Term Kind Topic What it is
Legal Hold practice Records Retention & Legal Hold Suspending deletion for specific records because of anticipated litigation or investigation, which must override the retention schedule and be provable.
Material Outsourcing Notification practice Sector Cloud Rules The regulatory obligation to inform a supervisor before placing a critical function with a third party, which puts cloud adoption on a timeline architecture must respect.
Obligation Mapping practice Regulatory & Data Protection Architecture Translating each legal or regulatory requirement into the specific design constraints it imposes, so that compliance becomes a set of testable properties rather than a document.
Provider Exit Plan practice Exit & Concentration Risk A documented and tested plan for moving a workload off a provider, whose credibility is measured by what has actually been rehearsed rather than described.
Scope Reduction practice PCI-DSS Scoping Shrinking the set of systems that store, process or transmit cardholder data, because the cost of the standard is proportional to the number of systems in scope.
Subject Access Fulfilment practice Data Subject Rights The operational path from a request to a complete, verified, delivered response within the statutory period, across systems that were never designed for it.