Compliance terms,
briefly explained.

Rules and technical means that ensure only authorised people access systems and data. One of the most frequently audited controls.

Formal confirmation that a certification body or audit body works competently and independently. Only accreditation makes a certificate internationally recognised.

List of specific measures with owners and deadlines that closes a gap, a risk or a nonconformity.

Optional part of the BSI C5 catalogue for customers with higher protection requirements. They are examined in addition to the basic criteria.

The EU AI Act distinguishes between prohibited practices, high-risk systems, systems with transparency obligations and minimal-risk systems. The higher the category, the stricter the obligations.

Structured survey that captures the implementation status of requirements control by control. The result is a clear picture of what is met and what is missing.

Anything that has value to the organisation and needs protecting: information, systems, applications, premises, and also people's knowledge. The asset inventory is the basis of every risk assessment.

Audit opinion of an independent auditor on an examined system, for example under BSI C5. Unlike a certificate, it is not issued by a certification body.

Systematic, independent examination of whether requirements are met. A distinction is made between internal audits, supplier audits and certification audits by an external body.

State in which all requirements are implemented, evidence is current, and the internal audit and management review are complete. The external audit can then begin without surprises.

Complete record of who changed what in the system and when. Auditors use it to check whether processes are actually followed in practice.

Access for external auditors that shows everything relevant to the audit but does not allow changes. This keeps the audit independent and traceable.

Documented rules on who may access which systems and data and to what extent, including the granting, review and revocation of rights. Auditors almost always ask for evidence of regular access recertification.

The three classic protection goals of information security. Every measure serves at least one of them.

Regular copy of data and systems so that they can be restored after a loss. Auditors focus above all on tested restoration, not just on backing up.

Mandatory part of the BSI C5 catalogue that every cloud provider with a C5 attestation must meet. They are supplemented by additional criteria for higher protection requirements.

German act on the Federal Office for Information Security (BSI). Following the transposition of NIS2, it sets out which entities have which security, reporting and registration obligations.

Planning how critical business processes continue or are quickly restored in the event of disruption. This includes contingency plans, recovery times and regular exercises.

The criteria catalogue of the German Federal Office for Information Security (BSI) for secure cloud services. An independent auditor examines the implementation and issues a Type 1 (suitability) or Type 2 (effectiveness over a period) attestation.

Process step in the HACCP system at which a food safety hazard must be effectively controlled, for example during heating or cooling. Each CCP has critical limits, monitoring and corrective actions.

Confirmation by an accredited certification body that a management system meets the requirements of a standard. It is usually valid for three years, with annual surveillance audits.

Accredited organisation that audits management systems and issues certificates. It must remain independent of consultancy.

Person responsible for building, operating and developing the ISMS. They report to management and coordinate risks, measures and incidents.

Basic principle of all management system standards: plan, do, check, act. A management system is never considered finished.

Individual requirement or safeguard from a framework, such as access control or backup. Controls are assessed, implemented and backed by evidence.

Action that eliminates the cause of a nonconformity so that it does not recur. It goes beyond merely fixing the symptom.

Use of encryption and signatures to protect data in transit and at rest. Frameworks require a concept for algorithms and key management.

Self-defined catalogue of requirements, such as group policies or customer requirements, managed like a standard with controls, evidence and assessments.

The national accreditation body in Germany. Among other things, it accredits certification bodies for ISO 27001 and ISO 9001.

Advance assessment of processing that is likely to result in a high risk to data subjects. It describes the purpose, necessity, risks and countermeasures.

Person who advises a company on data protection matters and monitors compliance with the GDPR. The role can be filled internally or contracted externally.

EU regulation on digital operational resilience in the financial sector, applicable since January 2025. It covers ICT risk management, incident reporting, resilience testing and the management of ICT third-party service providers.

Record of all contractual arrangements between a financial entity and ICT third-party service providers. It is kept in a prescribed format and submitted to the supervisory authority.

Evidence that a measure not only exists but achieves its objective, for example through key figures, samples or tests.

Preparing for and responding to serious disruptions, with alerting, a crisis team and recovery plans. Part of business continuity management.

EU regulation on artificial intelligence. It classifies AI systems by risk and attaches tiered obligations for providers and deployers.

Proof that a control has been implemented, such as a document, screenshot, record or export. Good evidence has a version and an expiry date.

Result of an audit for a requirement: conformity, nonconformity, observation or opportunity for improvement. Findings are documented in the audit report.

Shared attitudes and behaviours in a business that support food safety in day-to-day work. EU food hygiene law requires businesses to promote it and provide evidence of it.

Umbrella term for standards, laws and criteria catalogues that a company aligns itself with, such as ISO 27001, NIS2 or SOC 2.

Comparison of the current state with the requirements of a framework. It shows where improvements are needed and is usually the first step in a project.

EU regulation on the protection of personal data. Among other things, it requires a legal basis, transparency, data subject rights, technical and organisational measures and accountability.

The interplay of corporate governance, risk management and compliance with laws, standards and internal rules. GRC software, often called a GRC tool, brings these tasks together in one place: requirements, risks, measures, evidence and audits. Sightadel is a GRC platform for ISO 27001, ISO 9001, NIS2, DORA and other frameworks.

System for hazard analysis in food production and processing. Food businesses in the EU are required to work according to it.

AI systems that the EU AI Act regulates particularly strictly because of their possible impact on health, safety or fundamental rights, for example in recruitment, lending or critical infrastructure. Risk management, data quality, documentation and human oversight apply to them.

International association of accreditation bodies. Through its mutual recognition, certificates from accredited bodies are also valid in other member countries.

Framework of strategies, policies and tools with which a financial entity identifies, protects against, monitors and remedies risks arising from information and communication technology. Core chapter of DORA.

Under DORA, any service provider that supplies digital or data services to a financial entity, such as cloud, software or data centre services. Specific requirements apply to contracts, monitoring and exit strategies.

Self-assessment of the management system by independent people from within the company or by external contractors. For ISO certification, at least one internal audit per cycle is mandatory.

International standard for assurance engagements that do not concern financial information. C5 attestations and examinations of service providers' internal controls, for example, are based on it.

The rules, processes, roles and measures with which a company plans, implements, monitors and improves information security. ISO 27001 sets out the requirements.

International standard for quality management systems. It requires customer-focused, controlled processes and continual improvement.

Standard setting out requirements for bodies that audit and certify management systems. Among other things, it prohibits a certification body from advising the same organisation.

International standard for information security management systems. It is certifiable and is regarded in Europe as the most important evidence of information security.

International standard for management systems for artificial intelligence. It helps organisations develop and use AI responsibly and is certifiable.

German term for facilities whose failure would have significant consequences for the public, for example in energy, water, health or finance. In Germany, their operators are subject to stricter security and evidence obligations.

Under NIS2 and DORA, management is liable for ensuring that risk measures are implemented and monitored. It must undergo regular training for this.

Regular review of the management system by top management based on key figures, audit results and risks. It ends with decisions on resources and improvements.

Sign-in with at least two independent factors, such as a password and a one-time code. NIS2 names it explicitly as a measure, and many control catalogues require it for administrators.

EU directive for a high common level of cybersecurity. It significantly widens the range of companies affected and requires risk measures, incident reporting and management accountability.

Significant security incidents must be reported in stages: an early warning within 24 hours, an incident notification with an initial assessment within 72 hours and a final report no later than one month afterwards.

Framework of the US National Institute of Standards and Technology. Version 2.0 organises cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

A requirement that is not met. In a certification audit, a distinction is made between major and minor nonconformities; major nonconformities must be resolved before the certificate is issued.

Targeted, authorised attempt to attack systems in order to find vulnerabilities. Many frameworks expect regular tests and the remediation of the results.

Incident in which personal data is lost, disclosed or altered. As a rule, it must be reported to the supervisory authority within 72 hours.

Binding internal rule, for example on password use or backups. Policies are approved by management, communicated and reviewed regularly.

Action that prevents a potential nonconformity before it occurs. In current ISO standards, the idea has been absorbed into risk-based thinking.

Where a service provider processes personal data on behalf of a company, Art. 28 GDPR requires a contract with defined obligations. Among other things, it governs instructions, sub-processors and technical safeguards.

Assessment of how strongly the confidentiality, integrity and availability of a piece of information or a system need to be protected. Appropriate measures are derived from it.

Management system that aligns processes with consistent quality and customer satisfaction. The best-known basis is ISO 9001.

Audit at the end of a certificate's three-year validity. It re-examines the entire management system and starts a new cycle.

Overview of all processing of personal data, with purpose, categories, recipients, retention periods and safeguards. The GDPR requires it of almost all companies.

Deliberate decision by those responsible to bear a residual risk. It must be documented and justified.

Identification, analysis and evaluation of risks by likelihood and impact. It determines which measures are needed.

Decision on how to deal with an assessed risk: avoid, reduce, transfer or accept. The risk treatment plan with its measures follows from this.

Definition of which sites, processes, systems and organisational units a management system covers. A scope that is too narrow weakens the value of the certificate.

Provision of the German Social Code, Book V, on IT security in statutory health insurance medical and dental care, formerly § 75b. A guideline sets out which requirements practices must meet depending on their size.

Training and measures that make employees aware of security risks. Almost every framework requires it regularly and with evidence.

Event that impairs or could impair the confidentiality, integrity or availability of information. Incidents are recorded, assessed, handled and reviewed.

Key figure that summarises the implementation status of controls across all frameworks. It shows at a glance where a company stands and where it is heading.

Examination report under US standards on a service provider's controls, prepared by an independent auditor (certified public accountant). Type I looks at a point in time, Type II at a period.

First part of the certification audit. The auditor reviews documentation, scope and readiness before the actual implementation is examined.

Second part of the certification audit. The auditor checks on site or remotely whether the management system is effectively implemented in day-to-day operations.

Central document of an ISMS under ISO 27001. It lists all Annex A controls, justifies their inclusion or exclusion and states their implementation status.

Annual audit between initial certification and recertification. It examines parts of the management system and whether it remains effective.

Prepared draft for policies, processes or answers that is adapted to your own company. A template only makes sense if it is genuinely adapted and not simply adopted as is.

Assessment and exchange mechanism for information security in the automotive industry. It is based on an industry-specific questionnaire.

Threat-led penetration test under DORA that imitates real attackers and includes production systems. Selected financial entities must carry it out regularly.

Safeguards under the GDPR, such as encryption, access control or training. They must be appropriate to the risk and are usually documented in an overview.

Public or protected page on which a company shows customers its security and compliance evidence. This answers many questionnaires before they are sent.

Criteria on which SOC 2 reports are based: security, availability, processing integrity, confidentiality and privacy. Security is always mandatory; the others are chosen.

Risk arising from service providers and suppliers, for example through outages or data leakage. It is managed through assessments, questionnaires and contracts.

Ongoing process of identifying, assessing and remediating vulnerabilities in systems within set deadlines. A core topic of NIS2, DORA and ISO 27001.