything the reference needs is already there: owner, revision, change control, distribution. What you give up is search and entry-level links. Right for one or two glossaries of twenty entries.
• An internal page — a wiki such as Wiki.js, BookStack or MediaWiki, or a documentation site built from Markdown held in Git with MkDocs or Docusaurus. Each entry gets its own address, which turns “see TRM-014” into a link; the Git route adds revision history and a review step before publication. The discipline to add is approval: a page anyone can edit is not a controlled document.
• A glossary platform, if the group already runs or wants a data catalogue. OpenMetadata gives each glossary assigned reviewers and a draft / approved / rejected workflow on every term. DataHub carries related terms and is-a relationships, and lets the glossary live as a file in Git. Apache Atlas implements almost exactly the entry model above — synonyms, antonyms, see-also, preferred terms, replaced-by for the designations that lost, translation terms for the working-language column. All three are open source and run inside the plant network, which matters when the glossary names systems and zones.

A platform buys one thing a document cannot: the entry becomes a link. Attach it to the objects that already carry the word — historian tag groups, CMMS equipment classes, alarm classes, report fields — and two questions become answerable: which systems depend on this definition, and what breaks if it changes. The price is one more system to host and patch, worth paying only if something else needs it too. None of it makes the reference authoritative; the citation rule does.

The rule that makes it binding

Three mechanisms turn the reference into the source, all editorial rather than technical.

1. No document defines its own terms. Procedures, specifications, contracts and audit plans refer to the entry; they do not restate it. A restated definition ages differently from the original.
2. Every document opens with the same clause. One sentence, identical everywhere: terms used in this document have the meaning given in the terminology reference, revision in force. The obligation sits in the document the reader is holding.
3. A new term cannot be approved inside a document. If an author needs a term the reference does not contain, the entry is created first and the document cites it.

It travels outside the company too: a request for quotation that attaches the glossary and asks the integrator to answer in those words gets comparable offers.

Where to start, and how to know it worked

Not with a blank page. The words that cause trouble are already in the documents the site has. Harvest them from the last two audit reports, three supplier documents and the incident log, then mark the ones two documents use differently. That short list is the whole backlog. Search before you define, in the order of the cascade; run the substitution test on each entry against a real sentence from your own procedures; and get the result approved as a document, not a slide, with the citation clause added to the templates.

Then measure, rather than assume. Four numbers tell you whether the reference is alive: how often entries are cited in new documents, how far the terms in your systems still differ from the entries that govern them, how long a new term takes from proposal to approval, and how many disputes come back after being settled.

A word that has not been defined has still been decided — by whoever wrote the last document. One term. One agreed definition. One goal.

References

• ISO 10241-1:2011 · ISO 704:2022, Terminology work · ISO/IEC Directives Part 2 (2021), verbal forms. iso.org
• IEC Guide 120:2023, Security aspects in publications. webstore.iec.ch
• ISA/IEC 62443-1-1, zone · ISA/IEC 62443-4-1:2018, 3.1.5, asset · IEC 61511-1:2016, 8.2.4 · ISO 55000, asset. webstore.iec.ch
• ISO/IEC 27000:2018, 3.28, information security. iso.org
• ISPE GAMP 5, second edition (2022), software categories. ispe.org
• EudraLex Volume 4, EU GMP Annex 15 (2015), glossary — URS. health.ec.europa.eu
• NIST SP 800-88r2 (2025), Appendix A · NIST SP 800-82 Rev. 3 (2023). csrc.nist.gov
• Directive (EU) 2022/2555 (NIS 2), Articles 6(5), 6(6), 23(3) · Regulation (EU) 2016/679 (GDPR), Article 33(1). eur-lex.europa.eu
• Open-source tooling: OpenMetadata docs.open-metadata.org · DataHub docs.datahub.com · Apache Atlas atlas.apache.org.