Glossary: cloud, security and compliance terms

Access control

Access control governs who may access which data and systems. It ensures users receive only the permissions they need for their task.

Authentication

Authentication is the process of verifying that a user, device or service really is who it claims to be. It is the foundation of every access control.

The BSI C5 (Cloud Computing Compliance Criteria Catalogue) is a criteria catalogue from Germany's Federal Office for Information Security that defines minimum requirements for secure cloud services. Providers demonstrate fulfilment through an attestation.

Business cloud storage

Business cloud storage is cloud storage built for companies: files are stored centrally on a provider's servers, access rights are set per team, an audit log makes access traceable and a data processing agreement governs the processing.

CIS (Center for Internet Security)

The Center for Internet Security (CIS) is a non-profit organisation that provides recognised IT security standards through the CIS Controls and CIS Benchmarks.

Compliance

Compliance means adhering to legal, regulatory and internal requirements. In the cloud it mainly concerns data protection, information security and evidence obligations.

Data encryption

Data encryption uses a key to turn readable data into unreadable ciphertext, so that only authorized parties with the matching key can read it again.

Data processing agreement (DPA)

A data processing agreement (DPA) governs, under Article 28 of the GDPR, how a service provider processes personal data on behalf of a company.

Data protection

Data protection covers all rules and measures that protect personal data from misuse and safeguard the right to informational self-determination.

Data security

Data security covers all technical and organisational measures that protect data from loss, manipulation and unauthorised access.

Data sovereignty

Data sovereignty is an organisation's full control over its data: where it is stored, who can access it and which law it is subject to.

Digital signature

A digital signature is the cryptographic method that technically secures electronic signatures: key pairs prove the authenticity and integrity of a document.

Digital sovereignty

Digital sovereignty is the ability of states, organisations and individuals to act self-determinedly in the digital world, without dependence on providers from third countries.

Document collaboration

Document collaboration means several people creating and editing documents together, ideally directly in the browser without local software.

DORA

DORA (Digital Operational Resilience Act) is an EU regulation that requires financial entities and their ICT providers to ensure digital operational resilience. It has applied since 17 January 2025.

eIDAS Regulation

The eIDAS Regulation is the EU legal framework for electronic identification and trust services, including electronic signatures.

Electronic signature

An electronic signature is a digital method for signing documents with legal effect. The eIDAS Regulation distinguishes three levels: simple, advanced and qualified.

Email encryption

Email encryption protects the content, and partly the metadata, of emails so that only authorised recipients can read them.

End-to-end encryption

With end-to-end encryption, data is encrypted so that only the sender and intended recipients can read it. Not even the provider can access the content.

Enterprise File Sync and Share (EFSS)

Enterprise File Sync and Share (EFSS) refers to business solutions that let employees synchronise files across devices and share them securely.

GDPR

The General Data Protection Regulation (GDPR) is the EU-wide law protecting personal data. Since 25 May 2018 it governs how organisations collect, store and process personal data.

GDPR-compliant cloud

A GDPR-compliant cloud is a cloud service that meets the requirements of the General Data Protection Regulation and processes personal data lawfully.

Identity and Access Management (IAM)

Identity and Access Management (IAM) covers the processes and technologies companies use to manage digital identities and control access to systems and data.

ISO/IEC 27001

ISO/IEC 27001 is the leading international standard for information security management systems (ISMS). It defines requirements for systematically protecting information; fulfilment is demonstrated through certification.

IT Security Made in Germany

IT Security Made in Germany is a trust mark from the TeleTrusT association for providers whose IT security solutions are developed and operated in Germany.

KRITIS

KRITIS stands for critical infrastructure, meaning facilities of particular importance to society. In Germany, their operators are subject to heightened IT security obligations.

Managed File Transfer (MFT)

Managed File Transfer (MFT) is the centrally managed, automated and secured exchange of files between systems, applications and partners.

Model Context Protocol (MCP)

The Model Context Protocol (MCP) is an open standard through which AI applications such as language models access external data sources, tools and services in a secure, structured way. Anthropic released MCP in November 2024.

Multi-factor authentication (MFA)

Multi-factor authentication (MFA) secures login with at least two independent factors, such as a password plus a one-time code, instead of a password alone.

NIS2 Directive

The NIS2 Directive is an EU directive to raise cybersecurity. It requires entities in important and essential sectors to implement risk management, reporting obligations and technical security measures.

Passwordless authentication

Passwordless authentication replaces passwords with more secure methods such as passkeys, biometrics or hardware tokens.

Principle of least privilege

The principle of least privilege states that every person and system should receive only the minimum access rights necessary.

Privileged Access Management (PAM)

Privileged Access Management (PAM) covers methods and tools to specially secure and monitor privileged accounts with far-reaching rights.

Qualified electronic signature (QES)

The qualified electronic signature (QES) is the highest level of electronic signature under eIDAS and is legally equivalent to a handwritten signature.

Real-time collaboration

Real-time collaboration means several people editing the same document simultaneously, with changes appearing instantly for everyone.

Retrieval-Augmented Generation (RAG)

Retrieval-Augmented Generation (RAG) is a method in which a language model retrieves relevant information from an external knowledge source before answering and incorporates it into the response.

Role-based access control (RBAC)

Role-based access control (RBAC) assigns access rights based on roles rather than per individual, keeping permissions clear and auditable.

Secure data exchange

Secure data exchange is the protected transfer of data and documents between internal and external partners, encrypted, controlled and traceable.

Secure file exchange

Secure file exchange means sharing files with internal and external partners in a protected way, encrypted and with controlled access rights.

Sending large files

Sending large files means transferring files that exceed email size limits, ideally encrypted and via controlled shares.

Single sign-on (SSO)

Single sign-on (SSO) lets users log in once and then access multiple applications without signing in again.

Sovereign AI

Sovereign AI refers to the use of artificial intelligence under full control over data, models and infrastructure, independent of providers from third countries and in line with European law.

Sovereign cloud

A sovereign cloud is a cloud service in which data, operations and control remain entirely within your own legal jurisdiction, independent of providers from third countries.

TISAX

TISAX (Trusted Information Security Assessment Exchange) is an assessment and exchange standard for information security in the automotive industry.

Trusted Cloud

Trusted Cloud is an initiative of Germany's Federal Ministry for Economic Affairs and Climate Action (BMWK) and a label that distinguishes trustworthy, transparent cloud services.

US CLOUD Act

The US CLOUD Act is a 2018 US law that lets US authorities access data held by US companies, regardless of where in the world that data is stored.

Versioning

Versioning keeps earlier states of a file so that changes are traceable and older versions can be restored.

Virtual data room (VDR)

A virtual data room (VDR) is a secured online environment where companies provide and share sensitive documents with selected partners in a controlled way.

Zero Trust

Zero Trust is a security model that trusts no user and no device automatically. Every access request is verified, whether it comes from inside the network or outside.

Glossary