Glossary

At risk
An SLA item approaching its configured deadline.
Breached
An SLA item past its configured deadline.
Catalogue release
An immutable imported version of the SCF reference catalogue. One release is active at a time.
Claim
A named RiskVault capability, often inherited through a policy and role.
Compliance snapshot
An immutable point-in-time record of a risk's framework-mapping footprint; not a compliance or effectiveness judgment.
Control link
A risk-to-control mapping that pins the control version current when the link was created.
DPoP
Proof-of-possession protection that ties an access token to the client's private key, reducing the usefulness of a stolen token.
Files / Links / Tags
The always-available risk tab for attachments, Jira, related risks, and custom tags.
General retention period
The organization-wide number of days after the retention anchor date before manual deletion becomes eligible when no legal hold applies.
Inherent risk
Exposure before controls or treatment are considered.
Legal hold
Protection applied to a risk that blocks deletion while active and can optionally trigger permanent deletion after all holds expire.
MCP
Model Context Protocol, used by an approved external AI client to call bounded RiskVault tools with a user's delegated access.
Platform control
A versioned, organization-owned control such as CTL-0042, adopted from the catalogue or created in-house.
Policy
A reusable bundle of claims.
Quick edit
A field changed directly from Details through its pencil control.
Rating band
A named and colored score range such as Low, Medium, High, or Critical.
Re-affirm
Explicitly update a control link to the control's current version.
Residual risk
Exposure remaining after treatment or controls.
Retention anchor date
The first date a risk reaches Closed, Rejected, or Archived. Reopening clears it; a later terminal state sets a new anchor.
Risk owner
The person accountable for the risk.
Risk matrix
The likelihood-by-impact grid that converts two scores into a rating band.
Role
A job function connected to one or more policies.
RR number
The permanent human-readable risk reference assigned after creation.
SLA
A time target for work in a workflow state.
Soft delete
Hiding a record from normal use while retaining it for possible restoration.
Tolerance approver
The governance decision-maker for an accept-within-tolerance recommendation.
Treatment approver
The person authorized to approve a treatment plan.
Watcher
A user following a risk for updates.
Workflow phase
A broad group of related workflow states, such as Treatment or Monitoring.
Workflow rule
A trigger, condition tree, and one or more automated actions.
Workflow state
The risk's precise processing status, such as Draft or Under Review.