Glossary

The compliance glossary, minus the jargon

Short, practical definitions of the terms you’ll hit in a SOC 2 or ISO 27001 program — written by engineers who do the work daily, each linked to the deeper guide showing how it plays out in practice.

Talk to an Expert A to Z

Last updated July 26, 2026

75terms, from annex a controls to walkthrough

20letters

1deeper guide linked from every term

0jargon left unexplained

Glossary · A–ZPractitioner definitions

SOC 2 · ISO 27001 · HIPAA · FedRAMP · CMMCWritten by the engineers who do the work

The compliance glossary, minus the jargon.

Compliance Glossary · Hub

/0.1

A to Z

Every term links to the guide where it plays out in practice

AAnnex A controls Attestation Audit exception Audit readiness Audit window Authority to Operate (ATO)

BBridge letter Business associate agreement (BAA)

CCarve-out method CMMC Third-Party Assessment Organization (C3PAO)Compensating control Complementary user entity controls (CUECs)Compliance automation Compliance engineer Consensus Assessments Initiative Questionnaire (CAIQ)Continuous compliance Continuous monitoring Control owner Controlled Unclassified Information (CUI)Covered entity

DData processing agreement (DPA)Data protection impact assessment (DPIA)Data protection officer (DPO)Data residency Design vs. operating effectiveness

EEvidence collection

FForward-deployed engineer

GGap assessment Governance, risk, and compliance (GRC)GRC platform

IIn-scope systems Incident response plan Information security management system (ISMS)Internal audit ISO 27002

LLeast privilege

MManaged GRC Management assertion Mobile device management (MDM)Multi-factor authentication (MFA)

NNIST Cybersecurity Framework (CSF)NIST SP 800-171 Nonconformity

OObservation period

PPBC list Plan of Action and Milestones (POA&M)Protected health information (PHI)

QQualified opinion

RReadiness assessment Remediation plan Risk acceptance

SSampling Security questionnaire Shared responsibility model Single sign-on (SSO)SOC 1 SOC 2 Type 1 SOC 2 Type 2 SOC 3 Stage 1 audit Stage 2 audit Standardized Information Gathering (SIG) questionnaire Statement of Applicability (SoA)Subprocessor Subservice organization Surveillance audit System description System Security Plan (SSP)

TThird-Party Assessment Organization (3PAO)Trust center Trust Services Criteria

UUnqualified opinion

VVendor tiering Virtual CISO (vCISO)

WWalkthrough

Glossary

Skip the vocabulary lesson entirely

When Agency runs your program, the terminology becomes our problem — you just get the report. Top-ranked Vanta & Drata partner · 1,000+ companies served since 2021 · 4.9/5 on G2.

Talk to an Expert Top-ranked Vanta & Drata partner · 1,000+ companies served since 2021 · 4.9/5 on G2

Nearby terms

Compliance Q&ADirect answers to the questions behind these terms.

SOC 2 FrameworkWhere most of this vocabulary shows up first.

GRC Platform & Virtual CISO FAQHow the pieces fit together in a managed program.

Platform Products

Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integration Auditsuisse AIAI-powered evidence collection and analysis for IT audits.

Find your auditor

Auditnex makes buying audits simpler and more transparent.

Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.

Explore Auditnex

Common GRC Questions

GRC Platform & Virtual CISO FAQ

The long-form FAQ on how managed GRC and virtual CISO coverage work together.

Read the FAQ

AI-Powered

Build a Security & Compliance Team Led by Your Own Virtual CISO

Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.

Talk to an Expert Automation ends where judgment begins.