Glossary
GRC glossary
The terms of governance, risk and compliance, in plain words.
- Annex A
- The list of 93 reference controls in ISO/IEC 27001:2022, grouped in organisational, people, physical and technological themes. Learn more
- Business impact analysis (BIA)
- A study of what happens when an activity stops: it sets recovery priorities and the times to recover. Learn more
- Control
- A measure that reduces a risk, such as multi-factor authentication, a backup routine or a review process. Learn more
- Corrective action
- An action that removes the cause of a nonconformity so that it does not happen again. Learn more
- Data controller
- Under the GDPR, the party that decides why and how personal data is processed. Learn more
- Data processor
- Under the GDPR, the party that processes personal data on behalf of a controller. Learn more
- DPIA
- Data protection impact assessment: the GDPR assessment required before processing that is likely to create a high risk for people. Learn more
- EBIOS Risk Manager
- A risk analysis method published by ANSSI, the French cybersecurity agency, built around workshops and attack scenarios.
- Essential and important entities
- The two categories of companies covered by the NIS2 Directive, according to their sector and size. Learn more
- Evidence
- A record showing that a control works: a log, a report, a signed review or a screenshot. Learn more
- Gap assessment
- A comparison between current practices and what a standard or law requires, which shows what is missing. Learn more
- GRC
- Governance, risk and compliance: how a company steers itself, manages its risks and meets its obligations. Learn more
- ICT third-party risk
- Under DORA, the risk that comes from the technology suppliers a financial entity relies on. Learn more
- Internal audit
- A planned, independent check of whether a management system meets its own rules and the standard. Learn more
- ISMS
- Information security management system: the policies, processes and controls a company uses to manage information security, as defined by ISO/IEC 27001. Learn more
- Nonconformity
- A requirement that is not met, found during an audit or a review. Learn more
- RACI matrix
- A table showing who is Responsible, Accountable, Consulted and Informed for each activity.
- Record of processing activities
- The register of personal data processing that the GDPR requires (Article 30). Learn more
- Residual risk
- The risk that remains after treatment. Accepting it is the decision of the risk owner, whatever its level. Learn more
- Risk assessment
- Identifying risks, then rating their likelihood and impact against agreed criteria. Learn more
- Risk register
- The list of identified risks with their owner, level and treatment. Learn more
- Risk treatment plan
- The decisions taken for each risk (reduce, avoid, transfer or accept), with actions, owners and deadlines. Learn more
- RPO
- Recovery point objective: the maximum amount of data, measured in time, that a company accepts to lose after an incident. Learn more
- RTO
- Recovery time objective: the maximum time a company accepts for restoring a system or an activity. Learn more
- SLA
- Service level agreement: the measurable service levels a provider commits to. Learn more
- Statement of Applicability (SoA)
- The ISO/IEC 27001 document that lists each Annex A control, whether it applies, why, and whether it is implemented. Learn more