Compliance Glossary
Short, clear definitions of the terms security questionnaires, auditors and procurement teams use. One sentence first, then the detail.
B
- Business Associate Agreement (BAA)
A written contract required by HIPAA between a Covered Entity and any vendor that handles PHI on its behalf.
C
- Complementary User Entity Controls (CUEC)
Controls your customers must implement for your SOC 2 report's conclusions to hold.
- CCPA / CPRA
California Consumer Privacy Act (as amended by CPRA) — California's state privacy law for consumers' personal information.
- CMMC
Cybersecurity Maturity Model Certification — US DoD framework for contractors handling defence information.
- Cardholder Data Environment (CDE)
The scope boundary under PCI-DSS: systems that store, process or transmit cardholder data.
D
- Data Protection Impact Assessment (DPIA)
A GDPR-required assessment of high-risk data processing before it starts.
- Data Processing Agreement (DPA)
A contract required by GDPR between a controller and processor setting out how personal data will be handled.
- Data Protection Officer (DPO)
An appointed privacy specialist responsible for monitoring GDPR / PDPA / DPDP compliance.
- Data Subject Access Request (DSAR)
An individual's right to receive a copy of their personal data under GDPR, CCPA, PDPA and DPDP.
- DPDP Act (India)
India's Digital Personal Data Protection Act 2023, with Rules in force from November 2025.
F
- FedRAMP
US Federal Risk and Authorization Management Program — the US government's authorization process for cloud services.
G
- GDPR
EU General Data Protection Regulation (2016/679) — the EU law governing personal data of individuals in the EU.
H
- HIPAA
US Health Insurance Portability and Accountability Act — governs the privacy and security of protected health information.
I
- ISO 27001
International standard for an Information Security Management System (ISMS), certifiable by accredited bodies.
- ISO/IEC 42001
International standard for an Artificial Intelligence Management System (AIMS).
- ISMS
Information Security Management System — the policy, process and control stack ISO 27001 certifies.
N
- NIST Cybersecurity Framework (CSF)
A voluntary US framework of cybersecurity functions published by NIST.
P
- PDPA (Singapore)
Singapore's Personal Data Protection Act governing personal data of individuals in Singapore.
- PHI / ePHI
Protected Health Information (PHI) and the electronic subset (ePHI) as defined by HIPAA.
- PCI-DSS
Payment Card Industry Data Security Standard — the global standard for processing, storing or transmitting payment card data.
- Penetration test
An authorised simulated attack to find exploitable vulnerabilities in applications, networks or infrastructure.
R
- Record of Processing Activities (RoPA)
GDPR Article 30 register of what personal data you process, why, where it goes and how long you keep it.
- Risk register
A living list of identified risks with likelihood, impact, owner and treatment plan.
S
- SOC 2 bridge letter
A short attestation from your auditor confirming no material changes to controls between the end of your last SOC 2 period and today.
- Statement of Applicability (SoA)
An ISO 27001 document listing every Annex A control, whether it applies, and the justification.
- SOC 2
An AICPA attestation report evaluating a service organisation's controls against the Trust Services Criteria.
- SOC 2 Type 1
A SOC 2 report on the design of controls at a specific point in time.
- SOC 2 Type 2
A SOC 2 report testing the operating effectiveness of controls over a period, usually 3–12 months.
- Subprocessor
A vendor that processes personal data on behalf of your processor (and thus indirectly on behalf of your controller customer).
T
- Trust Services Criteria (TSC)
The AICPA framework of five criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) that a SOC 2 report evaluates against.
- Trust centre
A public page where a vendor publishes its security posture, certifications and legal documents for buyers to download.