Glossary
Plain-language definitions for SOC 2, ISO 27001, HIPAA, and general audit terminology.
A software bill of materials lists the components inside your software. Learn how an SBOM supports vulnerability management and what SOC 2 auditors look for.
A subservice organization is a vendor that performs part of a service organization's in-scope services and whose controls are relevant to its SOC report.
A system description is management's narrative of the SOC 2 in-scope system: services, boundaries, infrastructure, people, procedures, and complementary user entity controls.
Test of design checks whether a control could work as described. Test of operating effectiveness checks whether it actually ran during the audit period.
Third-party risk management (TPRM) is identifying, assessing, monitoring, and treating risks from vendors and other external parties that access your systems, data, or critical processes.
Vendor management is the operational discipline of running each vendor relationship through its lifecycle: inventory, selection, contracting, onboarding, performance and SLA oversight, renewal, and offboarding.
Vulnerability management is the ongoing process of finding security weaknesses, ranking them by risk, fixing or formally accepting them within set timelines, and verifying that each fix worked.
Complementary user entity controls (CUECs) are controls a service organization assumes its customers have in place so its own controls can meet the stated criteria.
The Trust Services Criteria are the AICPA benchmarks a SOC 2 auditor uses to evaluate controls across five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Workflow approval is a recorded decision step where an authorized person reviews a request and approves or rejects it before the work moves forward, such as an access request or a production change.
A written information security program (WISP) is the documented set of policies, procedures, roles, and safeguards an organization uses to protect the information it holds, written down so people can follow, review, and show it.
