Glossary: security and compliance terms, with the legal reference.

A

Accountability

A GDPR principle (Art. 5(2)) under which the controller is responsible for compliance with the data protection principles and must be able to demonstrate it. In practice it requires documentation, records and proof of the measures taken, not only their existence.

GDPR

ACN (Italian National Cybersecurity Agency)

Italy's national cybersecurity authority. Under Legislative Decree 138/2024 it is the national competent authority for NIS2 and the single point of contact. CSIRT Italia operates within ACN.

NIS2

Annex A (ISO/IEC 27001)

The annex to ISO/IEC 27001:2022 listing 93 reference controls in four themes: organisational, people, physical and technological. The organisation compares them with its own risk treatment and justifies inclusions and exclusions in the statement of applicability.

ISO/IEC 27001

Asset

Anything of value to the organisation that needs protecting: information, systems, applications, devices, services. An asset inventory is an ISO/IEC 27001 control (Annex A, 5.9) and asset management is one of the NIS2 measures (Art. 21(2)(i)).

ISO/IEC 27001NIS2

B

Business continuity

The ability to keep delivering services and products at acceptable levels during and after a disruptive event. NIS2 lists it among the measures (Art. 21(2)(c)) together with backup management, disaster recovery and crisis management; DORA requires ICT business continuity policies and response and recovery plans.

NIS2DORAISO/IEC 27001

C

Certification body

An independent body that audits a management system and issues certification, for example to ISO/IEC 27001 or ISO/IEC 42001. For management systems it operates under ISO/IEC 17021-1 and is accredited by a national accreditation body, which in Italy is Accredia.

ISO/IEC 27001ISO/IEC 42001

Control

A measure that maintains or modifies a risk: a rule, a procedure, a technical configuration or an organisational practice. A verifiable control has an objective, an owner, a scope and a procedure for checking that it works.

Control owner

The person accountable for a control being implemented, maintained and demonstrable: they carry out or coordinate the work, collect the evidence and handle exceptions and corrective actions. The role is distinct from the risk owner, who decides on the treatment and acceptance of the risk.

Controller

The party that, alone or jointly with others, determines the purposes and means of processing personal data (GDPR Art. 4(7)). It is responsible for compliance with the regulation and must be able to demonstrate it (Arts. 5(2) and 24).

GDPR

Corrective action

An action that removes the cause of a nonconformity to prevent it from recurring. In ISO/IEC 27001 (clause 10.2) it covers root cause analysis, implementation of the action and review of its effectiveness, documented as evidence.

ISO/IEC 27001

Critical vendor / ICT third-party service provider

A vendor whose service, if disrupted or compromised, has a significant effect on the organisation's services. NIS2 requires supply chain security to be managed (Art. 21(2)(d)); DORA governs the risk arising from ICT third-party service providers (Art. 28), with stricter requirements for services supporting critical or important functions.

NIS2DORA

CSIRT Italia

Italy's national computer security incident response team, established within ACN. It receives the incident notifications required by NIS2 from Italian entities and provides support in handling incidents.

NIS2

D

DPIA (data protection impact assessment)

An assessment required by the GDPR (Art. 35) before processing that is likely to result in a high risk to the rights and freedoms of individuals, for example when new technologies are used or for large-scale systematic monitoring. It describes the processing, assesses its necessity and proportionality, analyses the risks and sets out the planned measures.

GDPR

DPO (data protection officer)

A role defined by the GDPR (Arts. 37-39) that informs and advises the controller and processor, monitors compliance and cooperates with the supervisory authority. Designation is mandatory for public authorities and for organisations whose core activities involve regular and systematic monitoring on a large scale or large-scale processing of special categories of data.

GDPR

E

Early warning

The first communication NIS2 requires for a significant incident, due within 24 hours of becoming aware of it (Art. 23(4)(a)). It states whether the incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact. The incident notification follows within 72 hours and the final report within one month of the notification.

NIS2

Essential entity / important entity

The two categories of entity under NIS2 (Art. 3). Broadly, essential entities are large undertakings in sectors of high criticality (Annex I) and certain entities regardless of size; important entities are the other in-scope entities in the sectors of Annexes I and II. Obligations on measures and notifications are the same; supervision and maximum fines differ.

NIS2

Evidence

Verifiable information showing that a control exists or has worked: an approved policy, a configuration, a log, a ticket, minutes of a meeting. Evidence that can be used in an audit states its source, date and the scope it refers to.

Exception

An approved deviation from a control or policy, where a measure cannot be applied to a system or process. A managed exception has a justification, an approver, any compensating measures and an expiry date.

F

Finding

The result of an audit or test that identifies a deviation from a requirement or an opportunity for improvement. A managed finding has an owner, a corrective action and a deadline, and stays open until closure has been verified.

G

Gap analysis

A requirement-by-requirement comparison between what a framework requires and what the organisation has in place. The output is a list of gaps with priorities for action, which becomes the basis of the remediation plan.

I

Internal audit

A planned check, carried out by the organisation or on its behalf, that the management system conforms to the organisation's own requirements and those of the standard and is effectively implemented and maintained. ISO/IEC 27001 requires it (clause 9.2), and auditors must be objective and impartial towards what they audit.

ISO/IEC 27001ISO/IEC 42001

ISMS

Information security management system: the set of policies, processes, roles and controls through which an organisation manages risks to the confidentiality, integrity and availability of information. ISO/IEC 27001 sets its requirements and is the standard used for certification.

ISO/IEC 27001

M

Management body

The body that directs the organisation, such as the board of directors or a sole director. NIS2 (Art. 20) gives it the approval of risk-management measures, oversight of their implementation and liability for infringements, and requires its members to follow training. DORA (Art. 5) makes the management body responsible for the ICT risk-management framework.

NIS2DORA

Management review

A review of the management system by top management at planned intervals, required by ISO/IEC 27001 (clause 9.3). Among other inputs it considers audit results, nonconformities, monitoring results and the status of risk treatment, and it produces decisions on improvements and changes.

ISO/IEC 27001ISO/IEC 42001

N

Nonconformity

Failure to meet a requirement of the standard or one the organisation has set for itself. In ISO/IEC 27001 it requires a reaction, root cause analysis and, where needed, a corrective action (clause 10.2). In certification audits nonconformities are graded as major or minor.

ISO/IEC 27001ISO/IEC 42001

O

Operating effectiveness

The extent to which a control worked as intended over a period, not only at a single date. It is the subject of a SOC 2 Type II report and is demonstrated with evidence gathered across the whole period under review.

SOC 2

P

Personal data breach

A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (GDPR Art. 4(12)). The controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33), unless the breach is unlikely to result in a risk to individuals; where the risk is high, it also informs the data subjects (Art. 34).

GDPR

Processor

A party that processes personal data on behalf of the controller (GDPR Art. 4(8)). The relationship is governed by a contract or other legal act setting out instructions and obligations (Art. 28). A cloud software provider hosting customer data normally acts as a processor.

GDPR

R

Record of processing activities

The record of processing activities required by the GDPR (Art. 30) from controllers and processors: purposes, categories of data subjects and data, recipients, transfers to third countries, erasure time limits and security measures. The exemption for organisations with fewer than 250 employees does not apply if the processing is not occasional, is likely to result in a risk or involves special categories of data or data relating to criminal convictions and offences.

GDPR

Register of information (DORA)

The register financial entities keep of all contractual arrangements for the use of ICT services provided by third-party providers (Art. 28(3)), at entity level and, where applicable, at consolidated level. It must be made available to the competent authority, and its format is set by implementing technical standards.

DORA

Residual risk

The risk that remains after treatment measures have been implemented. In ISO/IEC 27001 (clause 6.1.3) it must be accepted by the risk owners; acceptance is documented with a date and an approver.

ISO/IEC 27001

Restore test

A practical check that data and systems can be restored from backup within the RTO and with no more data loss than the RPO allows. A backup that has never been restored in a test does not demonstrate recovery capability: the evidence is the test result, with its date and scope.

NIS2DORAISO/IEC 27001

Risk treatment plan

A document setting out, for each risk to be treated, the option chosen (reduce, avoid, transfer or accept), the controls, the owners and the timescales. ISO/IEC 27001 (clause 6.1.3) requires it to be formulated and approved by the risk owners.

ISO/IEC 27001

RPO / RTO

RPO (Recovery Point Objective) is the maximum acceptable data loss, expressed as time: an RPO of four hours requires a backup at least every four hours. RTO (Recovery Time Objective) is the maximum time within which a service must be available again after a disruption. Both are set in the business impact analysis and checked through restore tests.

NIS2DORAISO/IEC 27001

S

Scope

The set of sites, processes, systems, services and people to which a management system or framework applies. In ISO/IEC 27001 it must be determined and documented (clause 4.3), and the certificate states the scope covered.

ISO/IEC 27001ISO/IEC 42001

Security measures (NIS2 Art. 21)

Appropriate and proportionate technical, operational and organisational measures that essential and important entities take to manage risk. Art. 21(2) lists ten, from (a) to (j): risk analysis, incident handling, business continuity, supply chain, security in acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, human resources and access control, multi-factor authentication and secured communications.

NIS2

Significant incident (NIS2)

An incident that has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or that has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (Art. 23(3)). The notification obligation in Art. 23 applies to significant incidents.

NIS2

Statement of applicability (SoA)

A document required by ISO/IEC 27001 (clause 6.1.3 d) listing the necessary controls, the justification for their inclusion, whether they are implemented and the justification for excluding Annex A controls. It is one of the central documents of the certification audit.

ISO/IEC 27001

Sub-processor

A party engaged by a processor to carry out processing on behalf of the controller, for example a cloud infrastructure provider. The GDPR (Art. 28(2) and 28(4)) requires the controller's prior specific or general written authorisation and imposes on the sub-processor the same data protection obligations as the processor.

GDPR

T

Trust Services Criteria

The criteria defined by the AICPA on which a SOC 2 report is based: security, availability, processing integrity, confidentiality and privacy. Security is included in every report; the other criteria are added depending on the services and the commitments made to customers.

SOC 2

V

vCISO

An external information security lead who performs the CISO role on an agreed engagement rather than as a full-time employee. The vCISO sets the programme and priorities and works with the management body; decisions on measures stay with the organisation.