> ## Documentation Index > Fetch the complete documentation index at: https://syteca.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Glossary > Learn the key terms and concepts used throughout the ESPM, including policies, risk factors, controls, health scores, and compliance assessments. ### Active Risk Factor A risk factor that is currently present on an endpoint. An active risk factor is detected when its [risk score](/docs/espm/about-risk-factors#risk-score-calculation) becomes greater than 0 after previously being **0** or **Unknown**. Active risk factors indicate security issues that require review and, where appropriate, remediation. ### Assigning a Policy The process of associating a policy with one or more endpoints or endpoint groups. Assigned policies determine which risk factors are evaluated on the selected endpoints (see [Managing policies](/docs/espm/policies/managing-policies)). ### Compliance Policy A policy designed to assess endpoint compliance with a specific standard, framework, or organizational requirement, such as [SOC 2](/docs/espm/policies/soc2) , or internal security standards. ### Control A category or tag assigned to a risk factor within a policy. Controls group related risk factors and represent security, compliance, or operational areas affected by those risk factors. ### Event-Based Risk Factor A risk factor whose score depends on events occurring on the endpoint rather than its configuration. Examples include process executions, AI tool access, USB device usage, or disk I/O errors. The score may increase as qualifying events occur and typically resets to **0** at midnight in the endpoint's local time zone (see [How to investigate and remediate event-based risks](/docs/espm/howto/how-to-remediate-event-based-risk-factors)). ### Health Score A percentage value (`0–100%`) representing the overall health of an endpoint, policy, control, or environment. Health scores are grouped into health categories ranging from **A** (best health, lowest risk) to **D** (poorest health, highest risk) (see [About health score](/docs/espm/endpoint-security-posture-and-health-score)). ### No Longer Relevant Risk Factor An event-based risk factor whose [risk score](/docs/espm/about-risk-factors#risk-score-calculation) has returned to **0** because the events that caused the risk are no longer considered relevant. For many event-based risk factors, this occurs automatically at midnight in the endpoint's local time zone. ### Not Applicable Risk Factor A risk factor that cannot be evaluated on an endpoint because it does not apply to the endpoint's operating system, hardware, software, or configuration. ### Policy A collection of risk factors, controls, and severity definitions used to evaluate the security, compliance, or operational health of endpoints (see [About policies](/docs/espm/about-policies)). ### Remediated Risk Factor A state-based risk factor whose [risk score](/docs/espm/about-risk-factors#risk-score-calculation) has changed from a non-zero value to **0** because the underlying issue has been resolved. Remediated risk factors indicate that corrective action has successfully addressed the identified risk. ### Risk Factor A security, compliance, or operational condition that is evaluated on an endpoint. A risk factor may represent a configuration setting, software state, detected event, missing control, or other condition that affects endpoint health (see [About risk factors and probes](/docs/espm/about-risk-factors)). ### Risk Factor Evidence The data used to determine whether a risk factor exists on an endpoint. Evidence may include registry values, files, configuration settings, installed software, services, running processes, event records, or other endpoint artifacts (see [How to investigate risk factors](/docs/espm/howto/how-to-understand-risk-root-cause) ). ### Risk Score A numeric value from **0** to **100** that represents the risk associated with a risk factor. The score is calculated based on the risk factor's evaluation result and its severity within the applicable policy. Higher scores indicate greater risk. ### Severity The importance or impact level assigned to a risk factor within a policy. Severity influences the resulting risk score and helps prioritize remediation efforts. ### State-Based Risk Factor A risk factor whose score depends on the endpoint's current configuration or state. Its score remains unchanged until the underlying condition is modified or remediated. ## Related Deploy, license, and configure Endpoint Security Posture Management (ESPM) to begin monitoring endpoint security posture. Explore security and compliance policies, understand how risk factors, controls, and severity ratings contribute to policy health scores.