Compliance & Security Glossary

Third Party Assessment Organization — an independent, FedRAMP-recognized assessor that performs the security assessment a cloud provider needs for FedRAMP authorization.

A HIPAA Security Rule safeguard an organization must assess and either implement, implement an equivalent alternative to, or document why it isn't reasonable — not optional, despite the name, but more flexible than a "required" safeguard. HHS's 2025 proposed rule would convert several addressable safeguards to required ones.

The ISO 42001 term for an organization's continuous, documented system for governing how it develops, provides, or uses AI — the AI-specific analog to ISO 27001's ISMS.

The contract HIPAA requires between a covered entity and any vendor ("business associate") that creates, receives, maintains, or transmits protected health information on the covered entity's behalf.

CMMC Third-Party Assessment Organization — an accredited organization authorized to conduct CMMC Level 2 certification assessments for defense contractors that require third-party (rather than self-) assessment.

The conformity marking required before a product with digital elements can be placed on the EU market under the CRA, mirroring the mark's use across EU product-safety law.

The process (self-assessment or third-party, depending on product tier) by which a manufacturer demonstrates a product with digital elements meets the CRA's essential requirements before CE marking.

Federal information that requires safeguarding under law, regulation, or government-wide policy, but isn't classified — the specific category of information CMMC Level 2 and above is built to protect.

An ICT provider (which can include a cloud provider) designated by the European Supervisory Authorities as critical to the EU financial system, bringing it under direct regulatory oversight even though it isn't itself a financial entity.

The CRA's highest-scrutiny product category, requiring third-party conformity assessment before market placement.

One of four levels (Partial, Risk Informed, Repeatable, Adaptive) NIST CSF 2.0 uses to describe how mature and integrated an organization's cybersecurity risk-management practices are — a maturity descriptor, not a pass/fail compliance grade.

A PCI DSS v4.0 option letting an organization design its own control to meet a requirement's stated intent, validated by a QSA, as an alternative to the standard's traditional prescriptive ("defined approach") controls.

The European Union Agency for Cybersecurity — one of the receiving bodies for CRA Article 14's mandatory vulnerability and incident reporting, alongside national CSIRTs.

The higher-scrutiny NIS2 category — larger organizations in the most critical sectors (energy, transport, banking, health, digital infrastructure, public administration, space) subject to proactive supervision by national authorities.

The Low/Moderate/High categorization (based on Federal Information Processing Standard 199) that determines which NIST SP 800-53 control baseline a federal information system — including a FedRAMP cloud system — must meet.

The function new to CSF 2.0 — establishing, communicating, and monitoring an organization's cybersecurity risk-management strategy, expectations, and policy. CSF 2.0 treats Govern as informing all five other functions rather than sitting alongside them as a peer.

The second NIS2 category — medium-sized entities in scope sectors, subject to reactive (ex-post) supervision rather than the proactive oversight essential entities face.

A CRA product category (Class I and Class II) — including password managers, VPNs, firewalls, and industrial IoT components — subject to stricter conformity assessment than the default category.

Information Security Management System — the continuous, documented risk-management process ISO 27001 certifies, not a single tool or control.

The national body responsible for checking CRA compliance and enforcing penalties in each EU member state.

An independent organization designated by an EU member state to carry out third-party conformity assessment for Important Class II and Critical products under the CRA.

Hardware or software whose intended or reasonably foreseeable use includes a direct or indirect logical or data connection to a device or network — the CRA's core scope trigger (Art. 3).

An individual certified by the PCI Security Standards Council to perform on-site PCI DSS assessments (Reports on Compliance) for larger merchants and service providers.

A SOC 2 report opining on whether an organization's controls operated effectively over an observation period (typically 3-12 months), as opposed to a Type I report's single point-in-time design opinion.

A machine-readable inventory of the components in a software product, required under the CRA's Annex I technical documentation obligations.

The ISO 27001 document listing every Annex A control, whether it's applicable to the organization's ISMS scope, and — if excluded — why. Auditors treat it as a central artifact of the certification.

The status a cloud provider reaches after completing a full, independently verified StateRAMP security assessment — the program's highest, most reusable status for state and local government customers.

The length of time a manufacturer commits to providing security updates for a product, which must be stated and justified in the product's technical documentation under the CRA.

DORA's most advanced resilience-testing requirement — a real, intelligence-led red-team exercise against an entity's live production systems, required for the largest, most systemically important financial entities on a multi-year cycle.

The AICPA's five categories a SOC 2 report can be scoped against: Security (mandatory), Availability, Processing Integrity, Confidentiality, and Privacy.