Glossary

GRC terminology, in plain English.

Every acronym and buzzword, explained without the jargon. If it's missing, tell us — we'll add it.

A

The set of controls defined in ISO 27001.

Corrective and Preventive Action.

A safeguard or countermeasure used to reduce risk.

Artefacts proving that a control is operating as designed.

The EU General Data Protection Regulation.

US law protecting health information.

Information Security Management System.

International standard for information security management systems (ISMS).

The security standard for handling cardholder data.

The risk that remains after controls are applied.

A structured record of risks an organization has identified.

An attestation report for service organizations on trust services criteria.

A document listing which ISO 27001 controls apply to an ISMS, and why.

Risk introduced by vendors and service providers.

The five criteria SOC 2 reports are scoped against.

See Asurvo in action with a 20-minute walkthrough tailored to your stack and frameworks.