Compliance & Security Glossary

The Payment Card Industry Data Security Standard — requirements every organisation handling card data must meet. Current: v4.0.1.

A person/company certified by the PCI Council to perform PCI DSS assessments and produce a Report on Compliance.

The formal report a QSA produces after assessing a larger merchant or service provider against PCI DSS.

A signed summary confirming the outcome of a PCI DSS assessment, shared with banks and partners.

A self-validation tool for smaller merchants. The right type depends on how you handle card data.

The PCI standard covering 3-D Secure, the cardholder authentication step used in online payments.

A qualified assessor certified to evaluate organisations against the PCI 3DS standard.

The SWIFT Customer Security Programme — controls for organisations connected to the SWIFT banking network.

The international standard for an Information Security Management System (ISMS). Current: 2022.

Information Security Management System — the policies, processes and controls you use to manage security.

The document listing which ISO 27001 controls you’ve applied and why — central to certification.

A privacy extension to ISO 27001, covering personal information management (a PIMS).

The first international standard for an AI Management System — responsible governance of AI.

The qualified auditor who conducts an ISO certification audit and recommends the certification decision.

The lighter annual check, between full certifications, confirming you’re maintaining your management system.

The ISO principle that a management system should keep getting better over time — not just pass once.

An AICPA report on a service organisation’s controls for security, availability, confidentiality, processing integrity and privacy.

The five categories a SOC 2 report can cover (security is always included).

Type I assesses control design at a point in time; Type II assesses operating effectiveness over a period.

The New Zealand Information Security Manual — the government baseline for protecting official information.

An Australian set of eight baseline strategies to mitigate cyber security incidents.

An early review comparing your current controls to a standard, identifying what’s missing.

The work of fixing the gaps found, so you can meet the standard.

The principle that an assurance provider must be free of conflicts of interest — central to a credible audit.