Compliance and Security Standards Glossary: Part A

An AI management system is a set of interrelated elements of an organization that sets policies and objectives, plus the processes to achieve them, for the responsible development, provision or use of AI systems. ISO/IEC 42001 specifies requirements for one.

Source: ISO page for ISO/IEC 42001:2023, including its FAQ.

In ISO/IEC 17000 terms, certification is third-party attestation: an independent body gives written assurance, a certificate, that a system meets specific requirements. ISO itself does not certify. A SOC 2 report takes a different form: a CPA examines controls and issues an assurance report.

Sources: ISO, "Certification"; AICPA & CIMA, SOC suite; SOC 2 listed as attestation services; NIST SP 2000-01, quoting ISO/IEC 17000: certification is third-party attestation.

CERT-In, the Indian Computer Emergency Response Team, is India's national agency for responding to cyber security incidents, under the Ministry of Electronics and Information Technology. Its 2022 directions require organisations, including service providers and data centres, to report listed incidents within six hours.

Sources: CERT-In, about; Directions under section 70B(6) of the IT Act, 2000, dated 28 April 2022, paragraph on 6-hour reporting.

A data fiduciary is any person who, alone or with others, decides the purpose and means of processing personal data, under India's Digital Personal Data Protection Act, 2023. In that Act, "person" includes individuals, companies, firms and the State.

Source: DPDP Act, 2023, section 2(i) and section 2(s).

A data principal is the individual to whom personal data relates, under India's Digital Personal Data Protection Act, 2023. For a child, the term includes the parents or lawful guardian; for a person with a disability, the lawful guardian acting on that person's behalf.

Source: DPDP Act, 2023, section 2(j).

The Data Protection Board of India is established by the Central Government under section 18 of India's Digital Personal Data Protection Act, 2023. Most of its section 27 powers to inquire into breaches and impose penalties start eighteen months after 13 November 2025.

Sources: DPDP Act, 2023, sections 2(a), 2(c), 18, 27 and 29; India Code copy "as on the 19th November, 2025", with commencement notes.

The Digital Personal Data Protection (DPDP) Act, 2023, enacted on 11 August 2023, is India's law on processing digital personal data. It covers processing in India and, if tied to offering goods or services to people in India, processing abroad. It is being phased in.

Sources: DPDP Act, 2023, long title and sections 1 and 3; commencement notes citing notification G.S.R. 843(E) of 13 November 2025; Press Information Bureau explainer, 17 November 2025. Note: The Act does not apply to personal data processed by an individual for personal or domestic purposes (section 3(c)).

The GDPR (General Data Protection Regulation, Regulation (EU) 2016/679) is the EU's main data protection law, applying since 25 May 2018. It covers organisations established in the EU, and organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour.

Sources: European Commission; European Commission.

HIPAA is the US Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191). Its rules on health information privacy and security apply to health plans, health care clearinghouses, providers that send health data electronically in covered transactions, and business associates.

Sources: Public Law 104-191, title; 45 CFR 160.102, applicability; read through the eCFR API; HHS, covered entities and business associates.

The IRDAI Information and Cyber Security Guidelines, 2026 are issued by the Insurance Regulatory and Development Authority of India. They set minimum standards and governance mechanisms for insurers, insurance intermediaries and the Insurance Information Bureau of India, and revise the 2023 guidelines.

Source: IRDAI circular IRDAI/GA&HR/CIR/MISC/51/4/2026 dated 6 April 2026, with the Guidelines as Annexure B; IRDAI lists it as posted 08-04-2026 at https://irdai.gov.in/guidelines. Note: The 2023 version is IRDAI/GA&HR/GDL/MISC/88/04/2023 dated 24 April 2023.

An information security management system (ISMS) is a management system an organization uses to manage risks to the security of the data it owns or handles. ISO/IEC 27001 sets out the requirements an ISMS must meet.

Sources: ISO, ISO/IEC 27001 overview; ISO page for ISO/IEC 27001:2022.

ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system (ISMS). The current edition is ISO/IEC 27001:2022. It applies to organizations of any size and sector, whether private, public or not-for-profit.

Source: edition 3, published October 2022.

ISO/IEC 27701 is the international standard with requirements and guidance for establishing, implementing, maintaining and continually improving a privacy information management system (PIMS). The 2025 edition, published October 2025, replaced the 2019 edition. Organizations that act as PII controllers or processors can use it.

Source: edition 2, published October 2025; lists ISO/IEC 27701:2019 as superseded.

ISO/IEC 42001 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an AI management system within an organization. Published in December 2023, it is designed for entities that provide or use AI-based products or services.

Source: edition 1, published December 2023.

The Essential Cybersecurity Controls (ECC) are minimum cybersecurity requirements issued by Saudi Arabia's National Cybersecurity Authority (NCA). The edition checked is ECC-2:2024. It applies to government agencies and their affiliated entities, and to private entities that own, operate or host critical national infrastructure.

Source: NCA, ECC-2:2024, English edition, sections "Introduction" and "Scope of Work and Applicability". Note: The document says its Arabic version is the binding language.

The NIST AI Risk Management Framework (AI RMF 1.0, January 2023) is a voluntary framework from the US National Institute of Standards and Technology to help organizations manage the risks of AI systems. Its core has four functions: Govern, Map, Measure and Manage.

Sources: NIST AI 100-1, January 2023; NIST, released January 26, 2023.

The NIST Cybersecurity Framework (CSF) 2.0, published 26 February 2024, is guidance from the US National Institute of Standards and Technology for managing cybersecurity risk. Any organization can use it. Its six Functions are Govern, Identify, Protect, Detect, Respond and Recover.

Sources: NIST CSWP 29, February 26, 2024; PDF at https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf; NIST CSF page.

PCI DSS, the Payment Card Industry Data Security Standard, is maintained by the PCI Security Standards Council to enhance payment card data security. It applies to entities that store, process or transmit cardholder data or sensitive authentication data, or could affect the cardholder data environment.

Sources: PCI SSC; PCI SSC, "The Council's role is to develop and maintain standards".

A privacy information management system (PIMS) is a management system for handling personally identifiable information (PII). ISO/IEC 27701 sets requirements for establishing, implementing, maintaining and continually improving one, for any organization that collects, processes, stores or controls PII.

Source: ISO page for ISO/IEC 27701:2025.

The SAMA Cyber Security Framework is mandated by the Saudi Central Bank (SAMA) to help regulated financial institutions identify and address cyber security risks. It applies to all member organizations regulated by SAMA, including banks, insurance and reinsurance companies, financing companies and credit bureaus.

Source: SAMA Rulebook, Cyber Security Framework.

The Saudi PDPL is the Kingdom of Saudi Arabia's Personal Data Protection Law, approved by Royal Decree No. M/19 of 9/2/1443H (16 September 2021). It applies to personal data processing that takes place in the Kingdom, including residents' data processed by entities outside it.

Source: Bureau of Experts at the Council of Ministers, Arabic text, Article 2 and the decree record. Note: The law was later amended by Royal Decree M/148.

SOC 2 is a System and Organization Controls report in which a CPA examines a service organization's description of its system and its controls relevant to security, availability, processing integrity, confidentiality or privacy. The AICPA promulgates the professional standards for SOC engagements.

Sources: AICPA & CIMA, SOC 2 guide; AICPA & CIMA, SOC suite.

The Trust Services Criteria are control criteria established by the AICPA's Assurance Services Executive Committee, for use in attestation or consulting engagements to evaluate and report on controls. They cover security, availability, processing integrity, confidentiality and privacy.

Source: AICPA & CIMA, 2017 Trust Services Criteria with revised points of focus, 2022, published 30 September 2023.

Continue with Part B: Security and GRC operations glossary.