Glossary term
Compliance mapping
Also: Regulatory mapping, Control mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Compliance mapping is the connective tissue between a decision and the regulatory framework it sits inside. A memo that says the decision is DORA-compliant without mapping to Art. 5, Art. 28 or Art. 30 is not actually audit-ready; the auditor will ask which article exactly.
Usable mapping lists the article or control in full, summarises the expectation in one sentence, and states which part of the decision satisfies it, with a link to the evidence. If the same decision maps to multiple frameworks (DORA plus NIS2 plus ISO 27001), the mapping is layered, not duplicated.
In practice
In DecisionOS, compliance mapping is a first-class field on each memo so the same structural data drives the audit view, the board view and the vendor-due-diligence view without rework.
Related terms
DORA ICT risk management
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).
NIS2 Art. 20
The NIS2 article that makes the management body of an essential or important entity directly accountable for approving and overseeing cybersecurity risk-management measures. Management bodies that fail this duty can be held personally liable.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
CASB
Security layer between users and SaaS providing visibility (shadow IT discovery), data protection (DLP), compliance, and threat protection across SaaS apps. Four functions per Gartner: visibility, compliance, data security, threat protection.
CNAPP
Gartner platform category that combines CSPM, CWPP, CIEM, KSPM, DSPM and IaC scanning into one tool. Answer to tool fragmentation in cloud security stacks.
Confidential Computing
Hardware-based isolation that keeps data encrypted during processing (data-in-use). Complements encryption at rest and in transit. Technologies: Intel SGX, Intel TDX, AMD SEV-SNP, ARM CCA, Nvidia H100 Confidential Computing.
Critical ICT Third-Party Provider (CTPP)
ICT third-party provider designated critical by the European Commission under DORA Art. 31, falling under direct supervision of one of the three European Supervisory Authorities (EBA, EIOPA, ESMA). First CTPP designations expected in 2025/2026.
CSPM
Software category for continuous review of cloud configurations against security benchmarks (CIS, NIST, BSI cloud requirements). Finds misconfigurations like open S3 buckets, missing encryption, insecure IAM policies.