Glossary

The jargon, translated. Each term defined in a paragraph.

A

Annex AThe reference list of controls at the back of ISO 27001, 93 in the 2022 edition, that every Statement of Applicability is checked against.
ApplicabilityWhether a law, regulation or standard reaches your organisation at all, and how Sted works that out from your onboarding answers.
Approved documentA version of a policy or procedure that has been signed off, reads Approved in Sted, and is the version your people follow and auditors read.
Audit readinessSted's measure of how much of the evidence an auditor will look for is in place for each standard you adopt, counting only recent evidence.

Certification auditThe external audit a certification body runs before issuing a certificate: stage 1 checks readiness, stage 2 tests the system in practice.
Certification bodyAn independent organisation that audits you against a standard or scheme and issues the certificate if you meet it.
ControlA measure that keeps a risk in check, such as a policy, a process, a setting or a check; each framework uses the word slightly differently.
Controller and processorThe two GDPR roles: a controller decides why and how personal data is used, and a processor handles it on the controller's behalf.
CorrectionAction that fixes a nonconformity you have found, such as reworking a batch or removing an account, without touching its cause.
Corrective actionAction that removes the cause of a nonconformity so it does not happen again, checked afterwards to prove it worked.
Corrective and preventive action (CAPA)The process for handling a problem: fix it, find its cause, remove that cause, and act on similar problems before they happen.

Data protection impact assessment (DPIA)An assessment you carry out before processing personal data in a way likely to put people at high risk, to find and reduce that risk.
Data protection officer (DPO)The independent expert some organisations must appoint to advise on and monitor their compliance with UK GDPR and EU GDPR.
Documented informationThe ISO term for information you must control and the medium it sits on, covering both documents you maintain and records you retain.

EvidenceWhatever shows an auditor a requirement is met and a control ran: records, documents, system output, observation and interviews.

Information security management system (ISMS)The policies, processes, people and records an organisation uses to manage information security risk, as ISO 27001 sets out.
Interested partiesThe people and organisations that can affect, or are affected by, your management system, such as customers, staff, regulators and key suppliers.
Internal auditAn audit you arrange of your own management system, run by someone objective, to check it meets the standard and works as written.
International transferSending personal data, or giving access to it, to a recipient in another country, which UK GDPR and EU GDPR allow only by an approved route.

Lawful basisThe legal ground, one of six under EU GDPR and seven under UK GDPR, that you must have for each purpose you use personal data for.

Management reviewA planned review in which top management checks the management system is still suitable, adequate and effective, and decides what changes.

NonconformityThe failure to meet a requirement, whether set by a standard, the law, a customer or your own procedure, and the trigger for corrective action.

Personal dataAny information that relates to a living person who can be identified from it, directly or with other information, under UK GDPR and EU GDPR.
Personal data breachA security failure that leads to personal data being destroyed, lost, altered, disclosed or accessed without authority, by accident or on purpose.
Policy and Process Owner (PPO)The Sted level for people who own policies and procedures: they edit and approve the documents they own, assign trainees and adopt standards.
Preventive actionAction that removes the cause of a potential nonconformity before it occurs, still a separate procedure under ISO 13485.

Quality management system (QMS)The processes, responsibilities and records an organisation uses to meet customer and regulatory requirements, as ISO 9001 and ISO 13485 set out.

Record templateThe pattern a Sted record is created from: its sections, structured fields and the clauses it serves, under the document it gives evidence for.
Records of processing activities (ROPA)The written inventory of your personal data processing that UK GDPR and EU GDPR Article 30 require controllers and processors to keep.
Repeating recordA record type Sted asks you to complete on a schedule, from weekly to every two years, raising a task before each due date.
Residual riskThe risk that remains after treatment, compared with your acceptance criteria and formally accepted by a named risk owner.
Risk registerThe list of risks you have identified, with each one's owner, likelihood, impact, treatment and what is left, kept as risk evidence.
Risk treatment planThe ISO 27001 plan for dealing with assessed risks: which controls or actions, who owns each, and by when, approved by the risk owners.
Root causeThe underlying reason a problem happened: the cause that, once removed, stops the problem coming back.

SOC 2 reportAn attestation report in which a licensed CPA firm gives its opinion on a service organisation's controls against the Trust Services Criteria.
Special category dataThe kinds of personal data, such as health, ethnicity and biometrics, that UK GDPR and EU GDPR protect most and allow only under an extra condition.
Standard sectionOne of the sections every Sted policy or procedure keeps, such as Scope or Enforcement, adopted for you when the review of a draft finishes.
Statement of Applicability (SoA)The ISO 27001 document that lists every Annex A control, whether you apply it, why, and whether it is implemented.
Subject access request (DSAR)A request from a person for a copy of the personal data you hold about them, which you must usually answer within one calendar month.

Trust Services CriteriaThe AICPA criteria a SOC 2 auditor measures your controls against, grouped into Security and four optional categories.