Compliance Glossary
Key terms for SOC 2, ISO 27001, HIPAA, GDPR & EU AI Act — explained in plain language for security, legal, and engineering teams.
A
Access Control
Mechanisms that restrict who can view or use resources in a computing environment. Access control ensures that only authorized users can interact with systems, data, and physical locations. It is a foundational requirement under SOC 2 CC6 and ISO 27001 Annex A.9.
Related: Authentication, Least Privilege, Role-Based Access Control (RBAC)
Audit Trail
A chronological record of events and activities within a system, used to reconstruct and examine actions that affected a specific operation or procedure. Audit trails are critical for demonstrating compliance and investigating security incidents. SOC 2 requires comprehensive audit logging under CC7.
Related: Evidence, Log Management, SOC 2
Authentication
The process of verifying the identity of a user, device, or system. Multi-factor authentication (MFA) combines two or more verification methods — something you know, have, or are — and is strongly recommended by SOC 2, ISO 27001, and HIPAA.
B
Business Associate Agreement (BAA)
A legally required contract under HIPAA between a covered entity (e.g., healthcare provider) and a business associate (e.g., cloud vendor) that handles Protected Health Information (PHI). The BAA stipulates how PHI must be protected, used, and disclosed. Without a BAA, sharing PHI with a vendor violates HIPAA.
Related: HIPAA, PHI, Vendor Risk Management
C
Certification
Formal recognition by an accredited body that an organization meets the requirements of a specific standard, such as ISO 27001 or SOC 2 Type II. Certification signals to customers and partners that your security controls have been independently validated.
Related: ISO 27001, SOC 2 Type II, Audit Trail
Change Management
A structured process for requesting, evaluating, approving, implementing, and reviewing changes to IT systems. Effective change management reduces the risk of introducing vulnerabilities and is a core requirement of SOC 2 (CC8) and ISO 27001 (A.12.1.2).
Related: SOC 2, Risk Assessment
Compliance
The process of adhering to laws, regulations, industry standards, and internal policies applicable to an organization's operations. Common compliance frameworks include SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and the EU AI Act. Non-compliance can result in fines, reputational damage, and loss of customers.
Related: Framework, GRC, Risk Assessment
Control
A safeguard or countermeasure — policy, procedure, technology, or physical measure — implemented to manage a risk. Controls can be preventive (stopping an event), detective (identifying an event), or corrective (responding to an event). SOC 2 maps controls to Trust Service Criteria.
Related: Trust Service Criteria, Risk Register, SOC 2
D
Data Processing Agreement (DPA)
A contractual obligation under GDPR between a data controller and data processor governing how personal data is processed. DPAs specify the purpose of processing, security obligations, sub-processor rules, and data subject rights. Article 28 of GDPR mandates DPAs for all controller-processor relationships.
Related: GDPR, PII, Vendor Risk Management
Due Diligence
The process of thoroughly investigating a vendor, partner, or acquisition target before entering into a business relationship. In compliance, due diligence involves assessing the security posture, certifications, and risk profile of third parties to ensure they meet your organization's standards.
Related: Vendor Risk Management, Risk Assessment
E
EU AI Act
The European Union's comprehensive regulation for artificial intelligence systems, entered into force in 2024. It classifies AI systems by risk level (unacceptable, high, limited, minimal) and imposes obligations for transparency, human oversight, documentation, and conformity assessments. High-risk AI systems face mandatory requirements similar in scope to GDPR.
Related: GDPR, Risk Assessment, Compliance
Evidence
Documentation and artifacts collected to demonstrate that a control is operating effectively. Evidence for SOC 2 audits may include screenshots, logs, policies, HR records, vendor contracts, and penetration test reports. Insufficient or missing evidence is a primary cause of audit findings.
Related: Audit Trail, SOC 2, Control
F
Framework
A structured set of guidelines, best practices, or requirements for managing information security, privacy, or AI risk. Common frameworks include SOC 2 (AICPA), ISO 27001 (ISO/IEC), NIST CSF, HIPAA (U.S. HHS), GDPR (EU), and the EU AI Act. Organizations often pursue multiple frameworks simultaneously.
Related: Compliance, GRC, SOC 2
G
Gap Analysis
A systematic comparison of an organization's current security posture against the requirements of a target framework or standard. A gap analysis identifies which controls are missing, partially implemented, or not operating effectively, enabling prioritized remediation before a formal audit.
Related: Control, Risk Assessment, SOC 2
GDPR
The General Data Protection Regulation is the EU's landmark privacy law, effective May 2018. It grants individuals rights over their personal data and imposes obligations on organizations that collect or process EU residents' data, including lawful basis for processing, data minimization, breach notification (72 hours), and DPAs for processors. Fines can reach €20M or 4% of global annual turnover.
Related: PII, Data Processing Agreement (DPA), Privacy
GRC
Governance, Risk, and Compliance — an integrated approach to aligning IT and business objectives while managing risk and meeting regulatory requirements. GRC platforms centralize policy management, risk registers, audit evidence, and compliance tracking across multiple frameworks, reducing manual effort and duplication.
Related: Compliance, Risk Register, Framework
H
HIPAA
The Health Insurance Portability and Accountability Act is U.S. federal law governing the use and disclosure of Protected Health Information (PHI). HIPAA's Security Rule requires covered entities and business associates to implement administrative, physical, and technical safeguards. Violations can result in fines up to $1.9M per violation category per year.
Related: PHI, Business Associate Agreement (BAA), Compliance
I
Incident Response
An organized approach to addressing and managing the aftermath of a security breach or cyberattack. A formal incident response plan defines roles, communication procedures, containment steps, and post-incident review. SOC 2 CC7 and ISO 27001 A.16 require documented and tested incident response procedures.
Related: Audit Trail, Risk Register, SOC 2
ISMS
An Information Security Management System is the framework of policies, processes, and controls an organization uses to manage information security risks systematically. ISO 27001 certification requires a formally established, implemented, and continually improved ISMS covering scope definition, risk treatment, and management review.
Related: ISO 27001, Risk Register, Framework
ISO 27001
The international standard for information security management systems (ISMS). Published by ISO/IEC, it specifies requirements for establishing, implementing, maintaining, and improving an ISMS through 93 controls across four themes: organizational, people, physical, and technological. ISO 27001 certification is recognized globally and often required by enterprise customers.
Related: ISMS, Control, Certification
L
Least Privilege
The security principle that users, applications, and systems should be granted only the minimum permissions required to perform their function — nothing more. Enforcing least privilege limits the blast radius of a compromised account and is a foundational control in SOC 2 (CC6.3) and ISO 27001 (A.9.2).
Log Management
The practice of collecting, aggregating, storing, and analyzing log data from systems, applications, and network devices. Centralized log management enables security monitoring, incident investigation, and evidence collection for compliance audits. Retention periods vary by framework (e.g., HIPAA requires 6 years).
Related: Audit Trail, Incident Response, SIEM
M
Multi-Factor Authentication (MFA)
An authentication method requiring users to provide two or more verification factors to gain access. MFA dramatically reduces the risk of unauthorized access from stolen credentials and is required or strongly recommended by SOC 2, ISO 27001, HIPAA, and GDPR.
Related: Authentication, Access Control
P
PII
Personally Identifiable Information refers to any data that can be used to identify a specific individual, either directly (name, SSN, email) or indirectly. GDPR, CCPA, and many other privacy laws impose strict requirements on the collection, processing, storage, and deletion of PII. Mishandling PII can trigger breach notification obligations.
PHI
Protected Health Information is any individually identifiable health information created, received, maintained, or transmitted by a HIPAA-covered entity or business associate. PHI includes medical records, billing information, and any data linking a person's identity to their health status or treatment. Unauthorized disclosure of PHI can result in significant HIPAA penalties.
Related: HIPAA, PII, Business Associate Agreement (BAA)
Privacy
In compliance, privacy refers to the right of individuals to control how their personal data is collected, used, and disclosed. Privacy programs typically encompass a privacy policy, data inventory, consent mechanisms, data subject rights (access, deletion), and cross-border transfer mechanisms under frameworks like GDPR and CCPA.
R
Risk Assessment
A systematic process for identifying, analyzing, and evaluating risks to organizational assets. A risk assessment considers threat sources, likelihood, and impact to prioritize remediation. Both SOC 2 (CC3) and ISO 27001 (Clause 6.1) require documented risk assessments as part of the management system.
Related: Risk Register, GRC, Gap Analysis
Risk Register
A documented record of identified risks, their likelihood, potential impact, risk owner, and treatment plan. The risk register is a living document updated as new risks emerge or existing risks change. It is a central artifact reviewed during SOC 2 and ISO 27001 audits.
Related: Risk Assessment, GRC, Control
Role-Based Access Control (RBAC)
An access control model where permissions are assigned to roles rather than individual users. Users are then assigned roles based on their job function, ensuring consistent and auditable access provisioning. RBAC simplifies user management and supports the principle of least privilege.
Related: Access Control, Least Privilege, ISMS
S
SIEM
Security Information and Event Management systems collect, aggregate, and analyze log and event data from across an organization's IT environment in real time. SIEMs enable threat detection, compliance reporting, and forensic investigation. Deploying a SIEM supports evidence collection for SOC 2 CC7 and ISO 27001 A.12.4.
Related: Log Management, Incident Response, Audit Trail
SOC 2
Service Organization Control 2 is an auditing standard developed by the AICPA for technology and cloud service providers. SOC 2 reports assess whether an organization's controls meet the Trust Service Criteria (TSC) across five domains: Security, Availability, Processing Integrity, Confidentiality, and Privacy. SOC 2 Type II is considered the gold standard for cloud vendor trust.
Related: Trust Service Criteria, SOC 2 Type I, SOC 2 Type II
SOC 2 Type I
A SOC 2 Type I report evaluates whether an organization's controls are suitably designed to meet the Trust Service Criteria at a specific point in time. Type I is faster to obtain (typically 4–8 weeks) and is often used as a stepping stone before pursuing Type II. It does not provide assurance that controls operated effectively over time.
Related: SOC 2, SOC 2 Type II, Certification
SOC 2 Type II
A SOC 2 Type II report covers a minimum observation period of six months, assessing whether controls were suitably designed and operating effectively throughout the period. It is the most trusted form of SOC 2 report and is commonly required by enterprise customers before signing contracts with SaaS vendors.
Related: SOC 2, SOC 2 Type I, Evidence
T
Trust Service Criteria (TSC)
The Trust Service Criteria are the control categories defined by the AICPA against which SOC 2 auditors evaluate a service organization. The five TSC domains are: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Most organizations pursue SOC 2 starting with Security only.
Related: SOC 2, Control, Certification
V
Vendor Risk Management
The process of identifying, assessing, and monitoring risks introduced by third-party vendors and suppliers that have access to your systems or data. Vendor risk management includes security questionnaires, contract reviews, SOC 2 report reviews, and ongoing monitoring. It is required under SOC 2 CC9 and ISO 27001 A.15.
Related: Due Diligence, Business Associate Agreement (BAA), Risk Register
Vulnerability Management
The ongoing process of identifying, classifying, remediating, and mitigating security vulnerabilities in systems and software. A mature vulnerability management program includes regular scanning, a defined SLA for patching by severity, and tracking of remediation through a risk register. Required by SOC 2 CC7 and ISO 27001 A.12.6.
Related: Risk Register, Incident Response, Control
Ready to put these terms into practice?
Barafaa automates SOC 2, ISO 27001, HIPAA, GDPR, and EU AI Act compliance — from gap analysis through audit export.