Compliance Glossary

Plain-language definitions for teams pursuing SOC 2 and ISO 27001 compliance.

Browse by category

Browse A-Z

Showing 304 terms

B

Baseline Controls

Boundaries of the System

Breach Notification Requirements

Business Continuity Policy

C

Cabling Security

Capacity Management

Category-Specific Criteria

Center for Internet Security (CIS) Benchmarks

Certificate Validity Period

Certificate of Registration

Certification Audit

Certification Body Auditor

Certification Cycle

Certification Decision

Certification Maintenance

Certification Mark Usage

Certification Scope

Certification Scope Statement

Certification Suspension

Certification Withdrawal

Change Management Criteria (CC8)

Clear Desk and Clear Screen Policy

Clock Synchronization

Cloud Security Alliance (CSA)

Cloud Services Security

Cloud Services Security Control (5.23)

Communication and Information

Compensating Control Measures

Complementary Subservice Organization Controls

Complementary User Entity Controls Reliance

Compliance Officer

Confidentiality Criteria (C1)

Configuration Management Control (8.9)

Contact with Authorities

Contact with Special Interest Groups

Context of the Organization

Continuing Assurance

Continuity Exercise

Continuity Plan Activation

Control Attributes

Control Baseline Selection

Control Operating Effectiveness

Control of Documented Information

Corrective Control

Cryptographic Key Lifecycle

Cybersecurity Maturity Model Certification

D

Data Backup Control (8.13)

Data Masking Control (8.11)

Data Replication

Description Criteria

Detective Control

Deterrent Control

Disaster Declaration

Disciplinary Process

Documentation Review

E

Emergency Communication Plan

Emergency Response

Engagement Partner

Equipment Maintenance

Event Monitoring

F

FIPS-Validated Cryptography

G

General Use Report

Generally Accepted Privacy Principles

Governance Body

H

Harmonized Structure (Annex SL)

High Availability

Human Resource Security

I

IAF Multilateral Recognition Arrangement (MLA)

ICT Readiness for Business Continuity

ICT Supply Chain Security (5.21)

ISMS Audit Programme

ISMS Family of Standards

ISO/IEC 17021-1

Identity Lifecycle

Illustrative Controls

Improvement (Clause 10)

Incident Management Planning and Preparation

Independent Service Auditor's Report

Information Classification

Information Deletion

Information Deletion Control (8.10)

Information Labeling

Information Security Continuity

Information Security Event

Information Security Governance

Information Security Incident

Information Security Manager

Information Security Objectives

Information Security Risk Assessment

Information Security Roles and Responsibilities

Information Security in Supplier Agreements

Information Security in Supplier Relationships

Information Systems Audit Considerations

Interested Parties

Internal Auditor

Internal Control Environment

Internal and External Issues

International Accreditation Forum

Intrusion Detection

L

Leadership and Commitment (Clause 5)

Learning from Incidents

Logical Access Control

Logical and Physical Access Controls (CC6)

M

Major Nonconformity

Malware Protection

Management Commitment

Management Response

Management Review Inputs

Managing Information Security in the ICT Supply Chain

Maximum Tolerable Downtime

Measurement of ISMS Effectiveness

Minor Nonconformity

Monitoring Activities Control (8.16)

Monitoring Activities Criteria (CC4)

Monitoring and Review of Supplier Services

Monitoring, Measurement, Analysis and Evaluation

N

NIST Cybersecurity Framework 2.0

NIST SP 800-146

Needs and Expectations of Interested Parties

Nonconformity Tracking

Nonconformity and Corrective Action Process

O

Objective Evidence

On-Site Assessment

Operation (Clause 8)

Operational Planning and Control

Opportunity for Improvement

Organizational Controls

P

People Controls

Performance Evaluation

Physical Access Control

Physical Controls

Planning (Clause 6)

Planning of Changes

Precursors and Indicators

Preventive Action

Preventive Control

Preventive Safeguards

Privacy Criteria (P1-P8)

Privileged Access Rights

Processing Integrity

Processing Integrity Criteria (PI1)

Protection Against Physical and Environmental Threats

S

SOC for Cybersecurity

SOC for Supply Chain

Scenario-Based Risk Assessment

Scope Statement

Secret Authentication Information

Secure Coding Control (8.28)

Secure Coding Standards

Secure Controls Framework

Secure Development Lifecycle

Secure System Architecture

Security Objectives

Segregation of Duties Policy

Segregation of Networks

Service Auditor

Service Auditor's Report

Service Commitments

Service Organization

Steering Committee

Storage Media Management

Subservice Organization

Subservice Organization Carve-Out Method

Subservice Organization Criteria

Subservice Organization Inclusive Method

Suitable Criteria

Supplemental Criteria

Supplier Risk Assessment

Supplier Security Agreements

Support (Clause 7)

System Operations (CC7)

System and Organization Controls (SOC)

T

TSP Section 100

Technological Controls

Terms and Conditions of Employment

Test of Controls

Third-Party Assessor

Threat Intelligence Control (5.7)

Three-Year Certification Cycle

Topic-Specific Policies

Transition Audit

Trust Services Category

Trust Services Principles

U

UKAS Accreditation

Understanding Internal and External Issues

United Kingdom Accreditation Service (UKAS)

Unqualified Opinion

Use of Monitoring Systems

User Access Management

User Lifecycle Management

Utilities Protection

W

Web Filtering Control (8.23)

Promotional banner highlighting failures found in PCI audits and how to spot the gaps