Asset
Information or a resource with business or security value.
Assurance
Structured confidence that defined controls operate effectively and deviations are governed.
BSIG
German BSI Act; the current BSIG includes obligations for essential and important entities.
CIA Triad
Confidentiality, Integrity and Availability.
Compensating Control
Alternative security measure that reduces risk when the preferred control cannot be fully implemented.
Conditional Access
Microsoft Entra mechanism for context-based access decisions.
Control
Organizational, technical, people or physical measure used to modify risk or achieve a defined security state.
Control Owner
Role accountable for definition, operation, monitoring and deviation management of a control.
Control Health
Assessed current operating state of a control based on evidence, test criteria, findings and approved exceptions.
Evidence
Verifiable information used to assess a test criterion or control operation.
Evidence Freshness
Timeliness of evidence relative to the intended test frequency.
Finding
Documented deviation between expected and observed state.
GRC
Governance, Risk and Compliance: linkage of leadership, risk decisions, obligations, controls, evidence and oversight.
Human Oversight
Human supervision of AI or automated systems including approval, escalation and override responsibility.
ISMS
Information Security Management System: management system for systematic governance of information-security risk.
Least Privilege
Principle of granting identities only the minimum permissions required for the necessary period.
MFA
Multi-Factor Authentication using at least two different factor types.
NIS2
EU directive for a high common level of cybersecurity, operationalized in Germany through national law.
Remediation
Actions that move an unacceptable current state to a defined target state.
Risk Acceptance
Documented decision by an authorized risk owner to knowingly carry residual risk under defined conditions.
Risk Treatment
Avoidance, reduction, transfer or conscious acceptance of risk.
SoA
Statement of Applicability: ISO/IEC 27001 document recording applicability and rationale for reference controls in the ISMS scope.
Zero Trust
Security model based on explicit verification, reduced implicit trust, least privilege and assumption of possible compromise.