Compliance glossary
Plain definitions of the terms that come up in SOC 2 reports, ISO audits and EU regulation, each linked to the guide that covers it in depth.
50 terms
A
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- Attestation engagement
- An attestation engagement is an engagement in which an independent practitioner reports on a subject matter, or on someone else's assertion about it.
- Audit evidence
- Audit evidence is the record that a control operated as described, such as an approved change ticket, an access review record or a restore test result.
B
- Bridge letter
- A bridge letter is a statement from a service organization's management covering the gap between the end of its last SOC report period and today.
C
- Carve-out method
- The carve-out method is the way a SOC report treats a subservice organization by excluding its controls from scope and listing the controls assumed of it.
- Common criteria (CC)
- The common criteria are the SOC 2 Security criteria, numbered CC1 to CC9 in the 2017 version, which apply to every SOC 2 report.
- Compensating control
- A compensating control is an alternative control that addresses a risk when the expected control cannot be implemented as described.
- Complementary subservice organization controls (CSOC)
- Complementary subservice organization controls are controls a SOC report assumes a carved-out subservice organization operates for the criteria to be met.
- Complementary user entity controls (CUEC)
- Complementary user entity controls are controls a SOC report assumes the service organization's customers operate themselves for the criteria to be met.
- Continuous compliance
- Continuous compliance is keeping controls in a known, evidenced state between audits instead of reconstructing that state before each one.
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.
- Control mapping
- Control mapping is linking each control to every framework requirement it satisfies, so one control and its evidence serve several frameworks at once.
- Cyber Resilience Act (CRA)
- The Cyber Resilience Act is the EU regulation that sets cybersecurity requirements for products with digital elements placed on the EU market.
D
- Data processing agreement (DPA)
- A data processing agreement is the contract GDPR Article 28 requires between a controller and a processor, setting how personal data may be handled.
- Data protection impact assessment (DPIA)
- A data protection impact assessment is the GDPR Article 35 assessment a controller must carry out before processing likely to result in a high risk to people.
- DORA
- DORA is the EU Digital Operational Resilience Act, which sets ICT risk, incident, testing and third-party risk requirements for financial entities.
E
- EU AI Act
- The EU AI Act is the EU regulation setting obligations for AI systems by risk, from prohibited practices to high-risk systems and transparency duties.
- Exception
- An exception is a deviation an auditor finds when testing a control, such as a skipped access review or a change deployed without the required approval.
G
- GDPR
- The GDPR is the EU General Data Protection Regulation, which governs how personal data of people in the EU is processed and protected.
I
- Inclusive method
- The inclusive method is the way a SOC report treats a subservice organization by bringing its relevant controls into the examination and testing them.
- Information security management system (ISMS)
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Internal audit
- An internal audit is an organization's own planned review of whether its management system or controls conform to its requirements and work as intended.
- ISAE 3000
- ISAE 3000 is the IAASB's international standard for assurance engagements on subject matter other than historical financial information.
- ISAE 3402
- ISAE 3402 is the IAASB's international standard for assurance reports on controls at a service organization relevant to customers' financial reporting.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- ISO 42001
- ISO/IEC 42001 is the international standard for an AI management system: how an organization governs the AI systems it develops or uses.
L
- Least privilege
- Least privilege is the principle that every user, service and agent gets only the access it needs for its task, and no more.
M
- Management review
- Management review is the recurring review in which top management assesses whether the management system is still suitable, adequate and effective.
- Management's assertion
- Management's assertion is the signed statement in a SOC report that the service organization's description and controls meet the criteria.
N
- NIS2
- NIS2 is the EU directive that sets cybersecurity risk-management and incident-reporting obligations for essential and important entities in critical sectors.
- Nonconformity
- A nonconformity is a failure to meet a requirement of a management system standard or of the organization's own documented management system.
P
- Points of focus
- Points of focus are the AICPA's descriptions of what a Trust Services Criterion typically covers, used to design controls and judge whether it is met.
- Population and sample
- A population is every occurrence of a control during a review period; a sample is the subset of it an auditor selects and tests.
Q
- Qualified opinion
- A qualified opinion is an auditor's opinion that the controls met the criteria except for specific matters described in the report.
R
- Record of processing activities (RoPA)
- A record of processing activities is the GDPR Article 30 record of what personal data is processed, why, about whom, where it goes and for how long.
- Register of information (RoI)
- The register of information is the record DORA requires financial entities to keep of every contractual arrangement with an ICT third-party service provider.
- Review period
- The review period is the window of time a SOC 2 Type 2 covers, over which the auditor tests whether controls operated effectively.
S
- Segregation of duties (SoD)
- Segregation of duties is the principle that no one person can carry out and conceal a sensitive action alone, such as making and deploying a change.
- SOC 1
- SOC 1 is a CPA firm's report on a service organization's controls that are relevant to its customers' internal control over financial reporting.
- SOC 2
- SOC 2 is an attestation report in which a CPA firm gives an opinion on a service organization's controls against the AICPA Trust Services Criteria.
- SOC 2 Type 1
- A SOC 2 Type 1 report gives an auditor's opinion on whether controls were suitably designed and in place at a single point in time.
- SOC 2 Type 2
- A SOC 2 Type 2 report gives an auditor's opinion on whether controls were suitably designed and operated effectively throughout a review period.
- SOC 3
- SOC 3 is a general-use summary of a SOC 2 examination, with the auditor's opinion and a short system description but no detailed tests or results.
- Standard contractual clauses (SCCs)
- Standard contractual clauses are the European Commission's model terms for transferring personal data from the EU to countries without an adequacy decision.
- Statement of Applicability (SoA)
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.
- Subservice organization
- A subservice organization is a vendor that performs part of the service a SOC report covers, such as a cloud hosting provider or a managed database service.
- Surveillance audit
- A surveillance audit is the yearly audit a certification body performs between ISO certification audits to confirm the management system is still maintained.
- System description
- The system description is management's account of the system a SOC 2 covers, written against the AICPA DC 200 description criteria.
T
- Third-party risk management (TPRM)
- Third-party risk management is the work of identifying, assessing and monitoring the risks that vendors and other third parties bring to an organization.
- Trust Services Criteria (TSC)
- The Trust Services Criteria are the AICPA criteria a SOC 2 measures controls against: Security, Availability, Processing Integrity, Confidentiality and Privacy.
Trust, settled.
Knowing the terms is the start. See them mapped to your own controls and evidence.