Glossary
The compliance glossary: every term in plain words.
83 terms from SOC 2, ISO 27001, DPDP, GDPR, HIPAA, AI governance and security testing, each with an example and a link to the guide that goes deeper.
Back to Resources01 · A
A
Terms beginning with A.
- AI governanceAgentic AIAI systems that pursue a goal by planning steps and calling tools, systems or other agents on their own, with limited human direction at each step.
- AI governanceAI impact assessmentA documented review of the consequences an AI system could have for individuals, groups and society across its life, used to decide whether and how to deploy it.
- AI governanceAI systemUnder the EU AI Act, a machine-based system that infers from its inputs how to produce outputs such as predictions, content, recommendations or decisions, with some autonomy.
- ISO and management systemsAIMS (AI management system)The set of policies, roles, risk and impact processes, controls and reviews an organization uses to govern the AI systems it builds, supplies or uses.
- ISO and management systemsAnnex A controlsThe reference list of 93 information security controls in ISO/IEC 27001:2022, grouped into organizational, people, physical and technological themes, which an organization compares its own controls against.
- SOC and attestationAT-C Section 320The AICPA attestation section that governs a SOC 1 examination of a service organization's controls relevant to its clients' financial reporting.
- SOC and attestationAttestationA CPA's written conclusion on whether a subject matter, or management's claim about it, meets stated criteria, under the AICPA attestation standards.
- Testing and assessmentAudit scopeThe extent and boundaries of an audit: which organisation units, locations, processes, systems and time period the auditor will examine against the chosen criteria.
02 · B
B
Terms beginning with B.
- SOC and attestationBridge letterA letter from a service organization's management stating that nothing material has changed in its controls since the last SOC report's period ended.
- HIPAABusiness associate agreementThe written contract HIPAA requires before a vendor creates, receives, keeps or sends protected health information on behalf of a covered entity or another business associate.
03 · C
C
Terms beginning with C.
- SOC and attestationCarve-out methodA SOC reporting choice for a subservice organization: the report names its services, but its controls are neither described in the report nor tested.
- Privacy and data protectionCERT-InIndia's national agency for responding to computer security incidents, part of the Ministry of Electronics and Information Technology, with powers under section 70B of the IT Act.
- ISO and management systemsCertification bodyAn independent organization that audits a management system against a standard such as ISO/IEC 27001 and, if it conforms, issues and maintains the certificate.
- Privacy and data protectionConsent managerUnder the DPDP Act, a person registered with the Data Protection Board who gives individuals one interoperable platform to give, manage, review and withdraw consent.
- Testing and assessmentControlA measure that changes or keeps a risk in check, such as a policy, a procedure, a technical setting or a review, run consistently and owned by someone.
- SOC and attestationControl objectiveA statement of the result a set of controls must achieve, written by service organization management and used as the yardstick in a SOC 1 examination.
- SOC and attestationCSOC (complementary subservice organization controls)Controls that a service organization assumes its carved-out subservice organizations operate, without which its own controls would not meet the stated objectives or criteria.
- SOC and attestationCUEC (complementary user entity controls)Controls a service organization assumes its customers (user entities) will run, without which its own controls would not fully meet the stated objectives or criteria.
- Testing and assessmentCVSSAn open scoring method from FIRST that rates the technical severity of a software vulnerability from 0.0 to 10.0 and maps the score to a severity band.
04 · D
D
Terms beginning with D.
- Privacy and data protectionData controllerUnder the GDPR, the person or body that, alone or with others, decides the purposes and means of processing personal data, and answers for that processing.
- Privacy and data protectionData fiduciaryThe person or organisation that decides, alone or with others, why and how personal data is processed, and so answers for it under India's DPDP Act.
- Privacy and data protectionData principalThe individual whom personal data is about under India's DPDP Act, including a parent or lawful guardian acting for a child or for a person with a disability.
- Privacy and data protectionData processorAn organisation that processes personal data on behalf of another, the fiduciary under India's DPDP Act or the controller under the GDPR, without choosing the purpose.
- Privacy and data protectionDPDP ActIndia's law on processing digital personal data, passed in August 2023 and switched on in stages by the 2025 Rules made under it.
- Privacy and data protectionDPIA (data protection impact assessment)A documented assessment of a planned use of personal data that is likely to put people's rights at high risk, done before the processing begins.
- Privacy and data protectionDPO (data protection officer)A person appointed to advise on and oversee personal data protection: the GDPR makes one mandatory in set cases, and India's DPDP Act does so for significant data fiduciaries.
05 · E
E
Terms beginning with E.
- AI governanceEU AI ActThe European Union's regulation on artificial intelligence. It sets duties by risk tier and by role, and its provisions apply in stages from February 2025.
- Testing and assessmentEvidenceThe records, logs, exports, documents and observations an auditor relies on to conclude that a control exists and operated as described.
06 · G
G
Terms beginning with G.
- Testing and assessmentGap assessmentA structured comparison of how you work today against the requirements of a chosen standard or law, ending in a ranked list of what is missing.
- Privacy and data protectionGDPRThe European Union's regulation on processing personal data, applied since May 2018, which also reaches firms outside the EU that target or monitor people in it.
- AI governanceGPAI (general-purpose AI)An AI model, often trained on a large amount of data, that can competently perform a wide range of distinct tasks and be built into many downstream systems.
07 · H
H
Terms beginning with H.
- HIPAAHIPAAA 1996 US federal law whose regulations govern how health plans, healthcare clearinghouses, most providers and their vendors protect and share health information.
- HIPAAHIPAA Privacy RuleThe HIPAA regulation that controls how protected health information in any form may be used and disclosed, and gives patients rights over their own records.
- HIPAAHIPAA Security RuleThe HIPAA rule on securing electronic protected health information: covered entities and business associates must apply safeguards of three kinds, administrative, physical and technical, picked through risk analysis.
08 · I
I
Terms beginning with I.
- SOC and attestationICFR (internal control over financial reporting)The processes and controls a company uses to give reasonable assurance that its financial reporting is reliable and its financial statements are prepared properly.
- SOC and attestationInclusive methodA SOC reporting choice for a subservice organization: the vendor's relevant controls are written into your report and examined by your own service auditor.
- ISO and management systemsInternal auditA planned, independent check that an organization runs on its own management system to see whether it meets the standard and its own rules, and works in practice.
- ISO and management systemsISMS (information security management system)The policies, risk decisions, controls, owners and review cycle an organisation uses to manage information security as an ongoing system.
- ISO and management systemsISO/IEC 27001The international standard that sets requirements for an information security management system, against which an accredited certification body can audit and certify an organization.
- ISO and management systemsISO/IEC 27701The ISO/IEC standard for a privacy information management system (PIMS), covering how controllers and processors of personal data govern and protect it, and auditable by a certification body.
- ISO and management systemsISO/IEC 42001The 2023 international standard setting requirements for an AI management system, which organizations that develop, provide or use AI can be certified against.
- ISO and management systemsISO/IEC 42005An ISO/IEC guidance standard on assessing the potential impacts of an AI system on individuals, groups and society, across the system's life cycle.
- ISO and management systemsISO/IEC 42006The ISO/IEC standard that sets out what a certification body must meet before it audits and certifies AI management systems against ISO/IEC 42001, on top of the general certifier rules.
09 · L
L
Terms beginning with L.
10 · M
M
Terms beginning with M.
- SOC and attestationManagement assertionA signed statement by service organization management: the system is described honestly, the controls were designed to do their job and, for Type 2, ran effectively throughout the period.
- ISO and management systemsManagement reviewA planned meeting in which top management examines how the management system is performing and records decisions on changes, resources and improvement.
11 · N
N
Terms beginning with N.
12 · O
O
Terms beginning with O.
- SOC and attestationObservation periodThe span of time, with a fixed start and end date, over which a Type 2 SOC report tests whether controls actually operated.
- Testing and assessmentOWASP Top 10A ranked list of the most critical web application security risk categories, published by the OWASP Foundation and refreshed every few years from community and industry data.
13 · P
P
Terms beginning with P.
- Testing and assessmentPCI DSSThe card industry's security standard for any organisation that stores, processes or transmits payment card data, or can affect the security of that data.
- Testing and assessmentPenetration testingAuthorised, simulated attacks on a system by skilled testers who try to exploit weaknesses and chain them together, to show what a real attacker could reach.
- HIPAAPHI (protected health information)Individually identifiable health information held or sent in any form by a HIPAA covered entity or business associate, with a few listed exclusions.
- ISO and management systemsPIMS (privacy information management system)A management system for privacy: the roles, risk work, controls and reviews an organisation uses to handle personal data, as described in ISO/IEC 27701.
- SOC and attestationPoints of focusShort descriptions under each Trust Services Criterion of the characteristics a control environment often has, published to guide judgment rather than to be required one by one.
- AI governanceProvider and deployer (AI)Under the EU AI Act, the provider develops an AI system or model and puts it out under its name; the deployer uses it professionally under its own authority.
14 · Q
Q
Terms beginning with Q.
15 · R
R
Terms beginning with R.
- Privacy and data protectionRBI cybersecurity frameworkThe Reserve Bank of India's requirements for how banks govern and defend against cyber risk, set by its June 2016 circular and built on by later directions.
- Testing and assessmentReadiness assessmentA review shortly before a formal audit that checks whether controls operate and evidence exists, so remaining problems surface while there is still time to fix them.
- Testing and assessmentRemediationThe work of removing a weakness found by testing, scanning or an audit, by fixing its cause so the same finding cannot be reproduced.
- Testing and assessmentRetestA focused follow-up in which the tester repeats the steps behind each reported finding to confirm whether the fix holds, is partial or has failed.
- ISO and management systemsRisk assessmentA repeatable method for identifying information security risks, judging how likely and how harmful each is, and ranking them for a decision.
- ISO and management systemsRisk treatmentThe step where an organisation decides how to handle each assessed risk, by reducing, avoiding, sharing or accepting it, and records the plan and approval.
- Privacy and data protectionRoPA (record of processing activities)A written inventory, required by GDPR Article 30, of each personal data processing activity: its purpose, the people and data involved, recipients, transfers and retention.
- Testing and assessmentRules of engagementThe signed document that authorises a security test and sets its limits: targets, exclusions, timing, permitted techniques, contacts and what happens if something breaks.
16 · S
S
Terms beginning with S.
- SOC and attestationService auditorThe independent CPA practitioner engaged by a service organization to examine its controls and issue the SOC 1, SOC 2 or SOC 3 report.
- SOC and attestationService organizationA company that provides services to other organizations, called user entities, where its controls affect those customers' own reporting or security.
- Privacy and data protectionSignificant data fiduciaryA data fiduciary, or a class of them, that the Indian Central Government names under the DPDP Act for added duties, given the scale or risk of its data handling.
- SOC and attestationSOC 1An examination report, under AICPA standard AT-C 320, on a service organization's controls that are relevant to its customers' internal control over financial reporting.
- SOC and attestationSOC 2A licensed CPA firm's examination of how a service organization's controls measure up to the AICPA's Trust Services Criteria, covering security plus as many as four further categories.
- SOC and attestationSOC 3A short, general-use report from a CPA firm on whether a service organization's controls met the Trust Services Criteria, without the detailed tests found in a SOC 2.
- SOC and attestationSSAE 18The AICPA attestation standard, organised into AT-C sections, that a CPA firm must follow when it examines and reports on a service organization's controls.
- ISO and management systemsStatement of ApplicabilityThe ISO 27001 record that walks through Annex A control by control, noting whether each applies, why it was included or dropped, and whether it is in place.
- SOC and attestationSubservice organizationA vendor used by a service organization whose controls, together with the service organization's own, are needed for the report's criteria or objectives to be met.
- ISO and management systemsSurveillance auditA periodic audit, at least once a year, by the certification body between full recertifications, sampling parts of the ISMS to confirm the certificate should stand.
- SOC and attestationSystem descriptionManagement's written account of the service under examination: its boundary, components, controls, vendors and customer responsibilities, which the CPA firm then tests for accuracy.
17 · T
T
Terms beginning with T.
- SOC and attestationTrust Services CriteriaThe AICPA's published set of criteria, grouped into five categories, against which a service organization's controls are evaluated in SOC 2 and SOC 3 examinations.
- SOC and attestationType 1 reportA SOC report where the CPA firm opines, as of one date, on whether the system is described fairly and the controls were well designed and in place.
- SOC and attestationType 2 reportA SOC report in which the CPA firm tests and gives an opinion on whether controls operated effectively throughout a stated period, in addition to their design.
18 · U
U
Terms beginning with U.
19 · V
V
Terms beginning with V.
- Testing and assessmentVAPTA combined security engagement: a vulnerability assessment that finds and ranks known weaknesses, followed by penetration testing that tries to exploit them.
- Testing and assessmentvCISOAn experienced security leader engaged part-time, under contract, to set and steer a company's security programme without being a full-time employee.
- Testing and assessmentvDPOAn external privacy specialist engaged on contract to run or guide a company's data protection work, and sometimes to act as its data protection officer where the law allows.
- Testing and assessmentVulnerability scanAn automated check of hosts, applications or cloud settings against a database of known weaknesses, producing a list of likely issues ranked by severity.
Using the glossary
Are these legal definitions?
No. They are plain-words explanations.
Each entry explains a term the way a founder or compliance lead needs it. For a legal position, read the text of the law or the standard itself and ask your counsel.
Why do some terms have a longer name beside them?
Many are acronyms.
Where a term is an acronym, the entry spells it out first, then explains it. Terms are listed by their common name, which is usually the short form.
Missing a term you keep hearing?
Tell us, and we will add it. Or talk to our team about how a term applies to your scope.