GRC and compliance glossary

A

Access review

A periodic check, usually quarterly, that each person's access to systems still matches their job. Auditors in SOC 2 and ISO 27001 expect evidence that reviews happened and that unneeded access was removed.

Accreditation body

An organisation that checks certification bodies are competent and impartial, for example NABCB in India or ANAB in the US. Accredited certificates are the ones customers and tenders trust.

Annex A

The list of 93 information security controls in ISO/IEC 27001:2022, grouped into organisational, people, physical and technological themes. Your Statement of Applicability records which ones apply. Learn more about Annex A

Attestation

An independent professional opinion on a statement or set of controls. A SOC 2 report is an attestation by a CPA firm, not a certificate.

Audit evidence

The records an auditor examines to reach a conclusion: screenshots, logs, tickets, policies, sign-offs and samples. "If it isn't evidenced, it didn't happen."

Authorized External Assessor (AEA)

A firm approved by HITRUST to perform validated assessments (e1, i1 and r2) and submit them to HITRUST for certification. Learn more about Authorized External Assessor (AEA)

B

Bridge letter

A letter from a service organisation's management covering the gap between the end of its last SOC report period and today, confirming there were no significant control changes.

Business associate agreement (BAA)

A contract required by HIPAA between a covered entity and a vendor that handles protected health information on its behalf, setting out how the vendor must protect it. Learn more about Business associate agreement (BAA)

C

Carve-out method

A way of presenting a subservice organisation (such as AWS) in a SOC report: its controls are excluded from the report, and readers rely on the subservice organisation's own SOC report.

Certification body

An independent organisation that audits management systems against a standard such as ISO 27001 and issues the certificate. It should be accredited.

CIA triad

Confidentiality, integrity and availability: the three goals of information security. Learn more about CIA triad

CMMI maturity level

A rating from the CMMI Institute's appraisal method showing how mature an organisation's processes are, from Level 1 (Initial) to Level 5 (Optimizing). Learn more about CMMI maturity level

Common control framework

One set of controls mapped to several frameworks (for example SOC 2, ISO 27001, HIPAA and DPDP), so each control is built and evidenced once.

Compensating control

An alternative control that reduces the same risk when the normal control isn't possible, for example extra review when duties can't be fully separated.

Complementary subservice organisation controls (CSOCs)

Controls a SOC report assumes your subservice organisations (like your cloud provider) operate, for the report's control objectives or criteria to be met.

Complementary user entity controls (CUECs)

Controls a SOC report assumes your customers operate themselves, such as managing their own user access in your product.

Consent manager

Under India's DPDP Act, an entity registered with the Data Protection Board that lets people give, manage, review and withdraw consent through one interoperable platform.

Control owner

The person responsible for making a specific control work day to day and keeping evidence that it does. Learn more about Control owner

Corrective action

Action taken to remove the cause of a nonconformity so it doesn't happen again. ISO standards require you to record it and check it worked.

CPA firm

A licensed certified public accounting firm. Only a CPA firm can issue SOC 1, SOC 2 and SOC 3 reports, and it should have passed AICPA peer review.

D

Data fiduciary

Under the DPDP Act, the organisation that decides why and how personal data is processed (similar to a "controller" under GDPR). Learn more about Data fiduciary

Data principal

Under the DPDP Act, the person the personal data is about. For a child, it includes the parent or lawful guardian.

Data processor

An organisation that processes personal data on behalf of a data fiduciary or controller, under a contract.

Data Protection Board of India

The body set up under the DPDP Act to handle breach reports and complaints, conduct inquiries and impose penalties.

Data Protection Impact Assessment (DPIA)

An assessment of the risks a processing activity poses to people's rights, and how they're reduced. Required periodically for Significant Data Fiduciaries under the DPDP Rules and for high-risk processing under GDPR.

Data Protection Officer (DPO)

The person responsible for overseeing data protection compliance. Under the DPDP Act, Significant Data Fiduciaries must appoint a DPO based in India. Learn more about Data Protection Officer (DPO)

Deviation (exception)

In a SOC 2 Type 2 audit, a case where a tested control didn't operate as described, for example a leaver whose access wasn't removed on time.

E

e1, i1 and r2

The three HITRUST validated assessments: e1 (essentials, 1-year), i1 (implemented, 1-year) and r2 (risk-based, 2-year), each with increasing rigour. Learn more about e1, i1 and r2

ePHI

Electronic protected health information: PHI that is created, stored or sent electronically. The HIPAA Security Rule protects ePHI.

G

Gap assessment

A comparison of your current controls against a framework's requirements, producing a prioritised list of gaps to close.

GRC

Governance, risk and compliance: how an organisation sets direction, manages risk and meets its legal and contractual obligations in a coordinated way. Learn more about GRC

H

HITRUST CSF

A certifiable security and privacy framework that harmonises requirements from HIPAA, ISO 27001, NIST and others, widely requested by US healthcare organisations. Learn more about HITRUST CSF

I

Inclusive method

A way of presenting a subservice organisation in a SOC report where its relevant controls are included in the description and tested.

Information Security Management System (ISMS)

The policies, processes, people and controls an organisation uses to manage information security risk. ISO 27001 certifies the ISMS.

Interim assessment

The HITRUST check performed around the midpoint of a two-year r2 certification to confirm controls are still operating.

Internal audit

An audit the organisation runs on itself (or through an independent consultant) to check its management system works. Mandatory before ISO certification.

ISO/IEC 27001

The international standard for information security management systems. Certificates are issued by accredited certification bodies and last three years. Learn more about ISO/IEC 27001

ISO/IEC 27701

An extension to ISO 27001 for privacy information management, mapped to laws like GDPR and the DPDP Act. Learn more about ISO/IEC 27701

ISO/IEC 42001

The international standard for AI management systems, covering governance, risk and impact assessment of AI. Learn more about ISO/IEC 42001

IT general controls (ITGC)

Controls over access, change management, development and IT operations that support the reliability of systems and financial data. Learn more about IT general controls (ITGC)

M

Management assertion

The statement by a service organisation's management, included in a SOC report, that its system description is fair and its controls are suitably designed (and, for Type 2, operated effectively).

Management review

A formal, recorded meeting where top management reviews the performance of the management system. Mandatory in ISO 27001 (clause 9.3).

MyCSF

HITRUST's online platform where organisations scope their assessment, record control maturity and evidence, and work with their assessor.

N

Nonconformity

A failure to meet a requirement of the standard or your own system. ISO auditors classify them as major (system breakdown, blocks certification until fixed) or minor (isolated lapse).

O

Observation period

The time window a SOC 2 Type 2 report covers, usually 3 to 12 months, during which controls must operate consistently.

P

Penetration test

An authorised simulated attack on your systems to find exploitable weaknesses. Most SOC 2, ISO 27001 and HIPAA programmes expect one at least yearly. Learn more about Penetration test

Personal data breach

Under the DPDP Act, any unauthorised processing, disclosure, loss of access to or destruction of personal data. It must be reported to the Board and affected people.

PHI

Protected health information: individually identifiable health information held or sent by a HIPAA covered entity or business associate.

Point in time

The single date a SOC 1 or SOC 2 Type 1 report covers, as opposed to a period.

Q

Qualified opinion

A SOC auditor's opinion that controls were effective except for specific matters described in the report. A clean opinion is called unqualified.

R

Readiness assessment

A pre-audit review that checks whether you're ready for the actual audit, so there are no surprises.

Recertification audit

The full ISO audit in the third year of a certificate cycle that renews the certificate for another three years.

Remediation

The work to fix gaps or findings, for example writing a missing policy or enforcing MFA.

Risk appetite

The amount and type of risk an organisation is willing to accept to achieve its objectives, set by leadership.

Risk assessment

Identifying risks, then analysing their likelihood and impact to decide which need treatment. Required at least yearly by ISO 27001, SOC 2 and HIPAA.

Risk owner

The person accountable for a risk, who decides how it is treated and accepts any remaining risk. Learn more about Risk owner

Risk register

The record of identified risks, their ratings, owners and treatment decisions.

Risk treatment plan

The plan for how each risk will be reduced, avoided, transferred or accepted, with owners and dates. Mandatory in ISO 27001.

S

Significant Data Fiduciary (SDF)

A data fiduciary notified by the Indian government based on factors like data volume and sensitivity. SDFs have extra duties: a DPO in India, an independent data auditor, and periodic DPIAs and audits.

SOC 1

A report on controls at a service organisation that are relevant to its customers' financial reporting, used by their financial auditors. Learn more about SOC 1

SOC 2

A report on a service organisation's controls relevant to security, availability, processing integrity, confidentiality or privacy, based on the AICPA Trust Services Criteria. Learn more about SOC 2

SOC 3

A short, general-use version of a SOC 2 report that can be shared publicly, without the detailed tests and results.

Stage 1 audit

The first part of an ISO certification audit, reviewing your documentation and readiness for Stage 2.

Stage 2 audit

The main ISO certification audit, testing whether your management system and controls work in practice.

Statement of Applicability (SoA)

The ISO 27001 document listing every Annex A control, whether it applies, why, and whether it's implemented.

Subservice organisation

A vendor whose services are part of your system for SOC reporting purposes, such as a cloud hosting provider.

Surveillance audit

The yearly audit by the certification body in years two and three of an ISO certificate, checking the system is maintained.

T

Third-party risk management (TPRM)

Identifying, assessing and monitoring the risks vendors and partners bring to your organisation. Learn more about Third-party risk management (TPRM)

Trust Services Criteria (TSC)

The AICPA criteria used in SOC 2: security (always required), availability, processing integrity, confidentiality and privacy.

Type 1 report

A SOC report on whether controls are suitably designed at a point in time. Learn more about Type 1 report

Type 2 report

A SOC report on whether controls are suitably designed and operated effectively over an observation period. Learn more about Type 2 report

V

Validated assessment

A HITRUST assessment where an Authorized External Assessor tests your controls and HITRUST reviews the results before issuing certification.

VAPT

Vulnerability assessment and penetration testing: scanning for known weaknesses plus manual testing to exploit them. We deliver VAPT with CERT-In empanelled testing partners. Learn more about VAPT