Glossary

Terms used in registers, assessments and treatment plans.

Access: member.

Term	Definition
Activity	Business process supported by resources and vendors.
Criticality	Importance of a subject to the organization and potential impact of its failure.
Vendor	Third party tracked for its services and dependencies.
Assessment	Workflow associating a subject, scope and questionnaires.
Questionnaire	Structured set of questions to answer or reuse in an assessment.
Campaign	Intended grouping of assessments; dedicated screens are under construction in this version.
Framework	Set of requirements used as a basis for compliance tracking.
Requirement	Expected outcome that applies to an organization within a defined scope.
Control	Action or safeguard used to meet a requirement or treat a risk.
Evidence	Document or information demonstrating implementation or effectiveness of a control.
Initial risk	Risk level assessed before considering planned treatment.
Residual risk	Risk remaining after treatment measures are considered.
Incident	Event to qualify, track and close based on its impacts.
Crisis	Situation requiring exceptional coordination and decisions.
Exemption	Temporary acceptance of a deviation, with conditions and an expiry date.
Dependency	Relationship between an activity and supporting vendors or resources.
Concentration	Significance of a common dependency across multiple activities or vendors.
ASM	Attack surface management: scopes, exposed assets and findings.
Trust Center	Area for presenting and sharing trust information according to configured access.
TLP	File distribution level that complements access permissions.
Role	Permission assigned to a member or a resource user.
Team	Group of members with whom resources may be shared.

See Permissions and sharing and Availability to distinguish access, plans and activation.