Governance, risk & compliance, explained

SOC 2 is an independent audit report, defined by the AICPA, that shows how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current version, ISO/IEC 27001:2022, pairs management-system requirements (clauses 4–10) with 93 Annex A controls grouped into four themes.

HIPAA is a US law that sets national standards for protecting health information. Its Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI), and its Breach Notification Rule governs what happens after a breach.

The NIST Cybersecurity Framework is a voluntary, risk-based framework for managing cybersecurity. Version 2.0 (2024) is organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

PCI DSS is the Payment Card Industry Data Security Standard: a set of 12 core requirements for any organization that stores, processes, or transmits cardholder data. The current version is PCI DSS v4.0.1.

CMMC (Cybersecurity Maturity Model Certification) is the US Department of Defense program that requires contractors in the defense industrial base to prove they protect federal contract information and controlled unclassified information. CMMC 2.0 has three levels.

The CIS Critical Security Controls are a prioritized set of 18 Controls, broken into 153 Safeguards, published by the Center for Internet Security, that defend against the most common cyber attacks. Version 8.1 organizes those Safeguards into three Implementation Groups so smaller organizations can start with the essentials.

The GDPR (General Data Protection Regulation) is the European Union’s data-protection law. It governs how organizations process the personal data of people in the EU and EEA, grants individuals strong rights over their data, and requires breach notification, generally within 72 hours.

COPPA is the FTC’s Children’s Online Privacy Protection Rule, 16 CFR Part 312, implementing the Children’s Online Privacy Protection Act of 1998 and amended in 2025. It binds operators of websites and online services directed to children under 13, and any operator with actual knowledge it is collecting or maintaining personal information from a child, requiring notice to parents, verifiable parental consent before collection, a parent’s right to review and delete, and a written children’s information security programme.

An ISMS (information security management system) is the set of policies, processes, roles, and controls an organization uses to manage information security risk in a structured, repeatable way. It is the central concept of ISO/IEC 27001.

A Statement of Applicability (SoA) is the ISO 27001 document that lists the Annex A controls, states which ones apply to your organization, whether each is implemented, and the justification for including or excluding it.

A compliance crosswalk is a mapping that shows how a single control satisfies the requirements of multiple frameworks at once, so evidence collected for one framework can be reused for others instead of rebuilt from scratch.

FedRAMP (the Federal Risk and Authorization Management Program) is a US government program that standardizes how cloud services are security-assessed and authorized for use by federal agencies, using a control baseline drawn from NIST SP 800-53.

SOX compliance means meeting the requirements of the US Sarbanes-Oxley Act of 2002, which requires public companies to maintain and assess internal control over financial reporting. Section 404 in particular drives IT general controls over the systems behind the financials.

A risk register is a living record of the risks an organization has identified, each scored on likelihood and impact, assigned an owner and a treatment, and tracked over time. It is the backbone of a risk-management program and a requirement of frameworks like ISO 27001 and SOC 2.

A data protection impact assessment (DPIA) is a documented risk assessment required under GDPR Article 35 when a type of processing is likely to result in a high risk to individuals' rights and freedoms, used to identify and reduce that risk before processing begins.

Vendor risk management (also called third-party risk management, or TPRM) is the practice of identifying, assessing, and continuously monitoring the risks that your suppliers and service providers introduce, from data breaches to outages to compliance gaps.

A security questionnaire is a set of questions a customer sends a vendor to assess how the vendor protects data, covering areas like access control, encryption, incident response, and compliance, as part of vendor due diligence.

A trust center is a public web page where a company shares its security posture, compliance reports, policies, and subprocessors so prospective and current customers can vet it quickly, reducing back-and-forth during security review.

A subprocessor is a third party that a service provider (a processor) engages to process personal data on its behalf, such as a hosting, email, or analytics provider. Under GDPR, a processor may only use subprocessors with the customer's authorization.

AI governance is the set of policies, controls, and oversight that keep an organization’s use of artificial intelligence safe, fair, transparent, and accountable. Emerging standards include ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act.

ISO/IEC 42001:2023 is the first international management-system standard for artificial intelligence, an AI Management System (AIMS). It gives organizations a certifiable way to govern the responsible development and use of AI, using the same management-system structure as ISO 27001.

The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s law on artificial intelligence. It takes a risk-based approach: it prohibits certain AI practices, sets strict requirements for high-risk systems, adds transparency duties for some uses, and creates obligations for general-purpose AI models.

The NIST AI Risk Management Framework (AI RMF 1.0) is a voluntary US framework for managing the risks of AI. Released in 2023, it is organized around four functions, Govern, Map, Measure, and Manage, to help organizations build trustworthy and responsible AI.

Evidence collection is the practice of gathering and maintaining the artifacts, screenshots, logs, tickets, policies, and records, that prove your controls actually operate. It is what turns “we do this” into something an auditor can verify.

An access review (or user access review) is a periodic check that confirms each person still has only the access they need, and that access is revoked when it isn’t. It is a core control for SOC 2, ISO 27001, and least-privilege programs.

The principle of least privilege means giving each user, system, or process only the minimum access it needs to do its job, and nothing more. It limits the damage any single account or compromise can cause.

An incident response plan is a documented, practiced process for detecting, containing, and recovering from security incidents, and for communicating during them. Frameworks like SOC 2 and ISO 27001 expect one, and it is what keeps a bad day from becoming a catastrophe.

Data classification is the practice of sorting data into sensitivity levels, commonly Public, Internal, Confidential, and Restricted, so you can apply the right protection to each. It is the foundation for access control, encryption, and retention decisions.

Encryption converts readable data into ciphertext that only someone with the right key can decode. In practice you encrypt data in transit (with TLS) and at rest (often with AES-256), and the security depends heavily on how you manage the keys.

Continuous monitoring is the ongoing, largely automated checking of your controls, configurations, and evidence so that drift and issues are caught in near real time, rather than discovered once a year at audit. It keeps a compliance program true between audits.

Business continuity (BC) is the plan to keep your business running through a disruption; disaster recovery (DR) is the subset focused on restoring IT systems and data. Both are shaped by a business impact analysis and by recovery targets called RTO and RPO.

Modern guidance (from NIST SP 800-63B) favors longer passwords and passphrases over forced complexity, screening passwords against known-breached lists, dropping arbitrary periodic rotation, and layering multi-factor authentication on top. Length and MFA beat complexity rules.

Zero trust is a security model that assumes no user or device is trusted by default, even inside the network, and verifies every access request based on identity, device health, and context. Its guiding idea is "never trust, always verify."

A security control is a safeguard or countermeasure, technical, administrative, or physical, that reduces information security risk by preventing, detecting, or correcting a threat.

Multi-factor authentication (MFA) requires two or more independent factors to sign in, typically something you know (a password) plus something you have (a device) or something you are (a biometric), so a stolen password alone is not enough to get in.

A penetration test is an authorized, simulated attack on your systems by a skilled tester who tries to exploit weaknesses the way a real attacker would, to find and prove exploitable vulnerabilities before someone malicious does.