Glossary
Plain-language definitions for SOC 2, ISO 27001, HIPAA, and general audit terminology.
Availability is one of the SOC 2 Trust Services Criteria. It focuses on whether systems, applications, data, and services are available for operation and use as committed or agreed.
An audit period is the timeframe covered by an audit. It defines the period of activity, evidence, control operation, and business process performance that an auditor will review.
An audit trail is a chronological record of actions, changes, approvals, and system events that provides visibility into who performed an action, what was changed, when it occurred, and, in some cases, why it happened.
Audit evidence is the documentation, records, and supporting information used to demonstrate that a control was operating effectively during an audit period.
A security practice that determines who can access systems, applications, and data, and what actions they are permitted to perform.
Learn how control mapping connects security controls to requirements across SOC 2, ISO 27001, NIST, HIPAA, PCI DSS, and other frameworks.
Learn what a control owner does, how control ownership supports compliance, and what auditors expect control owners to demonstrate.
Confidentiality is the principle that sensitive information should only be accessed, used, or disclosed by authorized people, systems, and organizations.
Learn what a compliance framework is, how it organizes regulatory and security requirements, and how organizations use frameworks to manage controls and audit evidence.
It explains what went wrong, what needs to be corrected, who is responsible, when the work should be completed, and how the organization will confirm the issue has been resolved.
Instead of creating controls from scratch, companies often use a recognized framework to understand what areas they need to cover, how controls should be organized, and what auditors or assessors may expect to review.
In compliance and security, controls are used to show that an organization has safeguards in place to protect data, manage access, respond to incidents, review changes, and operate systems responsibly.
In a traditional audit process, teams often scramble near the end of the audit period to gather screenshots, exports, access reviews, policy acknowledgements, tickets, approvals, and other records. Continuous compliance changes that rhythm. Instead of treating compliance as a once-a-year project, the organization collects and organizes evidence as work happens.
Compliance is the act of following laws, regulations, standards, contractual obligations, and internal policies that apply to an organization.
A compensating control is an alternative control used when the primary or expected control cannot be implemented, but the organization still needs to reduce risk to an acceptable level.
Change management is the process used to review, approve, test, and implement modifications to systems, infrastructure, applications, configurations, or policies.
CAPA stands for Corrective and Preventive Action. It is a structured process for identifying issues, correcting them, and preventing them from happening again.
Disaster recovery is the set of plans, systems, and tested steps used to restore critical technology and data after a major disruption.
Learn how data classification categorizes information by sensitivity, risk, and handling requirements to support security, privacy, and compliance.
In compliance and security, data retention helps organizations manage records responsibly. This can include customer data, employee records, contracts, audit evidence, logs, tickets, access reviews, security alerts, policy acknowledgements, and other business records.
Exception management is the day-to-day process of identifying, assessing, approving or accepting, remediating, and closing control or policy deviations with clear ownership and time bounds.
Evidence collection is the practice of gathering, organizing, and retaining proof that controls operated as intended, so auditors and stakeholders can evaluate compliance over time.
Encryption is the process of converting readable data into protected ciphertext so only authorized parties with the right keys can read it.
Governance, risk, and compliance (GRC) is the coordinated program that sets direction and accountability, identifies and treats risk, and meets external and internal obligations with owned controls and evidence.
A gap analysis compares your current security and compliance practices against a target framework or set of controls, then lists the missing or weak areas that need remediation before an audit or certification effort.
ISO/IEC 27001 is an international standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
Internal audit is an independent assurance function inside an organization that evaluates whether governance, risk management, and internal controls are designed and operating as intended.
Incident management is the process to detect, triage, contain, eradicate, recover from, and learn from security or operational incidents, with severity, roles, timelines, communication, and evidence for audits.
An information security policy is the top-level written statement of your organization's security principles, roles, and expectations for protecting systems, data, and services.
Logical access is the ability to interact with systems, applications, data, and digital resources through credentials and permissions, as distinct from physical access to buildings or hardware.
Least privilege is the access principle that users, services, and devices receive only the minimum permissions needed to perform an authorized task, for only as long as needed.
Multi-factor authentication (MFA) requires two or more distinct authentication factors before granting access, so a stolen password alone is not enough.
Monitoring is the ongoing observation of systems, controls, and security-relevant events so teams can detect issues, verify controls still operate, and respond before small failures become incidents or audit gaps.
A procedure is a documented set of step-by-step instructions for performing a recurring operational or control activity consistently.
Policy acknowledgement is the dated attestation that a named person received a specific policy version and confirmed they understand and will follow it.
A penetration test is an authorized simulated attack that tries to find and exploit weaknesses in systems, applications, or people so you can fix them before real attackers do.
Role-based access control (RBAC) grants permissions through roles mapped to job functions so users and services receive defined rights based on the role they hold.
A risk register is a living inventory of identified risks with ratings, treatment decisions, owners, and review dates so teams can prioritize and prove how risk is managed over time.
A risk assessment is a structured process for identifying threats and vulnerabilities, estimating likelihood and impact, and deciding how to treat residual risk with dated records.
Remediation is the work of fixing an identified security, compliance, or control gap so the underlying issue is resolved and can be verified with dated evidence.
A system description is management's narrative of the SOC 2 in-scope system: services, boundaries, infrastructure, people, procedures, and complementary user entity controls.
SOC 2 Type 2 is an attestation report on whether a service organization's controls relevant to the Trust Services Criteria were suitably designed and operated effectively over a defined audit period.
SOC 2 Type 1 is an attestation report on whether a service organization's controls relevant to the Trust Services Criteria were suitably designed at a specific point in time.
SOC 2 (Service Organization Control 2) is an attestation report on how a service organization designs and operates controls relevant to security and other Trust Services Criteria.
Security awareness training teaches people how to recognize and avoid common security risks so human behavior supports the controls your organization designs.
Vulnerability management is the ongoing process of finding security weaknesses, ranking them by risk, fixing or formally accepting them within set timelines, and verifying that each fix worked.
Vendor management is the operational discipline of running each vendor relationship through its lifecycle: inventory, selection, contracting, onboarding, performance and SLA oversight, renewal, and offboarding.
A written information security program (WISP) is the documented set of policies, procedures, roles, and safeguards an organization uses to protect the information it holds, written down so people can follow, review, and show it.
Workflow approval is a recorded decision step where an authorized person reviews a request and approves or rejects it before the work moves forward, such as an access request or a production change.
The Trust Services Criteria are the AICPA benchmarks a SOC 2 auditor uses to evaluate controls across five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy.