Compliance and information security glossary
Plain-language definitions of the standards, controls and risk terms that come up in ISO 27001, NIS2, DORA, GDPR and EU AI Act work.
A
Access Control
Access control is the security control that defines and enforces which signed-in identity may read, change or delete which data. § 30(2) sentence 2 no. 9 of the German BSI Act requires concepts for it, and ISO/IEC 27001:2022 covers it in Annex A 5.15 to 5.18. It starts after sign-in, unlike system access control.
ISO 27002AI labeling obligation
The AI labeling obligation is a transparency obligation under Article 50 of the AI Act, Regulation (EU) 2024/1689, making AI interactions and AI-generated content recognizable. It has applied since August 2, 2026. For generative systems placed on the market earlier, providers have until December 2, 2026 to implement machine-readable marking.
EU AI ActAnnex A (ISO/IEC 27001)
Annex A of ISO/IEC 27001:2022 is a normative reference set of 93 information security controls against which an organisation cross-checks its risk treatment. The controls fall into four themes: 37 organisational, 8 people, 14 physical and 34 technological. It is not an implementation list; the outcome is recorded in the Statement of Applicability.
ISO 27001Asset Inventory
An asset inventory is the maintained register of all assets relevant to an organisation's information security, recording each entry's owner, protection need and dependencies. ISO/IEC 27001:2022 lists it in Annex A as control 5.9, and Article 8(6) DORA requires financial entities to maintain it. Unlike a CMDB, it also records information and business processes.
ISMSB
Backup and Recovery
Backup and recovery are a security control in two steps: backup creates copies of data and systems, and recovery returns them to operation. § 30(2) sentence 2 no. 3 of the BSI Act (BSIG) names both, and Article 12(2) DORA requires regular testing. The control is only evidenced by a documented restore test.
RisikomanagementBackup Strategy
A backup strategy is the set of rules defining which data is backed up, how often, where and for how long, and how restoration works. For essential and important entities, § 30(2) no. 3 BSIG requires backup management and recovery after an emergency. Only restore tests show that it works.
ISMSBSI C5
BSI C5 is a criteria catalogue from Germany's Federal Office for Information Security (BSI) that sets minimum information security requirements for cloud services. C5:2026 (Cloud Computing Compliance Criteria Catalogue) contains 168 criteria in 17 subject areas. Conformity is not certified but shown by an audit firm's attestation under ISAE 3000, which covers individual cloud services.
ISMSBusiness Continuity Management (BCM)
Business continuity management (BCM) is the management process by which an organisation makes sure that time-critical business processes survive an interruption. For entities under the German BSI Act, § 30(2) no. 3 BSIG requires maintaining operations. BCM determines which processes have to be available again and how quickly, and proves the effectiveness of its plans in exercises.
ISMSBusiness Impact Analysis (BIA)
A business impact analysis (BIA) is a structured examination that identifies time-critical business processes and the resources that support them. It assesses the damage of an outage over time and derives metrics such as the maximum tolerable period of disruption; for financial entities, Article 11(5) DORA requires it. The causes of an outage are examined by the risk analysis.
RisikomanagementC
Certification Body (CB)
A certification body is an independent organisation that assesses whether a management system meets a standard and certifies the result. To issue an accredited ISO/IEC 27001 certificate it needs an accreditation of its own; it audits in two stages and maintains oversight of the certificate across its term.
ISO 27001Change Management
Change management in IT is the process by which changes to systems, applications and configurations are requested, assessed, approved, tested and documented. For financial entities, Article 9(4)(e) DORA requires it; the German IT-Grundschutz covers it in module OPS.1.1.3. It is distinct from organisational change management.
ISMSCloud Security
Cloud security covers every measure protecting data and applications in environments someone else operates. Its defining feature is shared responsibility: the provider secures the platform, while the customer owns configuration, identities, permissions and data. Outsourcing the operation does not move accountability to the provider.
ISMSCMDB
A CMDB (configuration management database) is the database in which IT operations keeps its configuration items and the relationships between them. It comes from ITIL configuration management and supports incident and change analysis. It does not replace an ISMS asset inventory, nor the other way around.
ISMSCompliance
Compliance (regulatory compliance) is the organised and demonstrable observance of all laws, contracts, standards and internal rules that apply to a company. In German law it rests on § 130 OWiG, which requires the owner to take the necessary supervisory measures. A compliance management system is the organisation a company uses to steer this observance.
GRCCompliance Management System (CMS)
A compliance management system (CMS) is the set of rules, responsibilities and controls with which a company ensures and evidences that it meets its obligations. Under a German Federal Court of Justice judgment of 9 May 2017 (1 StR 265/16), efficient compliance management affects the fine under § 30 OWiG. It is audited under IDW PS 980 or certified against ISO 37301.
GRCCompliance Risk
A compliance risk is the possibility that an organisation breaches a binding obligation and suffers sanctions, liability or reputational damage as a result. In Germany, § 130 and § 30 OWiG attach a fine against the company to a failure to supervise. Unlike an operational risk, it arises from a binding rule, not from an operating event.
RisikomanagementConcentration Risk
Concentration risk is the risk from dependencies bundled onto a few providers, technologies, sites or people, so that one failure hits several processes at once. Article 29 DORA requires a preliminary assessment of ICT concentration risk before contracts for critical or important functions. German banking supervision (MaRisk) speaks of risk concentrations.
RisikomanagementCritical Infrastructure (KRITIS)
Critical infrastructure (KRITIS) means installations that provide a supply service whose failure would cause serious supply shortfalls or endanger public safety. Since 17 March 2026, § 2 No. 3 KRITISDachG has defined the critical installation, and § 4(1) names ten sectors. Under the BSI Act, their operators also count as essential entities.
NIS2Cryptography Policy
A cryptography policy is a written rule that defines where an organisation uses cryptography, which methods it approves and how it manages keys. For entities under the German BSI Act it is one of the minimum measures of § 30(2) BSIG (no. 8). It sits above any individual piece of encryption and governs keys across their entire life cycle.
ISMSCSDDD
The CSDDD (Directive (EU) 2024/1760) is the EU directive on human rights and environmental due diligence for very large companies. As amended in 2026, it applies from July 26, 2029 mainly to companies with over EUR 1.5 billion net turnover and, if EU-based, over 5,000 employees. For third-country companies, only turnover in the Union counts.
GRCCyber Resilience Act (CRA)
The Cyber Resilience Act is Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements. It obliges manufacturers to design hardware and software securely across the lifecycle, handle vulnerabilities and demonstrate conformity; importers and distributors have their own checking duties (Articles 19, 20).
Cyber Resilience ActCyber Threat Information Sharing
Cyber threat information sharing is the voluntary exchange of threat knowledge between financial entities that Article 45 of DORA permits on three conditions. Under paragraph 1 it includes indicators of compromise, tactics, techniques and procedures, cyber security alerts and configuration tools. The only duty attached is to notify the competent authority of participation.
DORAD
Data governance
Data governance is the framework of roles, rules and controls that defines who decides about which data and how it is used, protected and deleted. Legally, the outcome is required through the accountability principle in Article 5(2) GDPR. The Data Act, Regulation (EU) 2023/2854, has also applied since September 12, 2025.
GRCData Minimisation
Data minimisation is the data protection principle of processing personal data only to the extent the specified purpose requires. Article 5(1)(c) GDPR requires personal data to be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". The German term Datensparsamkeit means the same but does not appear in the Regulation.
DSGVOData Protection Officer (DPO)
The data protection officer (DPO) monitors data protection compliance, advises the controller and is the contact point for the supervisory authority and for data subjects. In Germany, § 38 BDSG requires a designation where, as a rule, at least 20 persons are permanently engaged in the automated processing of personal data.
GRCData Residency
Data residency is the geographic place where data is stored and processed, set through the choice of region and contractual location commitments. It answers only the question of storage location; where data is accessed from and which law the provider is subject to need separate checks. Data localisation, by contrast, is a requirement, and data sovereignty a legal question.
ISMSData Subject Rights
Data subject rights are the claims the GDPR gives a natural person against the controller that processes their personal data. Articles 15 to 22 GDPR set them out, from access, rectification and erasure through to objection. The controller must respond at the latest one month after receiving the request (Article 12(3)).
DSGVODigital Operational Resilience
Digital operational resilience is a financial entity's ability to keep delivering its services during IT disruption and to prove that it can. DORA defines it in Article 3(1) as the ability to build, assure and review operational integrity and reliability, including through ICT third-party service providers.
DORAE
Email Security
Email security is the set of measures that protect email communication against misuse of your own domain, eavesdropping and harmful messages. For sender authentication with SPF, DKIM and DMARC, BSI TR-03182 sets testable requirements; BSI TR-03108 covers transport. The DNS records used for sender authentication are public and can therefore be checked from outside.
ISMSEncryption
Encryption is a cryptographic method that transforms data with a key so that only holders of the matching key can read it. Article 32(1)(a) GDPR names it as a measure for the security of processing; § 30(2) no. 8 BSIG requires concepts for cryptographic methods. Its protective effect depends on how the keys are managed.
ISMSEndpoint Detection and Response (EDR)
Endpoint detection and response (EDR) is a security tool that records activity on endpoints and servers, flags anomalies and can isolate affected systems. EDR is not mandated; § 30(2) sentence 2 no. 2 BSIG requires the handling of security incidents. Unlike antivirus, which checks files for known malware, EDR records how an incident unfolded.
ISMSEU AI Act
The EU AI Act is Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. It regulates AI systems according to their risk: certain practices are prohibited under Article 5, high-risk systems must meet the requirements of Chapter III, and further systems carry transparency obligations under Article 50.
EU AI ActEvidence (Audit Evidence)
Audit evidence is verifiable information that shows a requirement is met or a control is effective, such as a record or a system export. ISO/IEC 27001 treats documents and records together in clause 7.5 as documented information. Evidence holds only while the state it describes holds, and only with a source, a date and a period of validity.
ISMSF
Federal Data Protection Act (BDSG)
The Federal Data Protection Act (BDSG) is the German federal statute that supplements the GDPR (Regulation (EU) 2016/679) and fills its opening clauses. For companies it mainly governs the data protection officer (§ 38), restrictions of data subject rights (§§ 32 to 37) and, from November 20, 2026, scoring (§ 37a).
DSGVOFinancial Entity (DORA)
Financial entity is DORA's collective term for the 20 types of undertaking listed in Article 2(1), points (a) to (t). It runs from credit institutions through investment firms and insurers to securitisation repositories. ICT third-party service providers (point (u)) fall within the Regulation's scope but, under Article 2(2), are not financial entities.
DORAI
Information security
Information security is the appropriate protection of the confidentiality, integrity and availability of information on paper, in IT systems or in people's heads. § 2 no. 17 of the German BSI Act (BSIG) defines the term in law. According to BSI Standard 200-1, IT security is a subset of it, limited to electronically stored information.
ISMSInformation Security Objectives
Information security objectives are the intentions an organisation sets for what its ISMS is to achieve. ISO/IEC 27001:2022 requires them in clause 6.2 at the relevant functions and levels, derived from the policy and with planning of who achieves what by when. They are distinct from metrics and measures.
ISMSInformation Security Policy
The information security policy is the top-level document of the security organisation. Top management puts it into force, and it sets out the objectives, scope, principles, roles and binding force of information security. Detailed rules belong in the topic-specific policies below it, not in the policy itself.
ISMSInternal Audit
An internal audit is an organisation's planned check of whether its management system meets its own rules and the standard and is effectively implemented. ISO/IEC 27001:2022 requires it in clause 9.2 at planned intervals. The organisation itself is responsible for it, not the certification body.
ISO 27001ISMS (Information Security Management System)
An ISMS (information security management system) is the framework of policy, roles, risk method and measures through which an organisation steers and evidences information security. Its requirements are set out in ISO/IEC 27001, against which an ISMS can be certified. Unlike IT security, it covers information in every form, including on paper.
ISMSISO/IEC 27001 (ISO 27001)
ISO/IEC 27001 is the international standard for information security management systems (ISMS). Clauses 4 to 10 set out the binding requirements for establishing, operating, monitoring and improving an ISMS; Annex A adds 93 reference controls. Unlike ISO/IEC 27002, ISO/IEC 27001 is certifiable.
ISO 27001ISO/IEC 27002 (ISO 27002)
ISO/IEC 27002 (Information security controls) is the international standard that explains the 93 Annex A controls of ISO/IEC 27001 with purpose and implementation guidance. The 2022 edition groups them into four themes: 37 organisational, 8 people, 14 physical and 34 technological controls. Unlike ISO/IEC 27001, it is not certifiable.
ISO 27002ISO/IEC 42001 (ISO 42001)
ISO/IEC 42001:2023 is the international standard for artificial intelligence management systems. It sets requirements for establishing, operating, monitoring and improving an AI management system and addresses any organisation that offers or uses AI systems. As a management system standard it is an organisational framework, not a route to conformity with a regulation.
GRCIT security
IT security is the protection of IT systems, applications and networks and the information processed in them against loss of confidentiality, integrity and availability. Germany's BSI Act calls it “security in information technology” (§ 2 no. 39 BSIG). According to BSI Standard 200-1, it is a subset of information security.
ISMSIT security management
IT security management is the planning, steering and control task through which an organization establishes, reviews and improves information security on an ongoing basis. The German BSI calls it (information) security management and describes it in BSI Standard 200-1 and module ISMS.1; it is carried out through an ISMS. Management bears overall responsibility.
ISMSK
Key risk indicator (KRI)
A key risk indicator (KRI) is a metric that signals early that a specific risk is rising, before damage occurs. It belongs to a named risk and has thresholds derived from the risk appetite. DORA requires financial entities in Article 6(8)(c) to set key risk metrics as part of their information security objectives.
RisikomanagementKRITIS-Dachgesetz (KRITISDachG)
The KRITIS-Dachgesetz (KRITISDachG) is the German federal act that governs the physical resilience of critical installations and transposes Directive (EU) 2022/2557. It has been in force since 17 March 2026; operators' duties start in stages after an installation is registered. Security in information technology is governed alongside it by the BSI Act.
NIS2L
Least Privilege (PoLP)
Least privilege is a security principle under which every identity receives only the rights its task requires, and only for as long as needed. The BSI requires it as a basic requirement in module ORP.4, and § 30(2) no. 9 BSIG requires a concept for access control. Unlike need-to-know, it limits not which information someone sees but what they may do with it.
ISO 27002Logging and Monitoring
Logging and monitoring are the security controls that record security-relevant events in systems and applications and evaluate those records for anomalies. ISO/IEC 27001 lists them in Annex A as controls 8.15 and 8.16. Because logs can contain personal data, purpose, access and deletion have to be set as carefully as the capture itself.
ISMSM
Management Review
The management review is the regular evaluation of the management system by top management. ISO/IEC 27001 requires it in clause 9.3 at planned intervals: on the basis of defined inputs, management checks whether the ISMS still serves its purpose. The outcome is not a set of minutes but a documented decision.
ISO 27001Management System
A management system is the framework of policy, objectives, roles, processes and evidence with which an organisation steers and improves a subject deliberately. The harmonised structure under Annex SL gives ISO/IEC 27001, ISO 22301 and ISO 37301 the same clauses 4 to 10. The ISMS is the management system for information security.
GRCMaRisk
MaRisk (Mindestanforderungen an das Risikomanagement) is a BaFin circular that specifies the risk management duty under § 25a(1) KWG for credit and financial services institutions. Since June 30, 2026, Circular 06/2026 (BA), the ninth MaRisk amendment, has applied. Significant institutions under direct ECB supervision have been excluded since then.
DORAMulti-Factor Authentication (MFA)
Multi-factor authentication (MFA) is a sign-in method that requires at least two pieces of proof from different categories: knowledge, possession or inherence. For essential and important entities in Germany, § 30(2) sentence 2 no. 10 BSIG makes it a minimum measure, as an alternative to continuous authentication. Two knowledge factors, such as a password and a security question, are not MFA.
ISMSN
NIS-2-Umsetzungsgesetz (German NIS2 Implementation Act)
The NIS-2-Umsetzungsgesetz is the German act that transposes Directive (EU) 2022/2555 by recasting the BSI Act (BSIG). It has applied since 6 December 2025 and obliges essential and important entities to manage cyber risk, report significant security incidents and register with the BSI.
NIS2Nonconformity (NC)
A nonconformity is an audit finding that evidences that an applicable requirement is not met. Audits distinguish major and minor nonconformities; under the BSI auditing scheme, a serious nonconformity rules out issuing or maintaining a certificate. Recommendations, which are not binding, are a separate category.
ISO 27001P
PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) is the payment card industry's security standard for every organization that stores, processes or transmits card data. It is published by the PCI Security Standards Council; since December 31, 2024, version 4.0.1 is the only active version. It becomes binding through the compliance programs of payment brands and acquirers, not by law.
GRCPenetration Testing (Pentest)
A penetration test is a commissioned, bounded security examination in which specialists use attacker methods to try to break into a target system. Unlike an automated scan, it shows whether a vulnerability is exploitable in the specific environment. Article 26 of DORA requires identified financial entities to carry out threat-led penetration testing at least every three years.
ISMSPersonal Data Breach
A personal data breach is a breach of security that leads to personal data being destroyed, lost, altered, disclosed without authorisation or accessed without authorisation. Under Article 33 GDPR, the controller notifies the supervisory authority without undue delay, where feasible within 72 hours, unless the breach is unlikely to result in a risk. The legal definition is in Article 4(12) GDPR.
DSGVOPhishing Simulation
A phishing simulation is a controlled campaign, run by the organisation itself, in which employees receive messages modelled on genuine phishing attempts. For entities under the German BSI Act it is an awareness measure under § 30(2) no. 7 BSIG. It trains staff to recognise and, above all, report suspicious messages.
ISMSPolicy and Procedure
A policy is a binding governing document that sets out what applies and who is responsible; a procedure describes how a workflow runs. Both sit below the top-level policy issued by management and above work instructions, and both fall under document control in clause 7.5 of ISO/IEC 27001.
GRCPseudonymisation
Pseudonymisation, under Article 4(5) GDPR, is processing after which personal data can no longer be attributed to a person without additional information kept separately. For whoever holds that additional information, the data remain personal data. Anonymised data can no longer be attributed to anyone and fall outside the GDPR.
DSGVOR
Residual Risk
Residual risk is the risk that remains once the agreed controls have been implemented. Under BSI-Standard 200-3 it is put to management for approval; this risk acceptance records that the organisation is aware of the residual risk. It differs from inherent risk, with no controls, and from current risk, with the controls effective today.
RisikomanagementRisk Analysis
Risk analysis is the step in risk management that estimates identified risks by likelihood and impact. Whether a risk is acceptable is decided by the risk evaluation that follows. BSI Standard 200-3, by contrast, uses risk analysis for the whole process up to and including risk treatment.
RisikomanagementRisk matrix
A risk matrix is a table that rates risks by likelihood and impact and assigns each cell a risk level. BSI Standard 200-3 recommends no more than five categories per axis and leaves the number of levels and their criteria open. Unlike the Nohl matrix from occupational safety, it rates damage to information and processes.
RisikomanagementRisk Owner
The risk owner is the named person who is accountable for a particular risk and decides on its treatment. ISO/IEC 27001 requires a risk owner to be determined for every identified risk in clause 6.1.2. The role needs decision and budget authority, so for business risks it sits in the business function, not with the information security officer.
GRCS
Security Metrics and KPIs (KPI)
Security metrics are measurements that show the state and effectiveness of information security in a form a decision can be based on. ISO/IEC 27001 makes measurement and evaluation mandatory in clause 9.1; the organisation decides which metrics to use. A KPI measures whether an objective is met, while a KRI signals rising risk early.
ISMSSoftware Bill of Materials (SBOM)
An SBOM (software bill of materials) is a machine-readable list of every component in a piece of software, with supplier, version and dependencies. The Cyber Resilience Act, Regulation (EU) 2024/2847, requires manufacturers from December 11, 2027 to draw up an SBOM for their products that covers at least the top-level dependencies.
Cyber Resilience ActSupply Chain Security
Supply chain security is the risk-management measure through which an entity governs the security risks arising from its relationships with suppliers and service providers. § 30(2) sentence 2 no. 4 BSIG requires the security of the supply chain, including the security-related aspects of relationships with direct suppliers or service providers.
NIS2