Glossary
Plain-language definitions for SOC 2, ISO 27001, HIPAA, and general audit terminology.
In compliance and security, data retention helps organizations manage records responsibly. This can include customer data, employee records, contracts, audit evidence, logs, tickets, access reviews, security alerts, policy acknowledgements, and other business records.
Disaster recovery is the set of plans, systems, and tested steps used to restore critical technology and data after a major disruption.
An emergency change is an urgent production change made faster than the normal process allows. Learn how to document approval and review so it holds up in a SOC 2 audit.
Encryption is the process of converting readable data into protected ciphertext so only authorized parties with the right keys can read it.
Evidence collection is the practice of gathering, organizing, and retaining proof that controls operated as intended, so auditors and stakeholders can evaluate compliance over time.
Exception management is the day-to-day process of identifying, assessing, approving or accepting, remediating, and closing control or policy deviations with clear ownership and time bounds.
A gap analysis compares your current security and compliance practices against a target framework or set of controls, then lists the missing or weak areas that need remediation before an audit or certification effort.
Governance, risk, and compliance (GRC) is the coordinated program that sets direction and accountability, identifies and treats risk, and meets external and internal obligations with owned controls and evidence.
Incident management is the process to detect, triage, contain, eradicate, recover from, and learn from security or operational incidents, with severity, roles, timelines, communication, and evidence for audits.
An information security policy is the top-level written statement of your organization's security principles, roles, and expectations for protecting systems, data, and services.
Infrastructure as code defines servers and cloud services in version-controlled files. Learn how it supports SOC 2 change evidence and what auditors ask for.
Internal audit is an independent assurance function inside an organization that evaluates whether governance, risk management, and internal controls are designed and operating as intended.
