Compliance terms, plainly explained.

Formal recognition of a certification body’s competence by a national accreditation body. Accreditation applies to the certifier; certification applies to the company.

Assessing an AI system’s potential impact on individuals, groups and society; required by ISO/IEC 42001 and related to the EU AI Act’s fundamental-rights impact assessment.

The American Institute of CPAs, which sets the standards and criteria for SOC engagements. SOC 2 reports must be issued by licensed CPA firms under them.

Artificial Intelligence Management System as defined in ISO/IEC 42001, including AI risk and impact assessment, data and lifecycle management.

ISO/IEC 27001:2022 Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. The Statement of Applicability records which apply and why.

Business Associate Agreement, required between a HIPAA covered entity and a vendor handling protected health information on its behalf.

A letter from management covering the gap between the end of the last SOC report period and the next report, stating there were no material changes. Not an auditor opinion.

Consensus Assessments Initiative Questionnaire, the CSA’s standard questionnaire based on the Cloud Controls Matrix, used for STAR Level 1.

The California Consumer Privacy Act as amended by the CPRA. Applies to for-profit businesses meeting revenue or data thresholds; enforced by the CPPA and the Attorney General.

The manufacturer’s declaration that a product meets applicable EU harmonisation legislation. Usually self-declared; some products require a notified body.

A third party that audits a management system, makes the certification decision and issues the certificate. Credible certificates come from bodies accredited by e.g. CNAS, UKAS or ANAB.

Tools such as Vanta or Drata that integrate with cloud, identity and code platforms to collect evidence and monitor controls. They reduce manual work but do not replace control design, people or the audit.

The party that determines the purposes and means of processing personal data and bears primary GDPR responsibility.

In SOC 2, a licensed independent accounting firm able to perform the attestation and issue the report. A readiness adviser cannot also be the auditor on the same engagement.

The Cloud Security Alliance’s Security, Trust, Assurance and Risk registry. Level 1 is self-assessment; Level 2 is third-party certification with ISO/IEC 27001 or attestation with SOC 2.

Complementary User Entity Controls: controls the customer must operate for the overall control objectives to be met, such as managing its own user access.

Regulation (EU) 2024/2847 setting cybersecurity requirements for products with digital elements. Reporting duties apply from 11 September 2026; full obligations from 11 December 2027.

The US DOJ rule under Executive Order 14117 (28 CFR Part 202) prohibiting or restricting access by countries of concern, including China, to bulk US sensitive personal data; effective 8 April 2025.

Regulation (EU) 2022/2554, applicable since 17 January 2025 to financial entities, and reaching their ICT providers through contract requirements and critical-provider oversight.

Data Processing Agreement: the controller–processor contract required by GDPR Article 28, covering scope, security, sub-processors and assistance duties.

Data Protection Impact Assessment, required before high-risk processing such as large-scale sensitive data or systematic monitoring (GDPR Article 35).

Data Protection Officer, mandatory in certain cases such as core activities involving large-scale systematic monitoring or sensitive data.

Regulation (EU) 2024/1689, regulating AI systems by risk tier and setting duties for general-purpose AI model providers. The 2026 AI Omnibus deferred high-risk obligations to 2027–2028.

A non-EU company subject to GDPR without an EU establishment must generally designate a representative in the EU under Article 27.

An instance where a control did not operate as described. Exceptions appear in the SOC 2 report and buyers read them; serious ones can lead to a qualified opinion.

Regulation (EU) 2016/679, applicable since 25 May 2018. It can apply to non-EU companies offering goods or services to, or monitoring, individuals in the EU.

General-Purpose AI. Provider obligations under the AI Act have applied since 2 August 2025, including technical documentation, a copyright policy and a training-data summary.

AI systems listed in Annex I (safety components of regulated products) or Annex III (uses such as hiring, credit, education) of the AI Act, subject to risk management, data governance, documentation and human-oversight duties.

US health-data privacy and security law for covered entities and business associates. There is no official “HIPAA certification”; compliance is shown through risk analysis, BAAs and third-party assessments.

International Accreditation Forum, the multilateral recognition arrangement among accreditation bodies. Some accredited certificates can be checked on IAF CertSearch.

A planned audit of the management system by the organisation itself; mandatory under ISO management-system standards and completed at least once before certification.

Information Security Management System: a risk-based management system covering scope, policy, risk assessment and treatment, controls, internal audit and management review.

The international requirements standard for an information security management system (ISMS), current edition 2022. Certification by an accredited body lasts three years with annual surveillance audits.

The privacy information management system (PIMS) standard. The 2025 edition, published October 2025, is a standalone certifiable standard rather than an extension of ISO/IEC 27001.

The AI management system (AIMS) standard published December 2023, setting requirements for responsibly developing, providing or using AI systems; certifiable.

Top management’s periodic review of the management system’s suitability and effectiveness; always examined in ISO audits.

Directive (EU) 2022/2555, widening cybersecurity duties for essential and important entities, including risk-management measures, incident reporting and management accountability, via national laws.

A failure to meet a standard requirement found during an ISO audit, graded major or minor. Major nonconformities normally block certification until closed.

A body designated by an EU member state to carry out third-party conformity assessment tasks. Whether one is needed depends on product category and procedure.

The period a SOC 2 Type 2 report covers. The auditor samples evidence from within it, so evidence must be produced during the period, not after.

The payment card data security standard set by the PCI SSC and enforced by card brands, current version v4.0.1. Compliance is validated by a QSA assessment or a Self-Assessment Questionnaire.

Simulated attacks by testers to find exploitable weaknesses. Not always explicitly mandated by SOC 2 or ISO/IEC 27001, but buyers and auditors usually expect one at least annually.

Protected Health Information: individually identifiable health information protected by HIPAA.

China’s Personal Information Protection Law, effective 1 November 2021. Outbound transfers require a security assessment, standard contract or certification unless an exemption applies.

A party processing personal data on behalf of a controller, such as a SaaS vendor hosting customer data. Must sign an Article 28-compliant DPA.

Qualified Security Assessor, a firm certified by the PCI SSC to assess entities and produce a Report on Compliance (ROC).

Commission Delegated Regulation (EU) 2022/30, requiring internet-connected radio equipment to meet cybersecurity, data-protection and anti-fraud essential requirements from 1 August 2025; harmonised standards EN 18031.

Records of Processing Activities required by GDPR Article 30: purposes, data categories, recipients, transfers and retention.

Software Bill of Materials listing components, versions and origins. The EU CRA requires manufacturers to draw up and keep one.

Standard Contractual Clauses adopted by the European Commission in 2021; the usual mechanism for transfers to countries without adequacy, including China, typically with a transfer impact assessment.

The Shared Assessments Standardized Information Gathering questionnaire (SIG Core, SIG Lite), a common enterprise vendor-security questionnaire.

An attestation report on controls relevant to user entities’ internal control over financial reporting, common for payroll and payment processors. Different focus from SOC 2.

An attestation report issued by an independent CPA on a service organisation’s controls relevant to security, availability, processing integrity, confidentiality or privacy, using the AICPA Trust Services Criteria. It is a restricted-use report, not a certificate.

Reports on the fairness of the system description and the suitability of control design as of a specific date. It does not test operating effectiveness over time.

Adds testing of whether controls operated effectively throughout a review period, commonly 3–12 months. Most enterprise buyers ultimately ask for Type 2.

A general-use summary report based on the same criteria as SOC 2, without the detailed test results, suitable for public distribution.

The two stages of an initial ISO certification audit: Stage 1 reviews documentation and readiness; Stage 2 evaluates whether the system operates effectively.

A mandatory ISO/IEC 27001 document stating, for each Annex A control, whether it applies, its implementation status and the justification.

A third party providing relevant services to the service organisation, such as a cloud provider. Usually carved out of the SOC 2 report and covered by its own report.

The annual audit during an ISO certification cycle confirming the system keeps operating; recertification follows in year three.

Transfer Impact Assessment: assessing whether the destination country’s law and practice undermine the SCCs, and what supplementary measures are needed.

The German automotive industry’s information security assessment and exchange mechanism run by ENX, based on the VDA ISA catalogue, with results shared as labels.

A public page presenting security and compliance information, often with NDA-gated reports, certificates, sub-processor lists and security notes, reducing repeat questionnaires.

AICPA criteria comprising Security (the mandatory Common Criteria CC1–CC9) plus optional Availability, Processing Integrity, Confidentiality and Privacy categories.

A buyer’s assessment of a supplier’s security and compliance, typically via questionnaires, SOC 2 reports or ISO certificates, contractual clauses and audits.