Your glossary for risk and compliance
Helpful definitions of all of the terms you need to know to better manage risk and compliance.
Trusted by the world’s leading organisations



















Terms
AFSL Authorised Representative AICPA Annex A Controls ASIC Attestation of Compliance (AOC) Business Continuity Management Compliance Automation Software Compliance Risk Management Cybersecurity Maturity Model Certification (CMMC) FedRAMP Governance Risk & Compliance (GRC) GPDR HIPAA HITRUST Incident Management Information Security Management System (ISMS) ISMS Governing Body ISO 27001 Notifiable Data Breach OAIC Policy Management SOC 1 SOC 2 SOC 3 SOC Reports SOC Trust Services Criteria (TSC) SSAE 16 SSAE 18 Third Party Risk Management Vendor Assessment Vendor Management Policy Vendor Review Vulnerability Vulnerability Management
What is SOC 2?
Developed by the American Institute of CPAs (AICPA), SOC 2 defines criteria for managing customer data based on five "trust service criteria" — security, availability, processing integrity, confidentiality and privacy.
SOC 2 reports are unique to each organization. In line with specific business practices, each designs its own controls to comply with one or more of the trust principles. These internal reports provide you (along with regulators, business partners, suppliers, etc.) with important information about how your service provider manages data.
There are two types of SOC reports:
- Type I describes a vendor's systems and whether their design is suitable to meet relevant trust principles as of a specified date
- Type II details the operational effectiveness of those systems throughout a specified period.
You may want to pursue a SOC 2 report if you handle customer data and/or you work with larger enterprises who will want to ensure that you are a secure vendor.