GLOSSARY

AICPA

Terms

Annex A Controls

Attestation of Compliance (AOC)

California Consumer Privacy Act (CCPA)

Compliance risk management

Cardholder Data (CHD)

Cardholder Data Environment (CDE)

Compliance software

General Data Protection Regulation (GDPR)

HIPAA Business Associates

HIPAA Compliance

HIPAA Covered Entities

HIPAA employee training

HIPAA Risk Assessment

HIPAA Rules: Breach Notification Rule

HIPAA Rules: Enforcement Rule

HIPAA Rules: Omnibus Rule

HIPAA Rules: Privacy Rule

HIPAA Rules: Security Rule

HIPAA Safeguards

HIPAA Sanctions

Health Information Technology for Economic and Clinical Health Act (HITECH)

ISMS Governing Body

ISO 27001 security standard

ISO 27001 Internal Audit

ISO 27001 Key Performance Indicators (KPIs)

ISO 27001 Management Review

ISO 27001 Nonconformities

ISO 27001 Risk Assessment

ISO 27001 Risk Treatment Plan

ISO 27001 Stage 1 Audit

ISO 27001 Stage 2 Audit

IT security policy

Information Security Management System (ISMS)

NIST Cybersecurity Framework (CSF)

Protected health information

Payment Card Industry Data Security Standard (PCI DSS)

Qualified Security Assessor (QSA)

Report on Compliance (ROC)

Security questionnaire

SOC 2 Type I report

SOC 2 Type II report

SOC 2 compliance

SOC Trust Services Criteria

Self-Assessment Questionnaire (SAQ)

Service Provider

Statement of Applicability

Vendor assessment

Vendor management policy

What is the AICPA?

‍

AICPA is the acronym for the American Institute of Certified Public Accountants. The AICPA is the originator of the SOC (System and Organization Controls) audit and reporting standards.

‍

Through the SOC 2 standard, the AICPA sets guidelines for the evaluation of an organization’s data Security, Availability, Confidentiality, Privacy, and Processing Integrity — a set of criteria known as the Trust Services Criteria.

‍

Learn more about the AICPA and its SOC reporting standards with this guide to the SOC 2.