Glossary¶

At risk: An SLA item approaching its configured deadline.
Auto-accept on provisioning: Recording Terms of Use acceptance for a new account when it is created by User Import, SCIM, or first external sign-in. Governed by an organization-wide default plus per-import and per-connector overrides.
Breached: An SLA item past its configured deadline.
Catalogue release: An immutable imported version of the SCF reference catalogue. One release is active at a time.
Claim: A named RiskVault capability, often inherited through a policy and role.
Compliance snapshot: An immutable point-in-time record of a risk's framework-mapping footprint; not a compliance or effectiveness judgment.
Control link: A risk-to-control mapping that pins the control version current when the link was created.
DPoP: Proof-of-possession protection that ties an access token to the client's private key, reducing the usefulness of a stolen token.
Files / Links / Tags: The always-available risk tab for attachments, Jira, related risks, and custom tags.
General retention period: The organization-wide number of days after the retention anchor date before manual deletion becomes eligible when no legal hold applies.
Inherent risk: Exposure before controls or treatment are considered.
Legal hold: Protection applied to a risk that blocks deletion while active and can optionally trigger permanent deletion after all holds expire.
MCP: Model Context Protocol, used by an approved external AI client to call bounded RiskVault tools with a user's delegated access.
Platform control: A versioned, organization-owned control such as CTL-0042, adopted from the catalogue or created in-house.
Policy: A reusable bundle of claims.
Quick edit: A field changed directly from Details through its pencil control.
Rating band: A named and colored score range such as Low, Medium, High, or Critical.
Re-affirm: Explicitly update a control link to the control's current version.
Resources card: The panel on a risk listing its five assigned people (owner, reviewer, action owner, treatment approver, tolerance approver), shown when resource reassignment is enabled.
Residual risk: Exposure remaining after treatment or controls.
Retention anchor date: The first date a risk reaches Closed, Rejected, or Archived. Reopening clears it; a later terminal state sets a new anchor.
Risk owner: The person accountable for the risk and responsible for its treatment work. Being named owner gives full access to that risk, so only someone already able to do the treatment work can be chosen.
Risk matrix: The likelihood-by-impact grid that converts two scores into a rating band.
Role: A job function connected to one or more policies.
RR number: The permanent human-readable risk reference assigned after creation, such as RR26-00042: the two-digit year, then a number that restarts each year.
SLA: A time target for work in a workflow state.
SLA deadline: The date the workflow sets automatically for the step a risk is on now. It drives SLA Status and is a different clock from the Target Date.
Soft delete: Hiding a record from normal use while retaining it for possible restoration.
Target Date: The date your team is aiming to finish by, entered by a person.
Terms & Privacy version: The short version string in Organization Settings that turns on Terms of Use re-acceptance and identifies the current legal wording. Changing it prompts every user to accept again; clearing it turns the requirement off.
Tolerance approver: The governance decision-maker for an accept-within-tolerance recommendation.
Treatment approver: The person authorized to approve a treatment plan.
Treatment Due: The date set for the treatment work itself, once treatment is under way.
Watcher: A user following a risk for updates.
Workflow phase: A broad group of related workflow states, such as Treatment or Monitoring.
Workflow rule: A trigger, condition tree, and one or more automated actions.
Workflow state: The risk's precise processing status, such as Draft or Under Review.