Compliance glossary

Compliance glossary: SOC 2, HIPAA, CMMC, ISO 27001 and AI terms in plain English

67 terms that come up in audits, security questionnaires and contracts, each defined in a sentence or two, with a link to the guide that covers it in full. Every term has its own anchor, so you can send a colleague straight to it.

Take the 3-minute Cyber Hygiene Test

A

Access review: A periodic check, often quarterly, that each person’s access to systems still matches their job, with a sign-off and a record of what was removed. SOC 2 auditors sample these. SOC 2 compliance checklist
AI governance: How a company decides which AI it uses, who owns the risk, and what it checks before and after a tool goes live: an inventory, a policy, an owner, reviews and records. AI governance assessment
Annex A (ISO 27001): The list of controls in ISO/IEC 27001. The 2022 version has 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). You choose which apply in the Statement of Applicability. ISO 27001 checklist
Attestation: An independent opinion on statements someone else makes. A SOC 2 report is an attestation by a CPA firm on your controls, which is why it is called a report and not a certificate. SOC 2 Type 1 vs Type 2
Audit log: A record of who did what in a system and when: sign-ins, changes, access to records. HIPAA requires audit controls on systems with ePHI, and SOC 2 and CMMC test logging too. HIPAA audit log retention

B

BAA (business associate agreement): The contract HIPAA requires between a covered entity and a vendor that handles its PHI, or between a business associate and its subcontractor. Its required clauses are in 45 CFR 164.504(e). HIPAA BAA checklist
Breach notification (HIPAA): The duty to tell affected individuals, HHS and sometimes the media after a breach of unsecured PHI: without unreasonable delay and no later than 60 days after discovery. HIPAA breach notification timeline
Bridge letter: A letter from a company, not its auditor, that covers the gap between the end of its last SOC report period and today, stating that nothing material has changed. SOC 2 renewal and bridge letters
Business associate: Under HIPAA, a person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity or another business associate: software vendors, billing services, IT providers, cloud hosts. Directly liable under the Security Rule since 2013. HIPAA for business associates

C

C3PAO: Certified Third-Party Assessment Organization: a company authorized to conduct CMMC Level 2 certification assessments. AccuSights is a readiness partner, not a C3PAO. CMMC certification
CAGE code: Commercial and Government Entity code: a five-character identifier for companies that do business with the US government, assigned during registration in SAM.gov. Defense contracts and SPRS records reference it.
CMMC: Cybersecurity Maturity Model Certification: the Department of Defense program that checks whether contractors protect FCI and CUI. Level 1 covers FCI, Level 2 the 110 requirements of NIST SP 800-171, Level 3 adds selected NIST SP 800-172 requirements. CMMC levels
Common criteria (SOC 2): The 33 criteria in the Security category of the Trust Services Criteria, grouped CC1 to CC9: control environment, communication, risk assessment, monitoring, control activities, access, operations, change management and risk mitigation. SOC 2 compliance checklist
Compensating control: An alternative control that meets the intent of a requirement when the standard control is not practical. It has to be documented and usually needs the auditor or assessor to accept it.
Conduit exception: The narrow HIPAA rule that a service which only transmits PHI, such as the postal service or an internet carrier, is not a business associate. It does not cover a vendor that stores PHI, even encrypted. Do I need a BAA? Checker
Control: A safeguard that reduces a risk: a policy, a process or a technical setting, such as MFA on every account. Frameworks state what controls must achieve; you show the evidence that yours run.
Covered entity: Under HIPAA, a health plan, a health care clearinghouse, or a health care provider that sends health information electronically in a standard transaction such as a claim. Defined in 45 CFR 160.103. HIPAA covered entities
CUI (Controlled Unclassified Information): Government information that is not classified but must be protected by law, regulation or policy. Defense contractors that handle it are held to NIST SP 800-171 and CMMC Level 2. NIST SP 800-171 explained
Cyber AB: The accreditation body for the CMMC ecosystem. It authorizes C3PAOs and oversees the assessors and training that the Department of Defense’s program relies on.

D

DDQ (due diligence questionnaire): A questionnaire a buyer, investor or partner sends to check a company’s security, compliance and operations before signing. Security DDQs overlap heavily with vendor risk questionnaires. Vendor risk questionnaire template
De-identification: Removing identifiers so health information no longer counts as PHI. HIPAA allows two methods: removing all 18 safe harbor identifiers, or a documented expert determination. What is PHI?
DFARS 252.204-7012: The defense contract clause that requires contractors to protect covered defense information with NIST SP 800-171 and to report cyber incidents to the Department of Defense within 72 hours. CMMC compliance checklist

E

Enclave: A separate, contained environment where CUI or other regulated data lives, so the requirements apply to the enclave rather than the whole company. It often shrinks a CMMC assessment. CMMC certification cost
ePHI: Protected health information in electronic form. The HIPAA Security Rule applies to ePHI only; the Privacy Rule covers PHI in every form. What is PHI?
EU AI Act: The European Union’s AI regulation. It sorts AI by risk and role and reaches US companies whose AI or its output is used in the EU. As of October 2026, high-risk obligations are deferred to 2 December 2027. AI governance regulations
Evidence: The record that proves a control ran: a ticket, a dated export, a signed document, a tool report. A control without evidence is a control the auditor cannot test.

F

FCI (Federal Contract Information): Information provided by or generated for the government under a contract and not intended for public release. Protecting it with the 15 basic safeguards of FAR 52.204-21 is CMMC Level 1. CMMC levels
FedRAMP: The US government program that authorizes cloud services for use by federal agencies. Under DFARS 7012, a cloud service that stores a contractor’s CUI must meet the FedRAMP Moderate baseline or its equivalent. CMMC vs FedRAMP
FIPS-validated encryption: Encryption whose cryptographic module has been validated under the FIPS 140 program. NIST SP 800-171 requirement 3.13.11 asks for it when encryption protects CUI. SPRS score explained

G

Gap assessment: A review of where you stand against a framework’s requirements, ending in a list of what is missing and a plan to close it. It is usually the first paid step toward any audit. AccuSights Assess
GCC High: Microsoft’s 365 government cloud for US defense contractors and agencies that handle CUI and export-controlled data. Many suppliers move CUI there to meet DFARS 7012. CMMC certification cost
GPAI (general-purpose AI model): An AI model trained for broad use, such as a large language model, that other systems build on. The EU AI Act has set duties for GPAI providers since 2 August 2025. AI governance regulations
GRC: Governance, risk and compliance: the policies, risk register, controls and evidence a company uses to run its compliance program, and the software category that holds them. GRC platform

H

HITECH Act: The 2009 law that strengthened HIPAA enforcement, made business associates directly liable (through the 2013 Omnibus Rule) and created the breach notification requirements.
Hybrid entity: Under HIPAA, a single legal entity that does both covered and non-covered work and designates its health care components, so the rules apply to those components only. HIPAA covered entities

I

Incident response plan: The written plan for detecting, escalating, containing and learning from a security incident, with named roles and the notification clocks that apply to you. Every major framework asks for one, tested.
ISMS: Information security management system: the policies, risk process, controls, audits and reviews that ISO 27001 certifies. Clauses 4 to 10 of the standard describe it. ISO 27001 checklist
ISO 27001: ISO/IEC 27001, the international standard for an information security management system. An accredited certification body certifies it after a Stage 1 and Stage 2 audit; the certificate lasts three years. ISO 27001 certification
ISO 42001: ISO/IEC 42001:2023, the management system standard for AI, built like ISO 27001 with clauses 4 to 10 and 38 Annex A controls. It can be certified by an accredited body. ISO 42001 certification

M

MFA (multi-factor authentication): Signing in with something beyond a password, such as an app prompt or a hardware key. HIPAA’s proposed update would require it; SOC 2, ISO 27001 and CMMC auditors already expect it.
Minimum necessary: The HIPAA Privacy Rule standard that uses and disclosures of PHI should be limited to the minimum needed for the purpose. It does not apply to disclosures for treatment.

N

NIST AI RMF: The NIST AI Risk Management Framework 1.0, published in January 2023: a voluntary framework with four functions (Govern, Map, Measure, Manage), 19 categories and 72 subcategories. It is not certifiable. NIST AI RMF explained
NIST CSF: The NIST Cybersecurity Framework, a voluntary framework organized into functions for governing, identifying, protecting, detecting, responding and recovering. Version 2.0 added the Govern function. NIST CSF compliance
NIST SP 800-171: The NIST publication that sets the requirements for protecting CUI on non-federal systems. Revision 2 has 110 requirements in 14 families and is the one DFARS 7012 and CMMC Level 2 use; Revision 3 (May 2024) has 97 in 17 families. NIST SP 800-171 explained

O

Observation period: The stretch of time a SOC 2 Type 2 report covers, usually 3 to 12 months, during which the auditor tests that controls operated. A Type 1 has none; it looks at one date. SOC 2 Type 2
OCR (HHS Office for Civil Rights): The part of the US Department of Health and Human Services that enforces the HIPAA Privacy, Security and Breach Notification Rules through investigations, resolution agreements and penalties. What an OCR investigation looks like

P

Peer review (CPA firms): The AICPA program in which another firm inspects a CPA firm’s quality, roughly every three years. Check a SOC auditor’s enrollment in the AICPA public file search before you sign. Choosing a SOC 2 auditor
Penetration test: An authorized, simulated attack on your systems to find weaknesses a scanner misses. SOC 2 does not mandate one, but most auditors and enterprise buyers expect it. Is a pen test mandatory for SOC 2?
PHI (protected health information): Information that identifies a person and relates to their health, care or payment for care, held or sent by a HIPAA covered entity or business associate, in any form. What is PHI?
POA&M (plan of action and milestones): The list of requirements not yet met, with the fix, the owner and the date. For CMMC Level 2 only some requirements may sit on one, and they must close within 180 days. CMMC compliance checklist

R

Risk analysis (HIPAA): The documented assessment HIPAA requires of where ePHI lives, the threats to it, how likely and harmful each is, and what controls are in place. It is the first document OCR asks for. Risk analysis vs risk assessment
Risk register: The list of identified risks, each with an owner, a likelihood, an impact, a score and a treatment, reviewed on a schedule. SOC 2, ISO 27001 and HIPAA all expect one in some form.

S

Shadow AI: AI tools staff use without approval, often through personal accounts. It is the usual reason an AI inventory built from a survey misses most of what is in use. AI governance assessment
SoA (Statement of Applicability): The ISO 27001 document that lists every Annex A control, whether it applies, why, and whether it is in place. Auditors open it first. ISO 27001 checklist
SOC 1: A CPA firm’s report on a service organization’s controls that are relevant to its customers’ financial reporting. Customers’ auditors read it. SOC 1 vs SOC 2
SOC 2: A CPA firm’s report on a service organization’s controls over security, and optionally availability, processing integrity, confidentiality and privacy, tested against the AICPA Trust Services Criteria. SOC 2 compliance
SOC 3: A general-use summary of a SOC 2 examination without the control detail and test results, so it can be posted publicly. Security reviewers usually still ask for the SOC 2. SOC 1 vs SOC 2
SPRS score: The self-assessment score a defense contractor posts in the Supplier Performance Risk System: start at 110 and subtract 1, 3 or 5 points for each NIST SP 800-171 requirement not met. SPRS score explained
SSP (System Security Plan): The document that describes a system’s boundary and how each NIST SP 800-171 requirement is met in it. Required by 3.12.4, and it cannot sit on a POA&M. CMMC SSP outline template
Subprocessor: A vendor your vendor uses to process your data, such as its cloud host. Contracts usually require a current subprocessor list and notice before a new one is added.
Surveillance audit: The yearly ISO 27001 audit in the two years between certification and recertification, checking that the ISMS still runs. ISO 27001 certification cost

T

Trust center: A web page where a company lists its security practices and lets customers request documents such as its SOC 2 report, usually behind an NDA.
Trust Services Criteria: The AICPA criteria a SOC 2 is tested against, in five categories: Security (always in scope), Availability, Processing Integrity, Confidentiality and Privacy. SOC 2 compliance checklist
Type 1 and Type 2 reports: A Type 1 SOC report tests the design of controls on one date. A Type 2 tests that they operated over a period, usually 3 to 12 months, and is the one enterprise buyers ask for by name. SOC 2 Type 1 vs Type 2

V

vCISO (virtual CISO): A part-time or fractional chief information security officer who sets security strategy and owns the program for a company that cannot justify a full-time hire.
Vendor risk assessment: A review of a vendor’s security before and during the relationship: a questionnaire, its SOC report or certificate, the contract terms and a risk decision, repeated for critical vendors. Vendor risk questionnaire template

W

WISP (written information security plan): A written plan describing the safeguards a business uses to protect customer information. The FTC Safeguards Rule requires one for covered financial institutions, and IRS Publication 4557 points tax professionals to it. Cybersecurity for accounting firms

Put the terms to work

Checklists and templates that use these words.

Free files you can download without an email: the ISO 27001 checklist, a vendor risk questionnaire, a SOC 2 policy list, a CMMC SSP outline and two HIPAA templates on the compliance templates page. For the full HIPAA list, see the HIPAA compliance checklist; for SOC 2, the SOC 2 guides. Not sure which frameworks apply to you? The compliance scoping tool answers that in four questions.

Next step

A word you cannot define is usually a gap you cannot see.

Book thirty minutes with a compliance engineer and leave with the frameworks that apply to you, the gaps that matter first and a fixed fee in writing.

Take the 3-minute Cyber Hygiene Test

The regulator has the final say. We help interpret, scope and get you ready; we do not certify.

3-min test