Glossary
Plain-language definitions for SOC 2, ISO 27001, HIPAA, and general audit terminology.
A compensating control is an alternative control used when the primary or expected control cannot be implemented, but the organization still needs to reduce risk to an acceptable level.
Learn what a compliance framework is, how it organizes regulatory and security requirements, and how organizations use frameworks to manage controls and audit evidence.
Compliance is the act of following laws, regulations, standards, contractual obligations, and internal policies that apply to an organization.
Confidentiality is the principle that sensitive information should only be accessed, used, or disclosed by authorized people, systems, and organizations.
In a traditional audit process, teams often scramble near the end of the audit period to gather screenshots, exports, access reviews, policy acknowledgements, tickets, approvals, and other records. Continuous compliance changes that rhythm. Instead of treating compliance as a once-a-year project, the organization collects and organizes evidence as work happens.
In compliance and security, controls are used to show that an organization has safeguards in place to protect data, manage access, respond to incidents, review changes, and operate systems responsibly.
A control deviation is an instance where a control did not operate as designed or as described. Learn how auditors record deviations in SOC 2 testing and what teams should do next.
Instead of creating controls from scratch, companies often use a recognized framework to understand what areas they need to cover, how controls should be organized, and what auditors or assessors may expect to review.
Learn how control mapping connects security controls to requirements across SOC 2, ISO 27001, NIST, HIPAA, PCI DSS, and other frameworks.
Learn what a control owner does, how control ownership supports compliance, and what auditors expect control owners to demonstrate.
It explains what went wrong, what needs to be corrected, who is responsible, when the work should be completed, and how the organization will confirm the issue has been resolved.
