Technology & Standards Glossary
Plain-language definitions of the standards, regulations, and technologies our clients work with — each with related standards, free tools, and further reading.
Information Security & Compliance
Frameworks, standards, and EU regulations for managing information security risk and demonstrating compliance.
ISO/IEC 27001
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS, and is the standard organizations certify against to prove they manage information security systematically.
ISO/IEC 27002
ISO/IEC 27002 is the international guidance standard that describes each of the 93 information security controls referenced by Annex A of ISO/IEC 27001 — what the control is, what it is for, and how to implement it.
ISMS (Information Security Management System)
An information security management system (ISMS) is the set of policies, processes, people, and technology an organization uses to manage risks to the confidentiality, integrity, and availability of its information — run as a continuous cycle rather than a one-off project.
Statement of Applicability (SoA)
The Statement of Applicability (SoA) is the mandatory ISO/IEC 27001 document that lists all 93 Annex A controls and records, for each one, whether it is included in your ISMS, why, and its implementation status.
SOC 2
SOC 2 is an attestation framework from the AICPA under which an independent CPA firm reports on whether a service organization’s controls meet the Trust Services Criteria — Security plus optional Availability, Processing Integrity, Confidentiality, and Privacy categories.
Trust Services Criteria (TSC)
The Trust Services Criteria are the AICPA control framework that SOC 2 reports are evaluated against — organized into five categories: Security (the mandatory Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy.
DORA (Digital Operational Resilience Act)
DORA — Regulation (EU) 2022/2554 — is the EU law on digital operational resilience for the financial sector. It has applied since 17 January 2025 and imposes binding requirements on ICT risk management, incident reporting, resilience testing, and third-party technology oversight.
GDPR (General Data Protection Regulation)
The GDPR — Regulation (EU) 2016/679 — is the EU’s data protection law. It governs how organizations collect, use, store, and share personal data, grants individuals enforceable rights over their data, and allows fines of up to €20 million or 4% of global turnover.
NIS2 Directive
NIS2 — Directive (EU) 2022/2555 — is the EU’s cybersecurity law for essential and important entities. It mandates risk-management measures, incident reporting with a 24-hour early-warning deadline, and personal accountability for management bodies across 18 critical sectors.
Gap Analysis
A gap analysis is a structured comparison of your organization’s current practices against the requirements of a target standard or framework — ISO 27001, ISO 9001, ISO/IEC 42001, SOC 2 — producing a prioritized list of what is missing or incomplete.
Risk Assessment (Information Security)
An information security risk assessment is the systematic process of identifying threats and vulnerabilities affecting your information assets, evaluating their likelihood and impact, and deciding which risks to treat, accept, transfer, or avoid.
Zero Trust
Zero Trust is a security model that removes implicit trust from networks: every access request is authenticated, authorized, and continuously validated based on identity, device posture, and context — never on network location.
AI Governance
Standards and regulation for developing, deploying, and managing artificial intelligence responsibly.
ISO/IEC 42001
ISO/IEC 42001 is the first international standard for AI management systems (AIMS). Published in December 2023, it specifies requirements for governing the development and use of AI — policies, risk assessment, lifecycle controls, and accountability — and is certifiable like ISO 27001.
AIMS (AI Management System)
An AI management system (AIMS) is the set of policies, processes, and controls an organization uses to govern the development, procurement, deployment, and retirement of AI systems — the AI equivalent of an ISMS for security or a QMS for quality.
EU AI Act
The EU AI Act — Regulation (EU) 2024/1689 — is the world’s first comprehensive AI law. It applies a risk-based regime: unacceptable-risk practices are banned, high-risk AI systems carry strict obligations for providers and deployers, and limited-risk systems face transparency duties, with phased application from February 2025.
Payments & Financial Messaging
Standards, message types, and identifiers that move money and financial data between institutions.
ISO 20022
ISO 20022 is the global standard for financial messaging — a common XML-based language for payments, securities, cards, and trade data exchanged between financial institutions. It is replacing the legacy SWIFT MT formats, with the MT/MX coexistence period ending in November 2026.
SEPA (Single Euro Payments Area)
SEPA — the Single Euro Payments Area — harmonizes euro payments across 36+ countries so that a credit transfer or direct debit between any two SEPA accounts works like a domestic payment: same formats, same rulebooks, same fees.
IBAN (International Bank Account Number)
The IBAN is the international standard for identifying bank accounts — up to 34 characters starting with a country code and two MOD-97 check digits, defined by ISO 13616 and required for all SEPA payments.
BIC (Business Identifier Code)
The BIC — also called a SWIFT code — is the ISO 9362 standard identifier for financial institutions: 8 or 11 characters encoding the institution, country, location, and optionally the branch, used to route international payments.
LEI (Legal Entity Identifier)
The LEI is the ISO 17442 standard 20-character identifier for legal entities in financial transactions — a globally unique code linking an entity to reference data about who it is and, via parent relationships, who owns it.
MT940 (SWIFT Customer Statement)
MT940 is the SWIFT MT format for end-of-day bank account statements — a tagged-field text message (:20:, :25:, :60F:, :61:, :86:, :62F:) that treasuries and ERPs have consumed for decades, now being replaced by ISO 20022 camt.053.
camt.053 (Bank-to-Customer Statement)
camt.053 is the ISO 20022 XML message for bank-to-customer account statements — the structured successor to SWIFT MT940, carrying balances, entries, and remittance data in machine-readable form.
pain.001 (Credit Transfer Initiation)
pain.001 is the ISO 20022 message a customer sends to its bank to initiate credit transfers — the file format behind SEPA SCT batch uploads generated by ERPs and payroll systems.
pain.008 (Direct Debit Initiation)
pain.008 is the ISO 20022 message a creditor sends to its bank to collect SEPA direct debits — each transaction carrying the mandate ID and signature date that authorize pulling money from the debtor’s account.
pacs.008 (FI-to-FI Credit Transfer)
pacs.008 is the ISO 20022 interbank message that carries a customer credit transfer between financial institutions — the bank-to-bank leg of what a customer initiates with a pain.001 file.
MiCA (Markets in Crypto-Assets Regulation)
MiCA — Regulation (EU) 2023/1114 — is the EU’s comprehensive crypto-asset framework: it licenses crypto-asset service providers (CASPs), regulates stablecoin issuance with reserve and redemption rules, and imposes white-paper disclosure and market-abuse requirements.
PSD2 (Revised Payment Services Directive)
PSD2 — Directive (EU) 2015/2366 — is the EU law that opened bank payment accounts to licensed third parties (open banking), mandated strong customer authentication (SCA) for electronic payments, and created the licensing framework for payment institutions.
Digital Identity & Trust
The EU trust framework, verifiable credentials, and decentralized identity technologies.
eIDAS (Electronic Identification and Trust Services)
eIDAS is the EU regulation on electronic identification and trust services — the legal framework for e-signatures, e-seals, timestamps, and national eID schemes. The 2024 update (eIDAS 2.0, Regulation (EU) 2024/1183) adds the European Digital Identity Wallet.
EUDI Wallet (European Digital Identity Wallet)
The EUDI Wallet is the digital identity wallet every EU member state must make available under eIDAS 2.0 — a smartphone app holding verified identity attributes and qualified attestations as verifiable credentials, presentable to services across the EU.
Verifiable Credentials (VC)
Verifiable credentials are cryptographically signed digital attestations defined by the W3C VC data model — an issuer signs claims about a holder, and a verifier can check authenticity and integrity without contacting the issuer.
DID (Decentralized Identifier)
A decentralized identifier is a W3C-standard, globally unique identifier controlled by its subject rather than a central registry — resolvable to a DID document containing the public keys and service endpoints needed to verify signatures and interact.
EBSI (European Blockchain Services Infrastructure)
EBSI is the EU’s cross-border blockchain infrastructure — a network of nodes operated by member states delivering public services, best known for its verifiable-credentials trust model used in diploma, identity, and trusted-data pilots.
Blockchain & Web3
Distributed ledger technology, smart contracts, and the networks our products are built on.
Blockchain / DLT
A blockchain is a distributed ledger: an append-only record replicated across nodes, where transactions are batched into cryptographically linked blocks and consensus rules — not a central operator — decide the shared state.
Smart Contract
A smart contract is a program stored on a blockchain that executes deterministically when called — enforcing rules and moving assets without an intermediary, and without the possibility of post-deployment edits.
Stellar (Network)
Stellar is an open-source layer-1 blockchain optimized for payments and asset issuance — fast finality, low fees, a built-in decentralized exchange, and an anchor model connecting fiat currencies to on-chain assets.
Keccak-256
Keccak-256 is the 256-bit cryptographic hash function Ethereum uses everywhere — transaction hashes, addresses, event topics, and function selectors are all Keccak-256 digests.
ABI (Application Binary Interface)
The ABI is Ethereum’s contract calling convention: calldata is a 4-byte function selector (the Keccak-256 prefix of the function signature) followed by arguments encoded in 32-byte words — and the JSON ABI is the machine-readable description of that interface.
Wei (Ether Denomination)
Wei is the smallest denomination of ether — 1 ETH equals 10^18 wei. Gas prices are quoted in gwei (10^9 wei), and Ethereum tooling works in wei to avoid floating-point error.
Zero-Knowledge Proof (ZKP)
A zero-knowledge proof lets a prover convince a verifier that a statement is true without revealing the underlying data — enabling private transactions, selective disclosure, and off-chain computation verified on-chain.
Healthcare Interoperability
Standards for exchanging clinical and administrative health data between systems.
HL7 v2 (Health Level Seven)
HL7 v2 is the pipe-delimited messaging standard that still powers most hospital interoperability — ADT admissions, ORU results, ORM orders exchanged as segments (MSH, PID, PV1, OBR, OBX) between clinical systems.
FHIR (Fast Healthcare Interoperability Resources)
FHIR is HL7’s modern healthcare interoperability standard: clinical data is modeled as resources (Patient, Observation, Encounter, MedicationRequest…) exchanged as JSON or XML over REST APIs — the format behind national patient-access APIs and SMART health apps.
Quality & Management Systems
Management system standards and the methods used to implement and integrate them.
ISO 9001
ISO 9001 is the international standard for quality management systems (QMS) — the requirements for consistently delivering products and services that meet customer and regulatory requirements, with certification through accredited bodies.
QMS (Quality Management System)
A quality management system is the framework of policies, processes, and responsibilities an organization runs to consistently meet customer and regulatory requirements — ISO 9001 is the standard that defines what a conforming QMS requires.
IMS (Integrated Management System)
An integrated management system combines two or more management standards — typically ISO 9001, ISO 27001, and ISO 42001 — into one system that shares policies, audits, document control, and management reviews instead of running parallel structures.
PDCA (Plan-Do-Check-Act)
PDCA — Plan, Do, Check, Act — is the continuous-improvement cycle behind every ISO management system: plan objectives and controls, implement them, monitor and audit the results, then act on findings and repeat.
Data Formats & Identifiers
Formats and identifiers used to structure, validate, and exchange data.
ISO 8601 (Date and Time Format)
ISO 8601 is the international standard for representing dates and times unambiguously — YYYY-MM-DD, the T separator, time-zone offsets, durations like P1Y2M, week dates, and intervals. RFC 3339 is the strict internet subset used in APIs.
XML (Extensible Markup Language)
XML is the W3C markup language for structured documents — elements, attributes, namespaces — that underpins standards from ISO 20022 payment files and SCORM manifests to SOAP services, XSD schemas, and sitemaps.
XSD (XML Schema Definition)
XSD is the W3C schema language that defines what a valid XML document looks like — allowed elements and attributes, order, cardinality, and datatypes — the mechanism used to validate ISO 20022 payment files and other regulated XML.
XPath
XPath is the W3C query language for addressing parts of an XML document — paths like /Document/CstmrCdtTrfInitn/PmtInf, predicates, and functions used in testing, extraction, transformation, and validation.
JSON (JavaScript Object Notation)
JSON is the dominant data-interchange format for web APIs — objects, arrays, strings, numbers, booleans, null — standardized by RFC 8259 and ECMA-404, and the serialization behind REST APIs, FHIR resources, and most modern configuration.
CSV (Comma-Separated Values)
CSV is the lowest-common-denominator tabular format — one record per line, fields separated by commas — defined loosely by RFC 4180 and still the default exchange format for CRM imports, bank exports, and bulk operations.
vCard (.vcf)
vCard is the standard electronic business-card format — .vcf files with properties like FN, TEL, EMAIL, and ORG — defined by RFC 6350 and understood by every phone, mail client, and CRM.
GTIN (Global Trade Item Number)
GTIN is the GS1 identifier for trade items — the number under every retail barcode. It comes in 8, 12, 13, and 14-digit variants (EAN-8, UPC-A, EAN-13, GTIN-14) and ends with a mod-10 check digit.
E.164 (International Phone Number Format)
E.164 is the ITU-T international numbering plan — the +country-code format (max 15 digits) behind tel: links, SMS routing, and every CRM that wants its phone fields to actually work.
TLE (Two-Line Element Set)
A TLE is the NORAD two-line format for satellite orbital elements — 69-character lines encoding catalog number, epoch, inclination, RAAN, eccentricity, and mean motion — still the standard way satellite tracking data circulates.
Enterprise IT & Cloud
Cloud, integration, and customer operations concepts used in day-to-day enterprise IT.
IAM (Identity and Access Management)
IAM is the discipline of managing digital identities and what they may access — authentication (who you are), authorization (what you may do), and the policies binding them. In AWS it is the JSON policy language controlling every API call.
ARN (Amazon Resource Name)
An ARN is AWS’s standardized resource identifier — arn:partition:service:region:account-id:resource — the address used in IAM policies, logging, tagging, and infrastructure-as-code to point at exactly one resource.
OData (Open Data Protocol)
OData is the OASIS-standard REST protocol for queryable data APIs — URL conventions like $select, $filter, $expand, $orderby, $top, $skip that let clients shape responses server-side. SAP Gateway uses it across the enterprise landscape.
CRM (Customer Relationship Management)
CRM is the system of record for customer relationships — contacts, companies, deals/opportunities, activities, and increasingly support tickets in one place — the operational layer between marketing, sales, and service.
SLA (Service Level Agreement)
An SLA is the measurable commitment inside a service contract — uptime percentages, response and resolution time targets, and the remedies when they are missed — the numbers that drive helpdesk triage and vendor accountability.
E-Learning Standards
Packaging and tracking standards for digital learning content.
SCORM (Sharable Content Object Reference Model)
SCORM is the dominant e-learning packaging standard — a ZIP containing an imsmanifest.xml plus course assets that any compliant LMS can import, launch, and track (completions, scores, time) via a JavaScript API.
xAPI (Experience API)
xAPI — also known as Tin Can, standardized as IEEE 9274.1.1 — is the learning-record standard that tracks experiences as actor-verb-object statements (Alice completed Module 3) sent to a Learning Record Store, covering learning that happens outside an LMS.
Frequently Asked Questions
Who is this glossary for?
Clients, partners, and practitioners who work with the standards and technologies we implement — compliance teams preparing for ISO 27001 or DORA, engineers integrating ISO 20022 or HL7, and product teams navigating eIDAS, MiCA, and verifiable credentials.
Are these the official definitions?
No — these are practical summaries written for orientation. Each entry lists the related standards and regulations it is based on; for compliance work always refer to the official standard text. Where we have free tools or in-depth articles, they are linked from each page.
Can I request a term?
Yes — email us at hi@ogtechnologies.co or use the quote form if you want a walkthrough of how a standard or technology applies to your project.