Security review glossary
The terms that come up when a customer's security team reviews your company, each in a sentence, with what the reviewer wants to see.
- CAIQ
- The Consensus Assessments Initiative Questionnaire: the Cloud Security Alliance's standard security questionnaire for cloud service providers.
- Data processing agreement (DPA)
- The contract between a company and a vendor that processes personal data for it, setting out how that data is handled, secured, and returned or deleted.
- Data subject access request (DSAR)
- A request from a person to see the personal data an organisation holds about them, and, more broadly, any request to exercise their data protection rights.
- HECVAT
- The Higher Education Community Vendor Assessment Toolkit: the security questionnaire that universities and colleges send to the software vendors they buy from.
- NDA (non-disclosure agreement)
- A contract in which one party agrees to keep the other's confidential information private, often asked for before sharing a SOC 2 report or pen test summary.
- Safe harbour
- A statement in a vulnerability disclosure policy that the organisation won't pursue legal action against researchers acting in good faith within the policy.
- security.txt
- A plain text file at /.well-known/security.txt, defined in RFC 9116, that tells security researchers how to report a vulnerability to a website owner.
- SIG Lite
- The shorter version of the Standardized Information Gathering questionnaire, a third-party risk questionnaire published by Shared Assessments.
- SOC 2
- An attestation report in which an independent auditor assesses a service organisation's controls against the AICPA's Trust Services Criteria.
- SOC 2 bridge letter
- A letter from management covering the gap between the end of a company's last SOC 2 report period and today, usually saying controls haven't materially changed.
- Subprocessor
- A third party that a data processor engages to process personal data on behalf of its customer, such as a hosting provider or an email service.
- Trust center
- A public page where a company shows how it protects customer data: its security controls, compliance status, documents, subprocessors and security contacts.
- Vulnerability disclosure policy (VDP)
- A public policy that tells security researchers how to report a vulnerability, which systems are in scope, and how the organisation will handle their report.