1. Scope
Scope explicitly defines which organizational units, locations, services, processes, identities, applications, cloud tenants, data flows and supplier dependencies are included. A control or compliance state is not defensible without scope because the same technical state may have different relevance inside and outside a defined boundary.
2. Requirement
A requirement is an external or internal obligation originating from law, contract, management-system standards, customer commitments or internal policy. Requirements are translated into testable control objectives rather than treated as technical findings themselves.
3. Risk
Risk describes the effect of uncertainty on objectives. Security assurance requires traceability of the relevant asset or service, threat, exposure or vulnerability, likelihood, impact, existing measures, residual risk, risk owner and treatment decision.
4. Control Objective
A control objective describes the desired security state. It is more stable than an individual product feature and allows different technical implementations to be assessed against the same objective.
5. Control
A control is the concrete organizational, technical, people or physical measure. It requires an owner, purpose, scope, operating frequency, test frequency, evidence source, test criterion, exception logic and linkage to risks and requirements.
6. Test Criterion
A test criterion unambiguously defines when a control is considered satisfied, degraded, failed or not testable. This prevents subjective impressions from being confused with reproducible results.
7. Evidence
Evidence is verifiable material used to assess a test criterion. Strong evidence has traceable provenance, timestamp, scope, integrity, sufficient detail and documented linkage to the relevant control.
8. Control Health
Control health is the assessed operating state of a control. It combines current evidence, test results, accepted exceptions and known findings. A high score is not a legal compliance guarantee; it describes documented assurance within the agreed scope.
9. Finding
A finding is an observed deviation between expected and actual state. It contains description, affected scope, risk, severity, evidence, root cause where known, owner, target state and treatment.
10. Exception
An exception is a deliberately approved deviation. It requires rationale, risk owner, approver, expiry date, compensating controls where necessary and reassessment before extension.
11. Remediation
Remediation is the controlled transition from current state to target state. It includes technical or organizational actions, accountability, deadline, dependencies, change risk and closure verification.
12. Verification
An action is not complete merely because a ticket is closed. Verification retests the achieved target state against defined criteria and records closure evidence.
13. Assurance
Assurance is the ongoing, traceable confidence that relevant controls operate effectively, deviations are detected and risks are governed. Continuous assurance increases the frequency and freshness of this statement but does not replace management accountability, legal advice or independent certification.