Glossary of information security and compliance

A

Actively exploited vulnerability

Under the Cyber Resilience Act (CRA), a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without the owner's permission. The manufacturer must report it within 24 hours.

More: CRA vulnerability reporting

Annex A controls

The list of information security controls in Annex A of ISO/IEC 27001:2022, grouped as organisational, people, physical and technological. The organisation selects them on the basis of its risk assessment and justifies the selection in the Statement of Applicability.

More: ISO 27001 and NIS2

Asset register

An inventory of information and other assets – hardware and software, data, services, people and locations – with owners and valuation. It is required by ISO/IEC 27001 and supports the asset management measures of NIS2 (Article 21(2)(i)).

More: ISO 27001 implementation

B

Business continuity

The capability of an organisation to continue delivering products and services within acceptable time frames at a predefined capacity during a disruption (ISO 22301).

More: ISO 22301

Business impact analysis (BIA)

An analysis of how a disruption affects the organisation's activities over time. Under ISO 22301 it is the basis for priorities and for setting the MTPD, RTO and RPO; it supports the business continuity measures required by NIS2 (Article 21(2)(c)).

More: ISO 22301

C

CE marking

The marking by which a manufacturer declares that a product meets the applicable EU requirements. Under the CRA, products with digital elements must bear it from 11 December 2027.

More: CRA for manufacturers

Certification audit

An audit in which an independent accredited certification body determines whether a management system meets the requirements of the standard. It has two stages: first a review of documentation and readiness, then of how the system works in practice.

More: ISO 27001 implementation

Coordinated vulnerability disclosure (CVD)

A process in which a reporter notifies the manufacturer of a vulnerability, and the manufacturer fixes it and discloses it publicly in coordination with the reporter. Under the CRA, manufacturers must have a coordinated vulnerability disclosure policy.

More: CRA for manufacturers

CSIRT

Computer security incident response team. Under NIS2, entities report significant incidents to the competent CSIRT; under the CRA, manufacturers submit reports through the single reporting platform to the competent CSIRT.

More: NIS2 in Slovenia

E

Essential entity

An entity classified as essential under NIS2 (Article 3(1)) – mainly large entities in sectors of high criticality (Annex I) and certain entities regardless of size. Proactive supervision and higher maximum fines apply.

More: Is your company in scope of NIS2?

G

Gap analysis

A comparison of an organisation's current state with the requirements of a standard or regulation. The result is a list of gaps and an action plan to close them.

More: ISO 27001 implementation

I

Important entity

An entity in scope of NIS2 that does not qualify as an essential entity (Article 3(2)). Supervision after the fact and lower maximum fines apply.

More: Is your company in scope of NIS2?

Information security management system (ISMS)

The part of an organisation's management system that establishes, implements, maintains and improves information security on the basis of risks. Its requirements are set by ISO/IEC 27001.

More: ISO 27001 implementation

Internal audit

An audit by which the organisation checks at planned intervals whether its management system meets the requirements and is effectively implemented (clause 9.2 of ISO management system standards). The auditor must be objective and impartial.

More: vCISO and maintenance

M

Management review

A review of the management system carried out by top management at planned intervals to ensure its continuing suitability, adequacy and effectiveness (clause 9.3 of ISO management system standards).

More: ISO 27001 implementation

MTPD

Maximum tolerable period of disruption – the time after which the impact of not resuming an activity would become unacceptable to the organisation (ISO 22301).

More: ISO 22301

P

Product with digital elements

Under the CRA, a software or hardware product and its remote data processing solutions, including components placed on the market separately.

More: CRA for manufacturers

R

Registration (NIS2)

The obligation of entities to submit their details to the competent authority so that it can establish the list of essential and important entities (NIS2 Article 3(4)). In Slovenia, registration with URSIV is due within 30 days of meeting the criteria.

More: Is your company in scope of NIS2?

RPO

Recovery point objective – the point to which data must be restored so that an activity can resume after a disruption; it expresses the maximum acceptable data loss.

More: ISO 22301

RTO

Recovery time objective – the time after a disruption within which products, services, activities or resources must be resumed. It must be shorter than the MTPD.

More: ISO 22301

S

SBOM

Software bill of materials – a record of the components and dependencies a product is made of. Under the CRA, the manufacturer prepares it as part of the technical documentation.

More: CRA for manufacturers

Severe incident (CRA)

An incident affecting the security of a product with digital elements – for example one that reduces its ability to protect the availability, authenticity, integrity or confidentiality of data or functions. The manufacturer must report it within 24 hours.

More: CRA vulnerability reporting

Significant incident (NIS2)

An incident with a significant impact on the provision of an entity's services under NIS2. It is reported to the CSIRT or competent authority: early warning within 24 hours, notification within 72 hours, final report within one month (Article 23).

More: NIS2 in Slovenia

Statement of Applicability (SoA)

A document that states, for each Annex A control of ISO/IEC 27001, whether it applies, why it is included or excluded, and whether it has been implemented.

More: ISO 27001 implementation

Support period

Under the CRA, the period during which the manufacturer ensures effective handling of the product's vulnerabilities – generally at least five years.

More: CRA for manufacturers

U

URSIV

The Government Information Security Office of the Republic of Slovenia – the Slovenian competent authority for NIS2, which runs registration and supervision of entities, and the central point for implementing the CRA in Slovenia.

More: Supervision by URSIV

V

vCISO

An external (virtual) chief information security officer who leads an organisation's information security programme on a subscription basis. Formal decisions remain with the organisation's management.

More: vCISO and maintenance