Compliance glossary
The words auditors use, in plain English
Short definitions of the terms that come up in SOC 2, ISO 27001, HIPAA, PCI DSS and GDPR work, each linked to where this site goes deeper.
A
- Access review
- A periodic check that each person's access to a system is still appropriate for their role, with a record of who decided and when. Auditors test both that reviews happened on schedule and that the access they flagged was actually removed. More on User access reviews
- Attestation report
- A report in which an independent auditor gives an opinion on a company's description of its controls. A SOC 2 report is an attestation, not a certification: there is no certificate, only the report and the auditor's opinion in it. More on SOC 2
- Audit period (observation window)
- The span of time over which a SOC 2 Type II report tests whether controls operated. Periods commonly run from three to twelve months, and evidence has to exist for the whole of it, which is why a late start cannot be made up later. More on SOC 2 Type I vs Type II
B
- Bridge letter
- A letter from a company's management covering the gap between the end of its last SOC report period and today, stating that no material changes to its controls have occurred. It is written by management, not by the auditor, so it carries less assurance than the report itself.
- Business associate agreement (BAA)
- The contract HIPAA requires between a covered entity and a business associate that handles protected health information on its behalf. It sets out how the associate will safeguard that information and report breaches. More on HIPAA
C
- Cardholder data environment (CDE)
- In PCI DSS, the people, processes and technology that store, process or transmit cardholder data, plus anything connected to them. Shrinking the CDE through segmentation is usually the single largest lever on the cost of a PCI assessment. More on PCI DSS
- Certification body
- An accredited organization that audits a company against a standard such as ISO 27001 and issues the certificate. Accreditation of the body itself is what makes the certificate recognized, so it is worth checking before you engage one. More on ISO 27001
- Compensating control
- An alternative control that meets the intent of a requirement when the original control cannot be implemented. PCI DSS formalizes the idea and requires each one to be documented and validated.
- Complementary user entity controls (CUECs)
- Controls a vendor's SOC 2 report assumes its customers operate themselves, such as managing their own user access. If the customer does not operate them, the vendor's controls may not achieve their objectives for that customer. More on SOC 2
- Continuous control monitoring
- Testing controls automatically and on a schedule against live system configuration, rather than collecting evidence once before an audit. A failing test surfaces when the drift happens, while it is still cheap to fix. More on Continuous monitoring
- Control
- A safeguard or process that reduces a specific risk, such as enforcing multi-factor authentication or reviewing code before release. Frameworks state requirements; controls are what a company actually does to meet them.
- Control mapping
- Linking one control to every framework requirement it satisfies. Because frameworks overlap heavily, a mapped control collected once can count toward SOC 2, ISO 27001 and others at the same time. More on Compliance automation
D
- Data processing agreement (DPA)
- The contract GDPR Article 28 requires between a controller and a processor that handles personal data on its behalf. It fixes the subject matter, duration, purpose and security obligations of the processing. More on GDPR
E
- Evidence
- The artifacts that show a control operated: configuration exports, logs, tickets, approvals and reports, each with a date and a source. An auditor samples evidence; a control without it is, for audit purposes, a control that did not happen. More on Evidence request checklist
- Exception
- An instance an auditor found where a control did not operate as described, such as an access review that was skipped. Exceptions are listed in a SOC 2 report; a few explained ones are common, and readers look at how they were handled.
G
- Gap assessment
- A comparison of a company's current practices against a framework's requirements, to find what is missing before the audit. It is the usual first step of a compliance program, and it is not an audit opinion. More on SOC 2 readiness check
I
- Information security management system (ISMS)
- The policies, processes, roles and controls ISO 27001 requires an organization to establish, run and continually improve. Certification is against the ISMS as a whole, not against individual controls. More on ISO 27001
R
- Risk register
- A record of identified risks, each with its likelihood, impact, owner and treatment. Auditors expect it to be current and to link each risk to the controls that treat it. More on Risk management
- Risk treatment
- The decision made for each identified risk: reduce it with controls, accept it, transfer it (for example to an insurer) or avoid the activity. ISO 27001 requires a documented risk treatment plan.
S
- Security questionnaire
- A buyer's list of security questions a vendor must answer before a deal closes, often based on a standard template such as SIG or CAIQ. Answers are only as good as the evidence behind them. More on Questionnaire automation
- Statement of Applicability (SoA)
- The ISO 27001 document listing every Annex A control, whether each is included, why, and how it is implemented. Auditors start from it, so it has to match what the organization actually does. More on Statement of Applicability
- Subservice organization
- A vendor that a SOC 2 service organization relies on to deliver its service, such as a cloud host. The report either carves the vendor out, relying on its own report, or includes its controls in scope.
T
- Third-party risk management (TPRM)
- Assessing the vendors that can reach your data or systems, ranked by exposure, and keeping each assessment current after onboarding. Most frameworks require a vendor inventory and periodic review of the critical ones. More on Third-party risk
- Trust center
- A public page where a company shows how it protects customer data and shares security documents, often with sensitive reports behind an access request. It answers a share of buyer security questions before they are asked. More on Trust Center
- Trust Services Criteria (TSC)
- The AICPA criteria a SOC 2 report is measured against, in five categories: security, availability, processing integrity, confidentiality and privacy. Security is required in every SOC 2; the other four are included by choice. More on SOC 2
- Type I report
- A SOC report on whether controls are suitably designed at a single point in time. It is faster to obtain and often unblocks a first deal, but it says nothing about whether the controls kept operating. More on SOC 2 Type I vs Type II
- Type II report
- A SOC report on whether controls were suitably designed and operated effectively over an audit period. It is the report most enterprise buyers ask for, because it tests sustained operation rather than intent. More on SOC 2 Type I vs Type II
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.