Turn glossary cleanup into audit-ready terminology evidence.
Use these templates to find terminology drift, start a controlled vocabulary, and prepare evidence questions before a SOC 2, ISO, FDA, DORA, NIS2, GDPR, or AI Act review.
Choose a resource
Each resource is ungated. Use it as a worksheet, discovery artifact, or internal checklist before installing any tooling.
Review document control, approval, terminology consistency, change history, evidence export, and training records.
Collect ambiguous terms, owners, source references, preferred wording, and approval status before importing into a glossary.
Download starter CSVs for AI Act Article 3, SOC 2, and FDA terminology. Review internally before relying on them.
Controlled vocabulary intake worksheet
Use this field set when interviewing compliance, legal, security, QA, engineering, or HR/onboarding stakeholders.
| Field | Why it matters | Example |
|---|---|---|
| Term | Canonical approved wording. | Security incident |
| Definition | What reviewers should approve and writers should reuse. | A confirmed event affecting confidentiality, integrity, or availability. |
| Forbidden or deprecated wording | Terms that should trigger review. | Security event, alert |
| Source reference | Policy, regulation, control catalog, SOP, or owner-approved source. | Incident Response Policy, section 2 |
| Owner | Person or team accountable for the definition. | Security Governance |
| Approval status | Draft, review, approved, or deprecated. | Review |
| Evidence question | What an auditor or buyer may ask. | Where is this term used and who approved it? |
Terminology packets
Each packet can seed a terminology review. Your organization remains responsible for source review, approval, and applicability.
Starter terms for AI governance and legal ops teams managing AI policy language.
Starter terms for security, compliance, and audit-readiness teams.
Starter terms for controlled documentation and quality-system review.
Starter terms for ISMS, risk, controls, audit, and role alignment.
Starter terms for ICT risk, incidents, resilience testing, and third-party oversight.
Starter terms for entity scope, incident reporting, controls, and supervision.
Starter terms for privacy, security, breach notification, and enforcement review.
When the worksheet is not enough
If the same regulated term appears across Confluence pages, Jira tickets, and GitHub documentation, a static spreadsheet will not prove current usage. You need approved definitions, page scanning, version history, remediation evidence, and exportable audit records.