Security and Compliance

Bridge Letter A bridge letter is a short letter from a vendor's management covering the gap between the end of its last SOC report period and today. It says no material control changes are known, but no auditor has checked it. Business Continuity and Disaster Recovery Business continuity and disaster recovery (BCDR) is a vendor's plan for keeping its service running during a major outage and restoring systems and data afterward. Two numbers sum it up: how much data could be lost (RPO) and how long recovery takes (RTO). CAIQ The CAIQ (Consensus Assessments Initiative Questionnaire) is the Cloud Security Alliance's set of yes-or-no questions that a cloud provider answers to show how it meets each control in CSA's Cloud Controls Matrix (CCM). Carve-Out Method (Subservice Organizations) The carve-out method is how a SOC report leaves out the controls of a vendor's own providers, such as its cloud host. The report names those providers, but the auditor does not test their controls, so you need other evidence for them. Complementary User Entity Controls (CUECs) Complementary user entity controls (CUECs) are the security steps a vendor's SOC report assumes you, the customer, will take. The vendor's controls only work as described if you do your part, such as managing your own users' access. Data Breach A data breach (in GDPR terms, a personal data breach) is a security failure that leads to personal data being destroyed, lost, changed, disclosed or accessed without permission, whether by accident or by attack. Due Diligence Questionnaire (DDQ) A due diligence questionnaire is a broad vendor review that covers security plus finances, ownership, legal, privacy and continuity. Encryption at Rest and in Transit Encryption in transit protects data while it moves between systems, usually with TLS. Encryption at rest protects data while it is stored on disks or in databases, often with AES-256. Vendors describe both in their security terms. ISO 27001 ISO 27001 is an international standard for running an information security management system: the policies, people and processes a company uses to manage security risk. A vendor certified to it has passed an audit by an independent certification body. ISO 27701 ISO 27701 is an international standard for managing privacy: how a company handles personal data as a controller or processor. It began as a privacy extension to ISO 27001, and its 2025 edition became a standalone standard. Penetration Test Report A penetration test report sets out what authorized security testers found when they attacked a system the way a real attacker would, how serious each weakness is and how to fix it. Security Incident A security incident is any event that threatens the security of systems or data. Every personal data breach is a security incident, but not every incident is a breach. Security Questionnaire A security questionnaire is a list of questions a buyer sends a vendor about how it protects systems and data: access, encryption, testing, incidents and subprocessors. The answers describe the vendor on the day they were written. SIG Questionnaire The SIG (Standardized Information Gathering questionnaire) is Shared Assessments' licensed vendor risk questionnaire. It comes in a short SIG Lite for lower-risk vendors and a longer SIG Core for vendors that handle sensitive or regulated data. SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. SOC 2 Exceptions A SOC 2 exception is a test result in the report showing that a control did not work as described during the audit period. SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. SOC 2 Scope SOC 2 scope is the boundary of what a SOC 2 report covers: which products, systems, locations, legal entities, trust services categories and time period. Anything outside it was not examined, even if it carries the same brand. SOC 3 Report A SOC 3 report is a short, public summary of a vendor's SOC 2 audit. It shows the auditor's overall opinion but leaves out the controls tested and the detailed results, so it cannot replace the full SOC 2 report. Vulnerability Disclosure Policy A vulnerability disclosure policy (VDP) tells outside security researchers how to report a security hole in a vendor's product, what testing is allowed and what to expect back, often with a promise not to take legal action over good-faith research.