The vocabulary, in plain words
Every term carries what it is and why a practitioner cares. The second line is the part that makes it usable. Free at every tier, because vocabulary is the first barrier into this work and the wrong thing to charge for.
E
- Evidence
-
An artefact showing that a control operated: dated, attributable, complete and produced when the control ran.
Contemporaneous is the property broken most often and in good faith. Evidence assembled when it is requested costs weeks and looks like what it is.
Taught in GRC-220 · See also: population, control-owner
I
- IT general controls ITGC
-
Controls over access to programs and data, program changes, program development and computer operations.
If they fail, an auditor cannot rely on any automated control running on those systems, however well designed.
Taught in GRC-230 · See also: Statement of Applicability, population
S
- Statement of Applicability SoA
-
The ISO 27001 document listing every Annex A control with whether it applies, the justification, and its implementation status.
It is referenced by the certificate and read first at every audit. Exclusions are expected; the justification has to be about relevance, not difficulty.
Taught in GRC-202 · See also: IT general controls, risk-treatment
Maintained by the association. A term here is a summary; the course named beside it is where the practice is taught.