Compliance glossary

Plain-language definitions for the terms used across compliance, privacy, cybersecurity, and operational resilience.

Regulations and standards

AI Act: The AI Act establishes risk-proportionate obligations for AI systems, general-purpose AI models, and the organizations that develop or use them.
CER: The CER Directive strengthens the resilience of essential infrastructure and services against physical, cyber, and supply-chain risks.
CIS Controls: CIS Controls are a practical, prioritized list of defenses — inventory, access, backups, monitoring — used to reduce the most common risks.
COSO: COSO defines components and principles for internal control, reporting, and risk management, often used alongside SOX and internal audit.
CRA: The Cyber Resilience Act requires security throughout the lifecycle of connected products, from design through after-sale support.
DORA: The Digital Operational Resilience Act is the EU regulation requiring financial entities to manage and evidence resilience across ICT services, third parties, testing, and incidents.
GDPR: The GDPR governs personal-data processing in the European Union and requires accountability, appropriate safeguards, and demonstrable compliance.
GPAI: A GPAI model is designed to perform a wide range of tasks and can be integrated into many downstream systems, with specific obligations under the AI Act.
IA ad alto rischio: A high-risk AI system, for example in health or critical infrastructure, requires risk management, data governance, transparency, human oversight, and compliance evidence.
ISO 22301: ISO 22301 specifies how to plan, implement, and improve a business continuity system that can withstand and recover from disruption.
ISO 27001: ISO 27001 specifies requirements for establishing, maintaining, and improving a risk-based information security management system.
ISO 31000: ISO 31000 provides principles and a process for identifying, assessing, treating, and monitoring risk as part of governance.
ISO 9001: ISO 9001 sets requirements for a quality management system based on processes, evidence, and continual improvement.
Modello 231: Model 231 defines processes, controls, protocols, and reporting flows to prevent offences that may lead to an organization’s administrative liability under Italian law.
NIS2: NIS2 is the European directive strengthening cyber-risk management, supply-chain security, and incident reporting for essential and important organizations.
NIST CSF: The NIST Cybersecurity Framework organizes cybersecurity into practical functions — Identify, Protect, Detect, Respond, Recover — used to assess and improve security posture.
NIST SP 800-53: NIST SP 800-53 defines a library of technical, operational, and governance controls that organizations tailor to risk and scope.
PCI DSS: PCI DSS sets technical and organizational requirements to protect cardholder data, covering network, access, monitoring, and testing.
Soggetto essenziale: Essential entities, together with important entities, fall under NIS2: they must manage cyber risk, the supply chain, and incident notification, with stronger supervision.
SOX: Sarbanes-Oxley requires US-listed companies to demonstrate reliable internal controls over financial reporting, with management accountability.

Privacy

Base giuridica: Every GDPR processing activity needs a legal basis, such as consent, contract, legal obligation, legitimate interest, or public interest.
Data breach: A data breach is a security incident leading to destruction, loss, alteration, or unauthorized access to personal data, often with notification duties.
Data Processing Agreement: A Data Processing Agreement sets instructions, security measures, sub-processors, and assistance duties between controller and processor.
Diritto all’oblio: The right to be forgotten lets a person request erasure when data are no longer needed or processing is no longer lawful, subject to exceptions.
DPIA: A DPIA assesses the necessity, proportionality, and risks of potentially high-risk processing and identifies measures to reduce them.
DSAR: A Data Subject Access Request is a request from an individual to access personal data or exercise other rights granted by the GDPR.
EDPB: The European Data Protection Board ensures consistent GDPR application across Member States and issues guidelines and opinions.
Garante Privacy: The Italian Data Protection Authority oversees GDPR application in Italy, handles complaints, and can impose measures and fines.
Legal hold: A legal hold prevents alteration or deletion of records and evidence when a proceeding, investigation, or preservation duty requires it.
Minimizzazione dei dati: Data minimisation requires collecting and keeping only data that are adequate, relevant, and limited to what the stated purposes need.
PII: PII refers to data that, alone or combined, can identify an individual; under the GDPR the broader concept is personal data.
Privacy by design: Privacy by design requires embedding privacy measures — minimization, security, retention limits — before processing starts, not afterwards.
Responsabile del trattamento: The data processor acts on the controller’s instructions, under an agreement covering scope, security measures, and assistance duties.
RoPA: The Record of Processing Activities documents purposes, data categories, parties involved, retention periods, and safeguards for each processing activity.
SCC: Standard Contractual Clauses are a contractual mechanism for transferring personal data to third countries with appropriate safeguards.
Sub-processor: A sub-processor sits further down the processing chain and must be authorized and bound to duties equivalent to the processor’s.
Titolare del trattamento: The data controller determines why and how personal data are processed and remains accountable for GDPR compliance.

Resilience and operations

BCM: Business Continuity Management covers analysis, plans, testing, training, and continual improvement so the organization can withstand disruption.
BCP: A Business Continuity Plan describes roles, procedures, and resources to keep operating during and after an incident, disaster, or ICT outage.
BIA: A Business Impact Analysis identifies critical processes, dependencies, and time-based consequences, and feeds objectives such as MTPD, RTO, and RPO.
CSIRT: A Computer Security Incident Response Team coordinates analysis, containment, recovery, and communications during a cyber incident.
Disaster Recovery: Disaster Recovery is the technical side of continuity: backups, alternate sites, and procedures to restore ICT and data within RTO and RPO.
Funzione critica o importante: In resilience rules, especially DORA, critical or important functions are processes and services that must be mapped, protected, and tested with evidence.
ICT: ICT covers the infrastructure, systems, networks, applications, and services that process, transmit, or store information.
Incident response: Incident response defines roles, notification timelines, evidence, and communications for cyber, operational, or privacy events.
KRI: Key Risk Indicators track leading signals — delays, incidents, dependencies — so risk treatment does not arrive too late.
MTPD: The Maximum Tolerable Period of Disruption identifies the disruption duration beyond which the consequences for the organization become unacceptable.
OT: OT covers industrial control systems and plants: it must be governed alongside IT because an incident can stop essential services.
Penetration test: A penetration test checks whether technical and organizational weaknesses can be exploited, and produces evidence and findings to remediate.
RPO: The Recovery Point Objective defines how far back in time data must be recoverable after an incident or disruption.
RTO: The Recovery Time Objective defines the maximum acceptable period of disruption before a service or process must be restored.
SLA: An SLA defines availability, restoration times, and other contractual measures used to govern ICT suppliers and critical functions.
SOC: A Security Operations Center watches logs and alerts, investigates incidents, and coordinates containment, often alongside SIEM and CSIRT.
Tabletop: A tabletop walks participants through an incident with roles and timelines, without attacking systems, to rehearse decisions and collect evidence.
TLPT: Threat-Led Penetration Testing simulates realistic threats against critical functions to assess technical, operational, and organizational resilience.

Security

AES-256: AES-256 is an encryption standard used to protect data at rest: without the key, the content stays unreadable even if the file is copied.
CSRF: Cross-Site Request Forgery abuses an existing session: CSRF tokens and SameSite cookies are used to block those forged requests.
DLP: Data Loss Prevention monitors and blocks confidential information leaving by email, cloud, or devices, supporting privacy and trade secrets.
eIDAS: eIDAS governs electronic identification and trust services, including electronic signatures, seals, and time stamps, in the European Union.
HMAC: HMAC combines a hash function and a secret key to sign logs and metadata, so tampering becomes detectable.
IAM: IAM covers how people and systems identify themselves, gain access, and lose it: directories, MFA, roles, and account reviews.
JWT: A JSON Web Token carries identity and permissions in signed form, so an API can verify the caller without sending the session every time.
MFA: Multi-Factor Authentication requires at least two independent factors, such as a password and one-time code, to reduce the risk of unauthorized access.
Minimo privilegio: Least privilege reduces the impact of a compromised account or a mistake: roles, permissions, and periodic reviews must match actual work.
OTP: An OTP grants a one-off login or confirmation without reusing the same secret; on supplier portals it reduces the risk of shared links.
PAM: Privileged Access Management protects administrators, keys, and elevated sessions, recording who did what on critical systems.
RBAC: Role-Based Access Control grants permissions to defined roles rather than individual users, supporting the principle of least privilege.
SIEM: A SIEM centralizes security logs and events to correlate signals, detect anomalies, and support incident investigations.
SOC 2: SOC 2 is an attestation of a service organization’s controls, used to assess cloud and SaaS suppliers against defined trust criteria.
SoD: Segregation of duties stops the same person from requesting, approving, and executing a critical action: it is a classic audit and SOX control.
TOTP: TOTP generates short-lived passwords in an authenticator app: it is the most common 2FA mechanism after username and password.
Zero Trust: Zero Trust requires continuous verification of identity, device, and context before each access, instead of treating the corporate network as safe.

Roles and authorities

ACN: Italy’s National Cybersecurity Agency coordinates and strengthens national cybersecurity and has key responsibilities in the national implementation of NIS2.
Autorità di controllo: A supervisory authority — privacy regulator, cyber agency, or financial supervisor — can inspect, request evidence, and sanction: operational registers serve that scrutiny too.
CISO: The Chief Information Security Officer leads cybersecurity strategy, coordinates risk management, and reports the security posture to management.
CRO: The Chief Risk Officer coordinates the risk register, treatments, and reporting to the management body, often alongside the CISO and compliance.
DPO: The DPO informs and advises the organization on privacy obligations, monitors compliance, and acts as a contact point for the supervisory authority.
ENISA: ENISA supports Member States with guidance, exercises, and operational cooperation, and has a role in the NIS2 framework and cyber certification.
Internal auditor: Internal audit examines whether controls work, collects evidence, and reports findings to management, without replacing first-line controls.
OdV: The Supervisory Body monitors the effectiveness and observance of Model 231, receives reports, and recommends updates when needed.
Organo di gestione: The management body — board or executive leadership — must know risks, incidents, and attestations: many regulations assign it explicit duties.

Governance and GRC

Appetito al rischio: Risk appetite, set by the management body, guides which risks to treat, accept, or avoid, and how much residual risk is tolerable.
Attestazione: An attestation commits the signer on controls, risks, or incidents: it should be linked to evidence, not stand as an isolated claim.
Audit trail: An audit trail records relevant actions in order and, if signed, immutably: it is the basis for reconstructing decisions and evidence in an audit.
Due diligence: Due diligence examines a supplier, acquisition, or partner — scope, duties, gaps, and proof — before taking on contractual risk.
ERM: Enterprise Risk Management brings strategic, operational, cyber, and compliance risks into one frame, with risk appetite and board reporting.
ESG: ESG groups environmental impact, people and labour, and governance quality: in IT it translates into controls, suppliers, and demonstrable evidence.
Finding: A finding records a gap or non-conformity, with severity, owner, deadline, and closure evidence: it is the bridge from discovery to remediation.
Gap analysis: A gap analysis shows what is missing — policies, evidence, ownership — against a framework, and feeds the remediation plan.
GRC: GRC connects decisions, risks, and regulatory duties in one system, so controls and evidence do not stay in separate silos.
ISMS: An ISMS, typically aligned to ISO 27001, organizes policies, risks, controls, and continual improvement of information security.
Lex specialis: Lex specialis explains, for example, why DORA can prevail over NIS2 for financial entities: the more specific framework applies, not a duplicate identical duty.
RACI: A RACI matrix makes roles visible on a process or control, reducing ownership gaps between compliance, IT, and business lines.
Registro dei rischi: The risk register holds description, inherent and residual levels, treatment plan, deadlines, and evidence: it is the CRO’s operational tool.
Remediation: Remediation is the concrete plan — action, owner, deadline, evidence — that takes an issue from open to demonstrably closed.
Rischio inerente: Inherent risk describes exposure and impact as if controls were absent: it shows how much those controls need to reduce.
Rischio residuo: Residual risk is what remains once safeguards are in place: if it exceeds appetite, further treatment or formal acceptance is required.
Tre linee di difesa: The three lines of defence distinguish who operates, who oversees risk, and who provides independent assurance, so controls are not self-certified.
Whistleblowing: Whistleblowing lets people report unlawful conduct with protections for the reporter: in Model 231 it is a typical safeguard, linked to the OdV.