Every compliance term, defined.

The reference set of information security controls in ISO/IEC 27001. The 2022 revision organizes 93 controls into organizational, people, physical, and technological themes.

An examination and opinion issued by a licensed CPA firm, such as a SOC 2 report, on whether an organization’s controls meet defined criteria.

A systematic, independent examination of controls and evidence to determine whether requirements are met. Can be internal or external.

Business Associate Agreement — a contract required under HIPAA between a covered entity and a vendor that handles PHI on its behalf.

Business Continuity and Disaster Recovery — plans and controls that keep an organization operating and recover systems after disruption.

Corrective and Preventive Action — the process of resolving a non-conformity and preventing its recurrence.

Formal recognition by an accredited certification body that an organization meets a standard such as ISO/IEC 27001, following a successful audit.

Confidentiality, Integrity, and Availability — the three core principles that underpin information security.

An operating model where controls and evidence are monitored continuously, keeping an organization audit-ready at all times rather than only before an audit.

A safeguard or countermeasure — technical, administrative, or physical — implemented to reduce risk and meet a compliance requirement.

An identified or identifiable individual whose personal data is processed. Under GDPR, data subjects have rights such as access and erasure.

Data Protection Impact Assessment — a GDPR process to identify and reduce data protection risks of high-risk processing activities.

The process of encoding data so only authorized parties can read it, protecting confidentiality in transit and at rest.

Proof that a control is designed and operating effectively, such as configuration exports, logs, tickets, screenshots, or records reviewed during an audit.

An analysis comparing current controls against a framework’s requirements to identify what is missing before an audit.

The structured process for detecting, containing, eradicating, and recovering from a security incident.

Information Security Management System — the framework of policies, processes, and controls an organization uses to manage information security risk, central to ISO/IEC 27001.

The principle of granting users only the access they need to do their job, and nothing more.

A periodic review by leadership of the ISMS’s performance, required by ISO 27001 to ensure it remains effective and aligned to objectives.

Multi-Factor Authentication — requiring two or more independent factors to verify identity, a foundational access control.

Non-Conformity Report — a documented finding that a requirement has not been met, raised during an audit and tracked to resolution.

Protected Health Information — individually identifiable health information covered by HIPAA’s Privacy and Security Rules.

The level of risk that remains after controls and treatments have been applied. Organizations accept residual risk within their defined risk appetite.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by leadership and used to guide treatment decisions.

Records of Processing Activities — documentation required under GDPR describing what personal data an organization processes and why.

Statement of Applicability — a document listing the ISO 27001 Annex A controls, whether each applies, the justification, and its implementation status.

A SOC 2 report evaluating whether controls are suitably designed at a single point in time.

A SOC 2 report evaluating whether controls operated effectively over a period, typically three to twelve months.

The five criteria a SOC 2 report can address: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

The risk introduced by third parties that access your systems or data, managed through assessment, contracts, and monitoring.