Glossary
Plain-language definitions for SOC 2, ISO 27001, HIPAA, and general audit terminology.
Remediation is the work of fixing an identified security, compliance, or control gap so the underlying issue is resolved and can be verified with dated evidence.
A risk assessment is a structured process for identifying threats and vulnerabilities, estimating likelihood and impact, and deciding how to treat residual risk with dated records.
A risk register is a living inventory of identified risks with ratings, treatment decisions, owners, and review dates so teams can prioritize and prove how risk is managed over time.
Role-based access control (RBAC) grants permissions through roles mapped to job functions so users and services receive defined rights based on the role they hold.
Security awareness training teaches people how to recognize and avoid common security risks so human behavior supports the controls your organization designs.
Segregation of duties splits the steps of a sensitive process across different people so no single person can start, approve, carry out, and hide an action alone.
Separation of environments keeps development, testing, staging, and production apart so changes are controlled. Learn how it supports SOC 2 change management and what evidence auditors expect.
SOC 2 Type 1 is an attestation report on whether a service organization's controls relevant to the Trust Services Criteria were suitably designed at a specific point in time.
SOC 2 Type 2 is an attestation report on whether a service organization's controls relevant to the Trust Services Criteria were suitably designed and operated effectively over a defined audit period.
SOC 2 (Service Organization Control 2) is an attestation report on how a service organization designs and operates controls relevant to security and other Trust Services Criteria.
