Compliance glossary

Annex A of ISO 27001:2022 is a reference list of 93 information security controls, grouped into four themes (organisational, people, physical and technological). Organisations choose which apply to them and record the decision in their Statement of Applicability.

A record of the information assets an organisation holds — systems, data, devices and services — often with an owner and a value or sensitivity rating. It underpins risk assessment by making clear what needs protecting.

A senior person in a health or social care organisation responsible for protecting the confidentiality of patient and service-user information and enabling appropriate information sharing. Required in many NHS-facing organisations.

Under PCI DSS, cardholder data includes the primary account number (PAN) and, where present, cardholder name, expiry date and service code. Any system that stores, processes or transmits it falls within PCI DSS scope.

An independent organisation, ideally UKAS-accredited, that audits your management system and issues certification (for example to ISO 27001). It is separate from any consultant who helps you prepare.

A measure that reduces information security risk — technical (such as multi-factor authentication), organisational (such as a policy) or physical (such as a locked server room). ISO 27001 Annex A and the Cyber Essentials five controls are examples.

Action taken to eliminate the cause of a nonconformity so it does not recur. In ISO 27001, corrective actions follow internal or external audit findings and are tracked to closure.

A UK government-backed scheme, delivered by IASME for the NCSC, that certifies an organisation has five core technical controls in place: firewalls, secure configuration, user access control, malware protection and security update management.

The higher tier of Cyber Essentials. It adds an independent technical audit — vulnerability scans and device sampling — to verify the five controls are genuinely in place, rather than relying on self-assessment alone.

Under UK GDPR, the organisation that determines the purposes and means of processing personal data. Controllers carry the primary legal responsibility for compliance.

Under UK GDPR, an organisation that processes personal data on behalf of a controller — for example a cloud provider or payroll bureau. Processors have direct legal duties and must operate under a written contract.

The UK law that sits alongside the UK GDPR, tailoring it to the UK and covering areas such as law-enforcement and intelligence processing. Together they form the UK's data-protection framework.

A structured assessment that identifies and reduces the data-protection risks of a project before it starts. A DPIA is legally required for processing likely to result in a high risk to individuals — for example new systems handling health data.

A role required under UK GDPR for public authorities and organisations whose core activities involve large-scale or special-category data processing. The DPO advises on compliance, monitors it and is the contact point for the ICO. The role can be outsourced.

An annual online self-assessment that organisations handling NHS health and care data must complete to demonstrate they meet the required data-security and information-governance standards. The standard annual deadline is 30 June.

Under UK GDPR, the identified or identifiable living individual to whom personal data relates — for example a patient, resident, employee or customer.

A structured review that compares your current position against a standard's requirements and identifies what is missing. It is usually the first step of a compliance project and shapes the action plan.

The organisation appointed by the NCSC to deliver the Cyber Essentials scheme, and the owner of the IASME Cyber Assurance standard — an SME-friendly alternative to ISO 27001.

The UK's independent regulator for data protection and information rights. Organisations register with the ICO, report notifiable breaches to it, and can be investigated or fined by it for non-compliance.

The framework of policies, roles and processes through which an organisation manages information — especially personal and health data — securely, legally and ethically. It underpins the DSPT.

A planned, independent check that your management system (such as an ISMS) meets the standard and works in practice. ISO 27001 requires internal audits before certification and on an ongoing basis.

The set of policies, processes, roles and controls an organisation uses to manage information security risk in a structured, ongoing way. Building a certifiable ISMS is the core of ISO 27001.

The international standard (current version ISO/IEC 27001:2022) for establishing, operating and improving an information security management system. Certification by an accredited body demonstrates a managed approach to security.

Under UK GDPR, every act of processing personal data must have one of six lawful bases — for example consent, contract, legal obligation, vital interests, public task or legitimate interests. Special-category data needs an additional condition.

A regular review by senior management of how the information security management system is performing — covering risks, incidents, audit results and objectives. ISO 27001 requires it to ensure the ISMS stays effective.

A sign-in method that requires two or more independent factors — such as a password plus a code from an app. MFA is a Cyber Essentials requirement for cloud services and a common reason assessments pass or fail.

The UK government body that provides cyber-security guidance and owns the Cyber Essentials scheme (delivered on its behalf by IASME).

The national NHS body responsible for the Data Security and Protection Toolkit and related information-governance requirements that health and care organisations must meet.

A finding that a requirement of a standard has not been met. In ISO 27001 audits, nonconformities are classified as minor or major and must be addressed through corrective action before certification.

The Payment Card Industry Data Security Standard (current version v4.0.1) applies to any organisation that stores, processes or transmits cardholder data. Compliance is evidenced through a Self-Assessment Questionnaire or formal assessment.

An authorised, in-depth test in which specialists attempt to exploit weaknesses in systems to see what a real attacker could achieve. It goes further than an automated vulnerability scan and is sometimes required for higher-assurance standards.

Under UK GDPR, any information relating to an identified or identifiable living individual — names, contact details, identifiers and more. Its processing is regulated by UK GDPR and the DPA 2018.

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Notifiable breaches must be reported to the ICO without undue delay and within 72 hours.

A documented inventory of an organisation's personal-data processing — what data, for what purpose, on what basis, shared with whom, and for how long. UK GDPR requires most organisations to maintain one.

The work of closing the gaps a review or audit has identified — updating policies, configuring systems, gathering evidence — so an organisation meets the standard.

The level of information security risk an organisation is willing to accept in pursuit of its objectives. It guides which risks are treated, tolerated, transferred or terminated.

The process of identifying information-security risks, assessing their likelihood and impact, and deciding how to treat them. It is central to ISO 27001 and drives the Statement of Applicability.

A validation tool for PCI DSS. Different SAQ types (for example A, A-EP, B, C and D) apply depending on how a merchant takes card payments; choosing the right one — and reducing scope — is key to simpler compliance.

The defined boundary of what a standard or assessment applies to — which systems, locations, data and business units. Getting scope right keeps compliance proportionate; reducing scope (in PCI DSS especially) reduces effort and cost.

Under UK GDPR, sensitive personal data — including health, biometric, genetic, racial or ethnic, religious, and sexual-orientation data — which needs extra protection and an additional condition for processing. Health and care data usually falls here.

ISO 27001 certification is assessed in two stages: Stage 1 reviews your documentation and readiness; Stage 2 tests whether the ISMS operates effectively in practice. Passing both leads to certification.

The DSPT status showing an organisation has satisfied all mandatory assertions for its profile. 'Approaching Standards' means some are outstanding with a plan to close them.

A central ISO 27001 document that lists the Annex A controls, states whether each is applicable, records the justification, and notes its implementation status. Auditors rely on it heavily.

A request from an individual to access the personal data an organisation holds about them. Under UK GDPR it must usually be answered free of charge within one month.

Periodic (usually annual) audits by the certification body that confirm a certified management system is still maintained and effective, between full recertifications every three years.

The United Kingdom General Data Protection Regulation — the UK's retained version of the EU GDPR — which, with the Data Protection Act 2018, governs how organisations process personal data.

The United Kingdom Accreditation Service — the national body that accredits certification bodies. A UKAS-accredited ISO 27001 certificate carries more weight than an unaccredited one.

An automated scan that checks systems for known security weaknesses, such as missing patches or insecure configuration. Vulnerability scanning is part of the Cyber Essentials Plus audit.