Glossary
GRC and resilience terms, explained
Short, plain definitions of the terms you meet in governance, risk, compliance, continuity and incident management, including the vocabulary of DORA and NIS2.
Terms
A
- Attestation
- A formal confirmation by a responsible person that something is true or has been done: for example that they have read a policy, or that a control operated as designed during a period.
- Audit trail
- A chronological record of who changed what and when, ideally with the values before and after the change. It lets you reconstruct decisions and demonstrate the integrity of records.
- Audit universe
- The complete set of auditable entities, processes, systems and topics in an organisation. Internal audit uses it to plan coverage over several years based on risk.
B
- BCMSBusiness continuity management system
- The policies, roles, processes and records an organisation uses to plan, run, review and improve business continuity. ISO 22301 sets out the requirements for a BCMS.
- BIABusiness impact analysis
- The analysis of how a disruption to each process or service would affect the organisation over time. It sets recovery priorities and objectives such as RTO, RPO and MTPD, and maps the dependencies behind each process.
C
- CAPACorrective and preventive action
- Actions that remove the cause of a detected problem (corrective) or of a potential problem (preventive), usually raised from audit findings, incidents or exercises and tracked to closure.
- Concentration risk
- The risk that arises when many critical services depend on a single provider, or a small group of connected providers, so that one failure has a wide impact. DORA asks financial entities to assess it for ICT third-party arrangements.
- Control
- A measure that modifies risk: a policy, procedure, technical safeguard or check designed to prevent, detect or correct an unwanted event. Controls are linked to the risks and obligations they address and are tested for design and effectiveness.
- Critical or important function
- Under DORA, a function whose disruption would materially impair a financial entity's financial performance, the soundness or continuity of its services, or its continuing compliance with its authorisation and legal obligations. ICT arrangements supporting such functions carry stricter requirements.
- CSIRTComputer security incident response team
- A team that handles cybersecurity incidents. Under NIS2, each Member State designates national CSIRTs, which receive incident notifications and support entities in handling them.
D
- DORADigital Operational Resilience Act
- Regulation (EU) 2022/2554, applying since 17 January 2025 to EU financial entities. It covers ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk and information sharing.
E
- Essential and important entities
- The two categories of organisations in scope of NIS2, determined mainly by sector and size. Both must take cybersecurity risk-management measures and report significant incidents; essential entities are subject to proactive supervision, important entities mainly to supervision after the fact.
- Exception
- An approved, documented deviation from a policy, standard or control, recorded with its justification, the risk accepted, an owner and usually an expiry or review date.
- Exercise
- A planned activity that tests plans, people and systems against a scenario, from a tabletop discussion to a full technical failover. Results are compared with objectives and turned into improvement actions.
- Exit strategy
- A documented plan for leaving an arrangement with a third-party provider, for example after failure or termination, without unacceptable disruption. DORA requires exit strategies for ICT services supporting critical or important functions.
F
- Finding
- An issue identified by an audit, assessment or review, usually rated by severity and assigned an owner. Findings lead to agreed actions, often CAPAs, and are followed until closed.
I
- ICT third-party service provider
- Under DORA, an undertaking that provides ICT services, meaning digital and data services delivered through ICT systems on an ongoing basis, to a financial entity.
- Inherent risk
- The level of a risk before controls or other treatment are taken into account.
- ISMSInformation security management system
- The policies, processes, roles and controls an organisation uses to manage information security risk systematically. ISO/IEC 27001 sets out the requirements for an ISMS.
K
- KRIKey risk indicator
- A metric that signals a change in the level of a risk, with thresholds that trigger attention or action before the risk materialises.
M
- MTPDMaximum tolerable period of disruption
- The time after which the impact of a process not resuming becomes unacceptable. The RTO must be shorter than the MTPD.
N
- NIS2
- Directive (EU) 2022/2555 on a high common level of cybersecurity across the Union. Member States transpose it into national law; it sets risk-management and incident-reporting obligations for essential and important entities.
O
- Obligation
- A specific requirement an organisation must meet, derived from a law, regulation, standard or contract. Obligations are mapped to the controls, policies and owners that fulfil them.
P
- Playbook
- A predefined set of response steps for a type of incident or event, with roles and tasks assigned in advance so the response starts quickly and consistently.
R
- Register of information
- The register DORA requires financial entities to keep of all contractual arrangements for ICT services provided by ICT third-party service providers, including the functions they support and their criticality.
- Residual risk
- The level of a risk that remains after controls and other treatment, compared against risk appetite to decide whether it can be accepted.
- Risk appetite
- The amount and type of risk an organisation is willing to pursue or accept to achieve its objectives, set by the management body and translated into limits and tolerances.
- RPORecovery point objective
- The maximum amount of data loss, measured in time, that a process can tolerate. It determines how often data must be backed up or replicated.
- RTORecovery time objective
- The target time within which a process or system must be resumed after a disruption, at an agreed minimum level of service.
S
- Significant incident
- Under NIS2, an incident that has caused or can cause severe operational disruption or financial loss for the entity, or considerable damage to others. Significant incidents are reported in stages: early warning, incident notification and final report.
- SoAStatement of applicability
- An ISO/IEC 27001 document listing the controls an organisation has determined to be necessary, why they are included, whether they are implemented, and why any Annex A controls are excluded.
T
- TLPTThreat-led penetration testing
- A controlled test that mimics the tactics of real attackers, based on threat intelligence, against the live production systems behind critical functions. Under DORA, financial entities identified by their competent authority must carry one out at least every three years.
- TPRMThird-party risk management
- The process of identifying, assessing, monitoring and controlling the risks of relying on suppliers and other third parties, from onboarding and due diligence to periodic review and exit.
W
- War room
- A dedicated crisis command space, physical or virtual, where the people managing a major incident coordinate decisions, communication and tasks in one place.
See ILSERIS in action.
A focused walkthrough, built around your regulatory landscape and operating model.