Key compliance terms,
explained in simple terms

The first control in Annex A of ISO/IEC 27001:2022. It requires information security policies to be defined, approved by management, published, communicated and reviewed at planned intervals.

The fourth and largest group of controls in Annex A of ISO/IEC 27001:2022, with 34 technological controls. It ranges from access control and protection against malware through logging to secure development.

Annex III of the AI Act lists the use cases in which an AI system counts as high-risk. It covers eight areas, from biometrics to the administration of justice, and is one of the two routes to a high-risk classification alongside Annex I.

Altering personal data so that it can no longer be attributed to a person, or only with disproportionate effort. Anonymous data is no longer personal data and the GDPR does not apply to it.

The GDPR provision governing the relationship between controller and processor. It requires careful selection, prescribes a contract with fixed minimum content and determines when a service provider becomes a controller in its own right.

The GDPR provision requiring controllers and processors to maintain a record of their processing activities. The record must be made available to the supervisory authority on request and is the single most important piece of accountability evidence.

The GDPR provision requiring controllers and processors to establish a level of protection for personal data appropriate to the risk. It gives criteria and examples, but no binding list of measures.

The GDPR provision requiring the controller to notify a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours. The exception: the breach is unlikely to result in a risk to the data subjects.

The GDPR provision requiring a data protection impact assessment where processing is likely to result in a high risk to the rights and freedoms of natural persons. It has to be carried out before the processing begins.

The GDPR provision setting out exhaustively when processing of personal data is lawful. Without one of the six lawful bases in paragraph 1, any processing is unlawful, however well it is secured technically.

The management process by which an organisation identifies its time-critical business processes and makes sure they can be continued or restored within defined timeframes when disruption occurs.

The BSI 200 series is the methodological framework for IT-Grundschutz published by the German Federal Office for Information Security. It describes how an information security management system is built, implemented and extended with risk analysis and business continuity management.

CAPA stands for a system of corrective and preventive action. Corrective action removes the cause of a nonconformity that has occurred; preventive action removes the cause of a potential one that has not yet occurred.

A leadership role with overall responsibility for an organisation's information security. Unlike the information security officer, who coordinates operationally, the CISO sits at a strategic level and is usually part of the management team.

A voluntary framework under Article 56 of the AI Act, facilitated by the European Commission and the AI Office. Providers of general purpose AI models can use it to demonstrate that they meet their obligations.

Continual improvement is the systematic, ongoing improvement of processes, products and management systems in small steps. It is a requirement in every ISO management system standard.

The Cyber Resilience Act is Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. It obliges manufacturers, importers and distributors to develop connected hardware and software securely, handle vulnerabilities across the lifecycle and supply security updates before the products are placed on the EU market.

DORA is Regulation (EU) 2022/2554 on digital operational resilience in the financial sector. It obliges financial entities to manage ICT risk, report incidents, test their resilience and oversee third-party providers.

A contract under Art. 28(3) GDPR between a controller and a service provider that processes personal data on its instructions. It sets out the subject matter, duration, nature and purpose of the processing and binds the processor to confidentiality and to technical and organisational measures.

A structured risk assessment under Art. 35 GDPR. It is required where processing is likely to result in a high risk to the rights and freedoms of data subjects, and it is carried out and documented before the processing starts.

The person who monitors and advises on compliance with data protection law inside an organisation. Appointment is mandatory in certain cases under Art. 37 GDPR and, in Germany, additionally under Section 38 of the Federal Data Protection Act. The role is free from instructions and may not be penalised for performing it.

A request by a data subject for access to the personal data processed about them under Art. 15 GDPR. The controller has to respond within one month, free of charge and whatever form the request arrived in.

The body of independent federal and state data protection supervisory authorities in Germany. It publishes resolutions, orientation guidance and short papers that shape how the authorities apply the law.

ENISA is the European Union's agency for cybersecurity. It supports member states, EU institutions and companies in implementing European cybersecurity law and produces guidance, threat reports and certification schemes.

An essential entity is an organisation regulated under the German NIS2 implementation act that operates in a sector listed in Annex 1 and has at least 250 employees, or an annual turnover above 50 million euros combined with a balance sheet total above 43 million euros.

The FRIA is the fundamental rights impact assessment under Article 27 of the AI Act. Certain deployers of high-risk AI systems have to assess, before first use, what effect the deployment may have on the fundamental rights of the people affected.

GPAI means general purpose AI models: models that display significant generality and are capable of performing a wide range of distinct tasks, regardless of how they are later embedded into applications.

A high-risk AI system is an AI system classified as high-risk under Article 6 of the AI Act, either because it serves as a safety component of a regulated product under Annex I or because it falls into one of the areas listed in Annex III.

IAM covers the processes and systems used to manage digital identities across their lifecycle and to control their access rights to applications and data.

An important entity is an organisation regulated under the German NIS2 implementation act, operating in a sector listed in Annex 1 or Annex 2, with at least 50 employees or an annual turnover and balance sheet total each above 10 million euros, and not qualifying as an essential entity.

An international standard containing implementation guidance for information security controls. It explains the controls that ISO/IEC 27001 only names in Annex A, and is not itself certifiable.

An international standard containing guidance on managing information security risk. It fleshes out the risk approach that ISO/IEC 27001 requires in clause 6.1, without prescribing any particular method.

An international standard containing additional information security controls for cloud services. It extends ISO/IEC 27002 with guidance addressed both to cloud providers and to their customers.

An international standard containing guidance on protecting personal data in public cloud services. It addresses cloud providers acting as processors and extends the controls of ISO/IEC 27002.

An international standard that extends ISO/IEC 27001 and 27002 with requirements for protecting personal data. It turns an information security management system into one that covers privacy as well.

An IT-Grundschutz module is the smallest unit of content in the IT-Grundschutz Compendium published by the German Federal Office for Information Security. Each module describes the typical threat situation for a given target object and the security requirements that follow from it.

KRITIS stands for critical infrastructures: facilities and installations whose failure would cause significant supply shortages or endanger public safety. In Germany the term is defined in law by the Act on the Federal Office for Information Security and its accompanying ordinance.

Least privilege holds that every person, account and process should receive exactly the permissions required for the task at hand, and only for as long as they are needed.

The management review is the regular assessment of a management system by top management. It examines whether the system remains suitable, adequate and effective, and decides on the changes needed.

MFA is a sign-in method in which a person's identity is proven through at least two independent factors from different categories: knowledge, possession and inherence.

The NIS2 sectors are the areas of the economy whose entities fall within the scope of the NIS2 Directive and the German implementation act. They are listed in Annex 1 (sectors of high criticality) and Annex 2 (other critical sectors).

A nonconformity is the non-fulfilment of a requirement. In the context of management systems it covers any departure from the requirements of a standard, from legal obligations, or from what the organisation itself has laid down.

PAM is the separate administration, protection and monitoring of privileged accounts, that is, accounts holding far-reaching rights over systems, applications or data.

Processing personal data in such a way that it can no longer be attributed to a person without additional information. That additional information is kept separately and protected. Pseudonymised data remains personal data and stays subject to the GDPR.

RBAC is a permission model in which access rights are assigned to roles rather than to individual people. A person receives rights solely by being assigned a role.

Documentation of all processing of personal data in an organisation, maintained under Art. 30 GDPR. For each activity it records the purpose, types of data, categories of data subjects, recipients, erasure periods and protective measures, and it is the central piece of accountability evidence.

A document recording, for each of the controls in Annex A of ISO/IEC 27001, whether it applies, how it is implemented and why it was excluded if it was. The standard requires it in clause 6.1.3 d.

STRIDE is a model for categorising threats in threat modelling. The acronym stands for six kinds of threat: spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.

Transferring personal data to a recipient outside the European Economic Area, or making it accessible from there. Such a transfer is lawful only where one of the grounds in Chapter V of the GDPR applies.

Threat intelligence is the systematic collection, analysis and presentation of information about current threats, attacker groups and their methods, in order to draw conclusions for an organisation's own security posture.

Threat modeling is a structured method for working out, already at the design stage of a system, which threats exist, what impact they would have and which countermeasures are needed.

A case-by-case assessment of whether the agreed safeguards for a third country transfer can in fact be complied with in the destination country. It became mandatory through the Schrems II judgment and complements the standard contractual clauses without replacing them.

The TISAX assessment level (AL1, AL2, AL3) sets the depth of a TISAX assessment. It follows the protection needs of the information being processed and determines whether there is a self-assessment, a review with evidence, or an on-site audit.

The umbrella term for the protective measures a controller puts in place under Art. 32 GDPR to secure personal data appropriately. Technical refers to systems and procedures, organisational to rules, roles and processes.

Zero trust is a security model that grants no user, device or network segment trust on the basis of its position in the network. Every access to a resource is authenticated and authorised individually, whether the request comes from the internal network or from the internet. The term denotes an architectural principle, not a requirement from any standard.