Glossary

The compliance vocabulary, in plain language

Definitions for the frameworks, artifacts, and acronyms that come up most when you start a compliance program or answer a security questionnaire.

Explore frameworks Back to resources

Access review: A periodic, documented check that every user's access to a system is still appropriate for their current role — also called a user access review (UAR).
BAA: Business Associate Agreement — a contract required under HIPAA between a covered entity and any vendor that handles protected health information on its behalf.
CAIQ: Consensus Assessments Initiative Questionnaire — a standardized cloud security questionnaire published by the Cloud Security Alliance, paired with the CSA STAR registry.
Continuous monitoring: Running tests on a schedule so configuration drift surfaces between audits, not at audit time.
Control: An objective within a framework (e.g. SOC 2 CC6.1) that you must satisfy and prove.
Control owner: The named individual accountable for a control's operation and evidence — who an auditor or reviewer would ask if something looks wrong.
Cross-mapping: Reusing one passing test across the multiple frameworks whose requirements it satisfies.
DPA: Data Processing Agreement — a contract required under GDPR (and similar laws) between a data controller and a processor, governing how personal data is handled.
Evidence: The artifact backing a test result, carrying a timestamp, source system, and content hash.
FedRAMP: A U.S. government program standardizing security assessment, authorization, and monitoring for cloud services used by federal agencies.
HITRUST: A certifiable framework (the HITRUST CSF) widely used in healthcare that harmonizes controls from HIPAA, ISO 27001, NIST, and other sources.
ISMS: Information Security Management System — the overall management structure (policies, risk process, roles, continual improvement) that ISO 27001 certifies.
ISO 27001: An international standard specifying requirements for an Information Security Management System (ISMS), with certification issued by accredited bodies.
MCP: Model Context Protocol — the open standard that lets AI clients like Claude and Cursor call your tenant's tools.
POA&M: Plan of Action and Milestones — a formal, tracked remediation plan for a known control gap or weakness, with owners and target dates.
Requirement: The finest-grain obligation inside a control — the level at which mapping happens so one test can serve many frameworks.
Residual risk: The risk that remains after controls and mitigations have been applied — as opposed to inherent risk, which is the risk before any mitigation.
Security questionnaire: A form a prospective or existing customer sends asking about your security and compliance practices, often as a gate before signing or renewing a contract.
SIG: Standardized Information Gathering questionnaire — a widely used, standardized third-party risk assessment questionnaire published by Shared Assessments.
SOC 2: An AICPA audit report on a service organization's controls over security, availability, processing integrity, confidentiality, and privacy.
SSP: System Security Plan — a document describing a system's boundaries, the controls it implements, and how each control is satisfied.
Test: An automated or manual check that produces a pass/fail result against a requirement.
Trust center: A public page sharing your security posture and NDA-gated documents to shorten customer reviews.
TSC: Trust Services Criteria — the AICPA criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) that a SOC 2 report is evaluated against.
Vendor risk assessment: The process of evaluating a third-party vendor's security posture (often via their SOC 2 report or a questionnaire) before and during the relationship.