Glossary
Plain-language definitions for SOC 2, ISO 27001, HIPAA, and general audit terminology.
Least privilege is the access principle that users, services, and devices receive only the minimum permissions needed to perform an authorized task, for only as long as needed.
Logical access is the ability to interact with systems, applications, data, and digital resources through credentials and permissions, as distinct from physical access to buildings or hardware.
Monitoring is the ongoing observation of systems, controls, and security-relevant events so teams can detect issues, verify controls still operate, and respond before small failures become incidents or audit gaps.
Multi-factor authentication (MFA) requires two or more distinct authentication factors before granting access, so a stolen password alone is not enough.
Peer review, or code review, is an independent check of a change before acceptance. Learn how it supports SOC 2 change management evidence with pull request approvals and branch protection.
A penetration test is an authorized simulated attack that tries to find and exploit weaknesses in systems, applications, or people so you can fix them before real attackers do.
Point-in-time evidence shows a control on one date. Period-of-time evidence shows it worked across the audit period. Learn when each applies in SOC 2.
Policy acknowledgement is the dated attestation that a named person received a specific policy version and confirmed they understand and will follow it.
In audit sampling, a population is the complete set of items or events from which an auditor selects samples to test a control.
A procedure is a documented set of step-by-step instructions for performing a recurring operational or control activity consistently.
