Glossary
Plain-language definitions for SOC 2, ISO 27001, HIPAA, and general audit terminology.
A security practice that determines who can access systems, applications, and data, and what actions they are permitted to perform.
Audit evidence is the documentation, records, and supporting information used to demonstrate that a control was operating effectively during an audit period.
An audit period is the timeframe covered by an audit. It defines the period of activity, evidence, control operation, and business process performance that an auditor will review.
An audit sample is a subset of items selected from a complete population so an auditor can test a control and draw a conclusion about the whole population.
An audit trail is a chronological record of actions, changes, approvals, and system events that provides visibility into who performed an action, what was changed, when it occurred, and, in some cases, why it happened.
Availability is one of the SOC 2 Trust Services Criteria. It focuses on whether systems, applications, data, and services are available for operation and use as committed or agreed.
Branch protection is a set of repository rules that limits how changes reach important branches: required pull requests, approvals, status checks, and limits on force pushes and bypass.
A bridge letter is a management-signed statement that covers the gap between the end of a SOC report period and a later date.
A Business Continuity Plan, often called a BCP, is a documented plan that explains how an organization will continue operating during and after a disruption.
CAPA stands for Corrective and Preventive Action. It is a structured process for identifying issues, correcting them, and preventing them from happening again.
A change advisory board reviews and approves risky production changes. Learn whether SOC 2 requires one and what approval evidence auditors expect.
Change management is the process used to review, approve, test, and implement modifications to systems, infrastructure, applications, configurations, or policies.
