Security & compliance glossary
Definitions for the terms that keep showing up in questionnaires, audits, and procurement conversations.
CAIQ (Consensus Assessments Initiative Questionnaire)
CAIQ is the Cloud Security Alliance's standard questionnaire for cloud providers, mapped one-to-one to the Cloud Controls Matrix and used as the STAR Level 1 artifact.
Cloud Controls Matrix
The Cloud Controls Matrix (CCM) is the Cloud Security Alliance's framework of 197 cloud-specific security and privacy controls, organized across 17 domains.
CMMC (Cybersecurity Maturity Model Certification)
CMMC is the DoD program that certifies defense contractors against NIST 800-171 controls, with the DFARS clause effective November 10, 2025.
CSA STAR (Security Trust Assurance Risk)
CSA STAR is the Cloud Security Alliance's trust registry and certification program where cloud providers publish security assessments from Level 1 (self-assessment via CAIQ) through Level 3 (third-party continuous auditing).
DORA (Digital Operational Resilience Act)
DORA is the EU regulation on ICT risk management for financial entities and their critical technology providers, fully applicable from January 17, 2025.
DPA (Data Processing Agreement)
A DPA is a contract mandated by GDPR Article 28 between a data controller and a processor, defining how personal data is handled, the processor's obligations, and security requirements.
GDPR (General Data Protection Regulation)
GDPR is the EU data protection regulation that has applied since May 25, 2018, with fines up to 20 million euros or 4 percent of annual global turnover.
HDS (Hébergeurs de Données de Santé)
HDS is the French certification required for any provider hosting personal health data of patients in France, governed by the ASIP Santé scheme.
HECVAT (Higher Education Community Vendor Assessment Toolkit)
HECVAT is the security questionnaire US colleges and universities use to assess cloud and SaaS vendors before contracting.
HITRUST CSF (Common Security Framework)
HITRUST CSF is a certifiable security framework, originally built for US healthcare, that maps HIPAA, NIST, ISO 27001, and PCI controls into one assessment.
ISO/IEC 27001 (Information Security Management System)
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS) and the most-cited security certificate in vendor security reviews.
ISO/IEC 27017 (Cloud Services Code of Practice)
ISO/IEC 27017 is the cloud-services extension to ISO 27001, adding cloud-specific implementation guidance and seven cloud-only controls on top of the base ISMS.
ISO/IEC 27018 (PII Protection in Public Clouds)
ISO/IEC 27018 is the code of practice for protecting personally identifiable information in public clouds when the provider is acting as a PII processor.
ISO/IEC 27701 (Privacy Information Management System)
ISO/IEC 27701 is the international standard for a Privacy Information Management System (PIMS), the certifiable framework most often used to demonstrate GDPR alignment.
ISO/IEC 42001 (AI Management System)
ISO/IEC 42001 is the first international management-system standard for artificial intelligence, published by ISO and IEC in December 2023.
NIST 800-171 (Protecting Controlled Unclassified Information)
NIST 800-171 is the control catalog non-federal systems must implement to protect Controlled Unclassified Information from federal agencies, including DoD.
NIST AI RMF (AI Risk Management Framework)
The NIST AI Risk Management Framework is a voluntary, non-certifiable US framework providing guidance for organizations to identify, measure, and manage risks from artificial intelligence systems.
NIST CSF 2.0 (Cybersecurity Framework)
NIST CSF 2.0 is the voluntary US cybersecurity framework, organized in six functions, including the new Govern function added in February 2024.
PCI DSS 4.0 (Payment Card Industry Data Security Standard)
PCI DSS 4.0 is the payment-card data security standard from the PCI SSC, with 51 future-dated requirements that became mandatory on March 31, 2025.
QSA (Qualified Security Assessor)
A QSA is a third-party auditor certified by the PCI Security Standards Council to conduct PCI DSS compliance audits and produce Attestations of Compliance (AOCs) for payment service providers.
SIG (Standard Information Gathering)
SIG is the Shared Assessments vendor questionnaire, the most common pre-contract security questionnaire sent to third-party software and service providers.
SOC 1 (Service Organization Controls 1)
SOC 1 is the AICPA audit of a service provider's controls over financial reporting, used when a vendor's systems affect a customer's books.
SOC 2 (Service Organization Controls 2)
SOC 2 is the AICPA audit of a service provider's controls against the Trust Services Criteria for security, availability, and related categories.
SOC 3 (Service Organization Controls 3)
SOC 3 is the AICPA general-use summary of a SOC 2 examination, designed to be published on a public trust page or website.
Sub-processor
A sub-processor is a third party that a data processor (vendor) engages to process personal data on its behalf, subject to approval by the data controller under GDPR.
TPRM (Third-Party Risk Management)
TPRM is the practice of identifying, assessing, and continuously monitoring risks an organization inherits from its vendors, contractors, and service providers.
VRM (Vendor Risk Management)
VRM is the discipline of identifying, assessing, and monitoring the security and operational risk that an organization inherits from its vendors.