Skip to content
Certifyi

Glossary

Compliance glossary

The terms that come up in a first SOC 2, ISO 27001 or ISO 42001 programme, explained the way a compliance lead would on a call. Each has its own page with what auditors look for and how it connects to the rest of a programme.

A

Access review
A periodic check, usually quarterly, that every user’s access to systems still matches their role, with removals recorded. One of the first pieces of evidence a SOC 2 or ISO 27001 auditor samples.
AI governance
The roles, policies, processes and records an organisation uses to decide which AI systems it builds or uses, manage their risks to the business and to people, and show that it does so.
AI GRC
Governance, risk and compliance for AI systems, against standards such as ISO 42001 and laws such as the EU AI Act, and the use of AI inside GRC work to draft, map and review, with a person accountable.
AI impact assessment
An assessment, for each AI system, of who is affected, what could go wrong, how likely and how severe it is, and what is done about it. ISO 42001 requires one, and the EU AI Act requires its own forms for high-risk systems.
AI system inventory
A register of every AI model, agent and third-party AI service an organisation builds or uses, with its purpose, data, owner and risk class. ISO 42001 and the EU AI Act both start from it.
AI transparency
The practice of making an AI system's purpose, training data, decision logic and limitations visible to affected people, regulators and auditors. The EU AI Act requires varying degrees of transparency by risk category.
Algorithmic bias
A systematic and unfair difference in outcomes produced by an AI system, caused by training data, feature selection, or design choices that disadvantage one group over another.
Annex A
The list of 93 reference controls in ISO 27001:2022, grouped into organisational, people, physical and technological themes. You select from it and justify every exclusion in the Statement of Applicability.
Attestation report
An independent auditor’s written opinion on whether an organisation’s controls are designed, and in a Type II report operating, as described. A SOC 2 report is an attestation, not a certificate.
Audit-ready
The point at which scoped controls, policies, a risk register and evidence are in place, so an auditor can be engaged and the audit can start without a scramble.

B

Business Associate Agreement (BAA)
A HIPAA-required contract between a covered entity and any vendor that creates, receives, maintains or transmits protected health information on its behalf.

C

C3PAO
A CMMC Third-Party Assessment Organisation: a company authorised by the Cyber AB to carry out CMMC Level 2 certification assessments for US defence contractors.
CAPA
Corrective and preventive action: the plan, owner and due date attached to an audit finding or incident, tracked until the fix is confirmed and the cause addressed.
Certification body
An organisation accredited by a national accreditation body, such as UKAS or ANAB, to audit and certify management systems against ISO standards. Only a certification body can issue an ISO 27001 or ISO 42001 certificate.
CMMC
Cybersecurity Maturity Model Certification: the US Department of Defense programme that checks contractors protect Federal Contract Information and Controlled Unclassified Information, at three levels. Full guide on its own page
Compensating control
An alternative safeguard used when a required control cannot be implemented as written, documented with the reason and accepted by the risk owner.
Continuous monitoring
Checking control evidence on an ongoing basis, so gaps are visible between audits rather than found while preparing for one. Full guide on its own page
Control
A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.
Control mapping
Linking one control to every framework requirement it satisfies, so the same control and its evidence count towards SOC 2, ISO 27001 and other frameworks at once.
Controlled Unclassified Information (CUI)
US government information that is not classified but must be protected under law or policy. Handling CUI brings a defence contractor under CMMC Level 2.
Cyber Essentials
The UK government-backed certification of five baseline technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds an independent technical audit. Full guide on its own page

D

Data Processing Agreement (DPA)
The GDPR-required contract between a controller and a processor setting out how personal data is handled, secured, and returned or deleted.
Data Protection Impact Assessment (DPIA)
A GDPR-required assessment of processing likely to result in a high risk to individuals, recording the risks and the measures that reduce them before the processing starts.
Data subject access request (DSAR)
A person’s request for a copy of the personal data an organisation holds about them and how it is used. Under the GDPR it must be answered within one month, normally free of charge.
DORA
The EU Digital Operational Resilience Act, applying from 17 January 2025. It makes financial entities manage ICT risk, including the risk from their third-party ICT providers. Full guide on its own page

E

Essential Eight
The Australian Cyber Security Centre’s eight mitigation strategies, such as application control, patching, MFA and backups, each assessed at maturity levels zero to three. Full guide on its own page
EU AI Act
Regulation (EU) 2024/1689, which sorts AI systems by risk and places obligations on providers and deployers, phasing in from February 2025. Full guide on its own page
Evidence
Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.
Evidence integrity
The property that a piece of evidence can be shown to be unchanged since it was collected, usually by hashing it and keeping a log that shows any later change.
Exception (audit)
An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

F

Federal Contract Information (FCI)
Information provided by or generated for the US government under a contract and not intended for public release. Handling FCI brings a contractor under CMMC Level 1.

G

Gap
A framework requirement the organisation does not yet meet. Gaps come out of a gap assessment and are tracked to closure before the audit.
Gap assessment
A comparison of current controls against a framework’s requirements, producing the list of gaps to close before an audit.
GRC
Governance, risk and compliance: deciding how an organisation is run, what could go wrong and which rules it must meet, managed as one system rather than three. Full guide on its own page

H

HIPAA Security Rule
The part of HIPAA that sets administrative, physical and technical safeguards for electronic protected health information. Compliance is shown with evidence; there is no official certificate. Full guide on its own page
HITRUST CSF
A certifiable framework common in US healthcare that draws on HIPAA, ISO 27001, NIST and other sources, assessed at e1, i1 and r2 levels. Full guide on its own page
Human oversight
The requirement that a qualified person can monitor, intervene in, or override an AI system's decisions. Required by the EU AI Act for high-risk AI systems and by ISO 42001 as a control objective.

I

Incident response plan
A documented procedure for detecting, containing, investigating and recovering from a security incident, with roles, communication steps and post-incident review. Required by nearly every compliance framework.
Internal audit
A review of the management system by someone independent of the area being audited. ISO 27001 and ISO 42001 require one before certification and at planned intervals after it.
ISMS
Information security management system: the scope, policies, risk process, controls and reviews that ISO 27001 certifies. The certificate covers the management system, not a product.
ISO 27001
The international standard for an information security management system. Certificates last three years, with surveillance audits in between. Full guide on its own page
ISO 42001
The international standard for an AI management system, published in 2023 and built on the same structure as ISO 27001, so the two can be run and audited together. Full guide on its own page

L

Lead Implementer
A person certified to plan and implement an ISO management system, such as an ISMS under ISO 27001 or an AI management system under ISO 42001.

M

Management review
A recorded review in which leadership looks at how the management system is performing: audit results, risks, incidents, objectives and resources. Required by ISO management system standards.
Model card
A structured document describing an AI model's intended use, training data, performance metrics, limitations and ethical considerations. Recommended by the NIST AI RMF and increasingly expected by auditors.
Monte Carlo risk analysis
A quantitative method that runs thousands of simulated scenarios to estimate the range of financial loss a risk could cause, turning a heat-map colour into a range of numbers.

N

NIS 2
The EU Network and Information Security Directive (2022), which sets security and incident-reporting duties for essential and important entities, through each member state’s national law. Full guide on its own page
NIST AI RMF
The US National Institute of Standards and Technology’s voluntary AI Risk Management Framework, organised into four functions: Govern, Map, Measure and Manage. Full guide on its own page
NIST SP 800-171
The US standard of 110 security requirements for protecting Controlled Unclassified Information in non-federal systems, and the control set behind CMMC Level 2.
Nonconformity
An ISO audit finding that a requirement is not met. A minor nonconformity needs a corrective action plan; a major one must be resolved before a certificate is issued.

O

Observation period
The window, usually three to twelve months, over which a SOC 2 Type II auditor tests whether controls operated. It starts once the controls are in place.

P

PCI DSS
The Payment Card Industry Data Security Standard: twelve requirements for any organisation that stores, processes or transmits cardholder data. Version 4.0.1 is current. Full guide on its own page
Penetration test
An authorised, simulated attack on systems to find weaknesses an attacker could exploit. Most frameworks expect one at least once a year and after significant changes.
Personnel security
Controls covering people: screening where the law allows it, onboarding and offboarding, training, acceptable-use acknowledgement, and removing access when someone leaves.
Plan of Action and Milestones (POA&M)
The CMMC and NIST document listing unmet requirements with the planned fix, owner and date. Only a limited set of requirements may sit on a POA&M at a CMMC assessment.
Policy acknowledgement
A recorded confirmation that a person has read and accepted a policy. Auditors sample acknowledgements to check that policies are communicated, not just written.
Protected Health Information (PHI)
Individually identifiable health information held or transmitted by a HIPAA covered entity or business associate.

R

Residual risk
The risk that remains after controls are applied. Residual risk is what management formally accepts, and it is the number an auditor compares to the organisation's risk appetite.
Responsible disclosure
Reporting a security vulnerability privately to the organisation affected and allowing time for a fix before anything is published. Most bug bounty programmes are built on it.
Risk appetite
The level and type of risk an organisation is willing to accept in pursuit of its objectives, set by leadership and used to judge whether a residual risk needs further treatment.
Risk register
The list of identified risks with an owner, likelihood, impact, treatment and review date, linked to the controls that treat each one. Usually the first document an auditor asks to see.

S

Security awareness training
Periodic training for all staff on phishing, social engineering, password hygiene and data handling. Required by SOC 2, ISO 27001, HIPAA and CMMC, with completion tracked as evidence.
SOC 2 Type I
A SOC 2 report on whether controls are suitably designed and in place on a single date. Often the first report a company obtains.
SOC 2 Type II
A SOC 2 report on whether controls operated effectively over an observation period. The report most enterprise buyers eventually ask for.
Statement of Applicability (SoA)
The ISO 27001 document listing every Annex A control, whether it applies, why, and whether it is implemented. The auditor’s map of your ISMS.
Sub-processor
A third party that processes personal data on behalf of a processor. Under GDPR a processor needs the controller’s authorisation to use one and must tell it about changes.
Surveillance audit
The yearly audit between ISO certification and recertification, checking that the management system is still being run. Shorter than the initial Stage 2 audit.
System Security Plan (SSP)
The CMMC and NIST SP 800-171 document describing the system boundary and how each of the 110 requirements is met. The assessor starts from it.

T

Threat-led penetration testing (TLPT)
Intelligence-led testing of live production systems that simulates a real attacker. DORA requires it of financial entities chosen by their regulators, at least every three years.
Trust centre
A public page where an organisation shares its certifications, reports and security practices, so prospects can complete a security review without a long email thread. Full guide on its own page
Trust Service Criteria
The five categories a SOC 2 report can cover: Security, which is always included, and optionally Availability, Confidentiality, Processing Integrity and Privacy.
Type I / Type II
The two SOC 2 report types. Type I covers control design on one date; Type II covers how controls operated over an observation period.

V

Vendor risk management
Assessing and monitoring third parties according to the data and access they hold, with questionnaires, evidence and reassessment on a schedule. Full guide on its own page

Missing a term?

Email [email protected] and we will add it, or book a call and ask the person who would run your programme.

Book a call Suggest a term
  • Each customer workspace has its own database
  • Every change written to a tamper-evident activity log
  • Auditors get scoped, read-only access
  • AI suggestions wait for a person to accept them
Scroll to Top