Business Risk, Third Parties and Compliance

Glossary

179 terms from Business Risk, Third Parties and Compliance, in plain words, each with the chapter that teaches it.

Search the glossary

A

Acceptance criteria: The tests written into a statement of work that decide whether a vendor's work is finished and correct. For example, they set when Kettle & Crane can say Ridgeline's migration of the shop is done.
Acknowledgement: A statement signed by one person, often a tick box in a training system, saying they have received, read and understood a policy or course and will follow it. The business keeps it in its own records, as with Priya's acknowledgement of Data Handling Policy version 3.
Adequate procedures: Under the UK Bribery Act 2010, the anti-bribery measures (training is one of them) that can protect a company from guilt when someone acting for it pays a bribe.
Agreement: A written understanding between two or more parties about what each will do. Some agreements are binding contracts. Others, such as most MOUs, only record an intent.
AICPA (American Institute of Certified Public Accountants): The US accounting body whose standards independent accountants follow when they prepare SOC reports on a service organization's controls.
Amazon Web Services (AWS): Amazon's cloud computing platform, which rents out services such as EC2 virtual servers that customers use in place of their own hardware. Its EC2 service-level agreement (SLA) promises at least 99.99% monthly uptime per region and pays only service credits toward future bills when it falls short, not compensation for a customer's lost sales; its testing policy lets customers penetration test their own resources but not AWS's infrastructure or other customers, and forbids denial-of-service testing without approval.
AML/CTF (anti-money laundering/counter-terrorism financing): The laws, controls and training that stop a business from being used to launder criminal money or to fund terrorism. Sam spotting the North Pine Roasters cash red flags is an example.
Annualized loss expectancy (ALE): The money you expect to lose to one risk in an average year, worked out as SLE × ARO. Ransomware on the order server has an ALE of $20,000 × 0.2 = $4,000 a year.
Annualized rate of occurrence (ARO): How many times an event is expected to happen in one year. It is a frequency, not money: an event that happens once every five years has an ARO of 1 ÷ 5 = 0.2.
Anti-bribery: The laws, policies and training that stop staff from giving or taking bribes, including bribes paid through agents and vendors. Jo refusing the broker's $200 'speed fee' is an example.
Asset: Anything of value the business owns or uses, such as a laptop, the order server, the customer list or the online shop.
Asset value (AV): What an asset is worth in dollars, including the cost to replace it, the work to rebuild it and the sales lost while it is gone. Alex values the order server at $40,000.
Assurance mechanisms: Assurance is justified confidence that a vendor will do what it says. Assurance mechanisms are the ways a business gets that confidence (evidence such as attestations and audits) or protects itself if it proves wrong (warranties, indemnity, insurance, bonds, escrow).
Attestation: A formal signed statement that something is true, usually that a business, system or vendor meets a requirement. A responsible officer or an independent auditor signs it, and it is usually given to outsiders, as when Morgan signs Kettle & Crane's PCI DSS AOC.
Attestation of Compliance (AOC): A PCI DSS form in which a business that handles card data states that it meets the standard. Kettle & Crane keeps its payment company's AOC and sends its own to the payment company each year.
Audit: A formal check, based on evidence, against a set of requirements. In vendor monitoring it examines a vendor's internal controls, records and facilities.
Awareness training: General training in safe habits, such as spotting phishing. It differs from compliance training, which teaches duties that come from a law, regulation or contract and must be recorded.

B

Bank Secrecy Act: The main US anti-money-laundering law, enforced by FinCEN. Banks and other financial businesses must run a written AML program, check who their customers are and report suspicious activity.
Breach notification law: A law that says who must be told about a data breach, and by when. Oregon's law gives Kettle & Crane 45 days to tell affected people, and the business must also tell the Attorney General if more than 250 Oregon consumers are affected.
Bribery: Offering, giving, asking for or accepting anything of value (cash, gifts, meals, trips, a job for a relative) to improperly influence someone's decision.
Bridge letter: A vendor's statement that nothing important has changed since the end of the period its last SOC 2 report covered. It fills the gap until the next report.
Business associate agreement (BAA): The agreement HIPAA requires a healthcare provider to sign with any vendor that handles patients' health information.
Business partnership agreement (BPA): A contract between partners who run a business activity together, such as a joint venture. It covers ownership, how profits and decisions are shared and how the partnership ends, like an MOA with money and ownership at stake.

C

CAIQ (Consensus Assessments Initiative Questionnaire): A widely used standard security questionnaire from the Cloud Security Alliance for assessing a vendor's controls.
Certificate of destruction: Written proof from a vendor that it has securely erased or destroyed media. Alex adds one to SOW 1 so Ridgeline must wipe the old office server's disks and prove it.
CLOUD Act (Clarifying Lawful Overseas Use of Data Act): A 2018 US law under which US authorities can order a US vendor to hand over data it controls, even when the data is stored abroad.
Commercial bribery: Bribing an employee of another private company. Many US state and federal laws forbid it.
Complementary user entity controls: A section of a SOC 2 report listing what the customer must do for the vendor's controls to work, such as managing its own users' access.
Compliance: Following the laws, regulations, contracts and internal policies that apply to the business, and keeping records that prove it.
Compliance attestation: A formal statement or report that a vendor meets a named standard, such as a SOC 2 report, an ISO/IEC 27001 certificate or a PCI DSS AOC. The strongest come from independent auditors, and customers read them instead of auditing every vendor themselves.
Compliance monitoring: The ongoing checking that the business, its staff and its vendors actually follow the rules, plus keeping evidence of it. It uses training records, reviews, automated checks, acknowledgements and attestations.
Compliance training: Training, matched to each person's role, in the specific duties that come from laws, regulations or contracts. It is given at hiring, yearly and when rules change, with a quiz and a record of who took it.
Computer Fraud and Abuse Act: A US law that makes accessing a computer without authorization a crime. A pen test without the system owner's written permission can break it.
Conflict of interest: A personal interest, such as money, family, friendship or a future job, that could pull a decision-maker away from the business's best interest. It is handled by disclosing, assessing, recusing and recording, as when Jo steps aside because a relative works at Ridgeline.
Constraint: Anything that restricts what a business can do about third-party risk, such as too few people, too little money, a law, a location or a contract that is hard to leave.
Contract: An agreement that is legally binding, so a court will enforce it. A vendor only has to do what its contract says.
Cross-border data transfer: Moving data from one country to another, for example personal data leaving the European Union. It may need special legal terms, such as approved contract clauses, because the data then falls under another country's laws.
CSV: A standard spreadsheet file format. Service B lets Kettle & Crane export its contacts as CSV at any time, which reduces lock-in.
Cyber insurance: Insurance that covers losses from a breach. Due diligence checks whether a vendor carries it, and Alex requires Ridgeline to show proof of $1 million of cover.

D

Damages: Money a court orders one party to pay another for harm it caused, for example after a lawsuit over a broken contract or negligence.
Data classification: A policy that puts each kind of data in a class, such as public, internal or confidential. Data handling training then teaches what staff must do with each class.
Data handling: How staff collect, store, use, share, keep and destroy data under the rules for each kind of data. Data handling training follows the data through that life, as in Priya's team's 20-minute course.
Data portability: A contract clause saying the vendor returns all your data, in a standard format and within a set time, when the contract ends. For example, Ridgeline must return the shop's data within 15 days of exit.
Data processing agreement (DPA): An agreement that sets how a vendor may handle personal data on your behalf. Laws such as the GDPR require one with each vendor that processes personal data.
Data residency: The physical place where data is stored. Some laws and customers require it to stay in a given country, which is why Alex insists Ridgeline's backups stay in the US.
Deliverables: The things a vendor hands over under a statement of work, such as 'shop running on Ridgeline servers' or a migration report.
Denial-of-service: An attack that floods a system so it stops serving real users. Provider testing policies and Kettle & Crane's rules of engagement forbid it unless specially approved.
Due diligence: Checking a vendor carefully before you commit to it: its security evidence, finances, legal record, references, its own vendors and its insurance. Alex's reference call that uncovered Northfield's hidden breach was due diligence.

E

Egress fees: Charges a vendor, usually a cloud service, makes for taking your data out of its service. They are one cause of vendor lock-in.
Environment: The technical setting a vendor's service runs in (production or test, shared or dedicated, cloud or on-premises). It limits where and how you can check, test or change things.
Escrow: An arrangement in which a neutral third party holds a copy of code or keys you depend on and releases it to you if the vendor goes out of business.
Evidence of internal audits: A vendor's own audit team's reports and fix records, asked for as proof that its controls are being checked.
Exception: In a SOC 2 report, a control test that failed. Ridgeline's report notes two leavers' accounts removed late.
Exit plan: The steps, cost and time needed to move to another vendor, reviewed every year to reduce lock-in.
Exposure factor (EF): The share of an asset's value that one event destroys, written as a percentage or decimal. Ransomware wiping half the order server's value is an EF of 50% (0.5).
Expression of interest (EOI): The earliest, lightest selection step: a short notice asks which vendors want the work. Their brief replies help build a shortlist, with no prices yet.

F

Facilitation payment: A small payment to an official to speed up a routine action they must do anyway. The FCPA has a narrow exception for these, the UK Bribery Act has none, and most company policies forbid them.
FATF (Financial Action Task Force): The international body whose 40 Recommendations most countries follow when writing AML/CTF laws.
FCPA (Foreign Corrupt Practices Act): The US law against bribing foreign government officials to win or keep business. It also requires public companies to keep accurate books, and as of November 2026 it still applies in full.
FinCEN (Financial Crimes Enforcement Network): The part of the US Treasury Department that enforces the Bank Secrecy Act.
Form 8300: The IRS form any US business must file within 15 days when it receives more than $10,000 in cash in one payment or in related payments.
Fourth party: A vendor of your vendor, such as the data center company Ridgeline uses. Its risk reaches you one step further away.
FTC (Federal Trade Commission): The US agency that enforces the GLBA Safeguards Rule for many non-bank businesses.

G

GDPR (General Data Protection Regulation): The European Union regulation protecting the personal data of people in the EU. It matters to a US company only if the company sells to or tracks people there.
Geography: Where a vendor, its staff and your data physically are. Location affects which laws apply, as well as support hours and exposure to floods, earthquakes or political trouble.
Gift register: A log of gifts given and received, kept so anti-bribery rules can be checked.
Gifts and hospitality: Gifts, meals or tickets offered to decision-makers. During a bid they create a conflict of interest and may be bribery, so policies set value limits (for example, $75) and forbid gifts during bids.
GLBA (Gramm-Leach-Bliley Act): A US law that makes financial companies protect customers' financial data. Its Safeguards Rule also makes them oversee their service providers.

H

Hardware security key: A small physical device staff use to log in securely. Alex buys 14 identical keys by RFQ.
HIPAA (Health Insurance Portability and Accountability Act): A US law protecting health information, enforced by the Department of Health and Human Services. It requires a business associate agreement with each vendor that handles patients' health information.
Hosted payment page: A payment page run by the payment company, so card numbers go straight to it and never touch Kettle & Crane's or Ridgeline's servers. This keeps Kettle & Crane in the small SAQ A assessment.

I

Indemnity: A promise by one side to cover the other's losses from certain events, such as Ridgeline covering breaches it causes.
Independent assessment: A review by an outside party with no stake in the result, such as a SOC 2 auditor or a hired assessor.
Integration: The third stage of money laundering, when the money comes back looking clean, as business income or a property sale.
Internal attestation: An attestation signed by the business's own officer, such as a manager certifying each quarter that their team's access was reviewed, or SOX certification by a public company's top officers.
Invitation to bid: A formal request for prices on a fully specified job. It is closest to an RFQ.
IRS (Internal Revenue Service): The US tax agency, which receives Form 8300 reports of large cash payments.
ISA (interconnection security agreement): An agreement that sets the technical security terms when two organizations connect their networks.
ISO/IEC 27001: An international standard for information security management systems. A certificate from an accredited body shows a vendor meets it, usually for three years with a surveillance audit each year.

J

Jurisdiction: Which government's laws and courts have power over a vendor and its data. Data stored in a country is usually subject to that country's laws, and contracts name the courts that hear disputes.

K

Kickback: A payment back to the person who awarded a contract, often hidden in the vendor's price.
Know your customer (KYC): Checking who a customer really is before doing business, and watching for changes. It is the customer-side twin of vendor due diligence.

L

Law: A rule passed by a legislature, such as Congress or a state legislature.
Layering: The second stage of money laundering, when money is moved many times (transfers, overpayments and refunds, resold purchases) to hide where it came from.
Legal consideration: Any way the law, the courts or a contract can hold a business responsible for a risk, through deadlines, lawsuits or liability. A statute's deadline or a customer suing points to legal, not regulatory.
Legally binding: Enforceable by a court. Contracts such as an NDA, MSA, SOW or SLA are binding, while an MOU usually is not.
Liability: Being held responsible for harm and having to pay for it.

M

Master services agreement (MSA): A contract signed once that sets the general terms for all future work between two companies, such as security, liability, right to audit and termination. Short SOWs then sit under it, as with Kettle & Crane's MSA with Ridgeline.
Memorandum of agreement (MOA): A more formal document than an MOU that spells out each partner's specific duties and conditions, and may be binding in whole or in part. An example is the four businesses' loyalty-card MOA.
Memorandum of understanding (MOU): A document recording partners' shared intent to work together, usually not legally binding. An example is the two-page MOU Kettle & Crane and three cafés sign to explore a loyalty card.
Milestones: Dates for each stage of a project in a statement of work, often tied to payments.
Money laundering: Making money from crime look as if it came from a legal source, usually through placement, layering and integration.
Multi-tenant: A service in which many customers share the same platform, like Ridgeline's servers. You see only your own part and cannot test or inspect the platform freely without affecting others.
Multifactor login: Logging in with more than one factor, such as a password plus a hardware key. Alex finds that Ridgeline's backup console lacks it and records a gap.
Mutual NDA: An NDA that binds both sides because both share secrets, as with the one Alex and Ridgeline sign before exchanging details.

N

Negligence: Failing to take reasonable care. If someone is harmed as a result, they can sue.
NIST SP 800-47 Rev. 1: A US federal guide from NIST (the National Institute of Standards and Technology) on information exchanges between organizations. It lists agreements such as an ISA or MOU/MOA to set the security terms for the link.
Non-disclosure agreement (NDA): A contract in which one or both sides promise to keep certain information secret. It covers what counts as confidential, the exceptions, how long the duty lasts and return or destruction at the end.

O

OFAC (Office of Foreign Assets Control): The US Treasury office that publishes a sanctions list of people, firms and countries US businesses must not deal with.
On-premises: Equipment you own in your own building, like the shop's old server in the office closet. In the cloud, by contrast, the provider controls the hardware.

P

PCI DSS (Payment Card Industry Data Security Standard): The card brands' security standard for businesses that take cards. It is not a law, but it is enforced through contracts with payment companies, so it is treated like a regulation and limits risk acceptance.
Penetration test: An authorized, simulated attack that actually tries to exploit weaknesses, to show how far an attacker could get. It may be done only on systems you have written permission to test.
Performance bond: Money held or guaranteed by a third party and paid to you if the vendor fails to deliver.
Phishing: Fake emails that trick staff into giving away information or clicking something harmful. Awareness training teaches people to spot them.
Placement: The first stage of money laundering, when criminal money enters the legal system, for example as cash used to buy goods. This is the stage where an ordinary business is most often used.
Production environment: The live system customers use. Testing it risks real outages, which is why Alex tests a staging copy of the shop instead.
Proposal: A vendor's detailed answer to an RFP, explaining how it would do the work, who would do it, how long it would take and what it would cost.
Proprietary format: A data format that only one vendor's tools can read, which makes leaving that vendor hard.

Q

Quantitative analysis: Risk analysis that uses numbers and dollar figures (AV, EF, SLE, ARO, ALE). Qualitative analysis, its opposite, uses labels such as high, medium or low.

R

Ransomware: Malware that locks files and demands payment. It is the main example event for Kettle & Crane's order server.
Recusal: Stepping aside from a decision because of a conflict of interest, as Jo does when Sam scores the bids instead.
Red flag: A warning sign that staff are trained to report, such as large cash payments, amounts split just under $10,000 or refunds to an unrelated account.
Regulation: A detailed rule made by a government agency under powers a law gives it. The agency checks it with audits and reports and punishes breaches.
Regulator: A government agency that writes, checks and enforces regulations for an industry or a kind of data, such as the FTC.
Regulatory consideration: A duty from a regulation, or from an industry rule set like PCI DSS, that shapes how a business handles a risk. An agency auditing, fining or licensing points to regulatory.
Request for information (RFI): A document asking vendors to describe what they offer and how they work, used when the buyer is still learning the market. Answers are not binding offers.
Request for proposal (RFP): A document asking vendors for a detailed solution and price for requirements the buyer has defined. The proposals are scored, as in Alex's hosting RFP with security must-haves.
Request for quote (RFQ): A document asking vendors only for a price on an exactly specified item, such as 14 identical security keys. On the exam RFQ does not mean 'request for qualifications'.
Resource availability: Whether the money, tools, time and suppliers you need actually exist when you need them. An example is a $4,000 pen test when only $2,500 of budget is left.
Retention schedule: The rule for how long each kind of data may be kept before it must be destroyed.
Return on investment (ROI): How much a spending choice gives back compared with its cost: (benefit − cost) ÷ cost × 100. In security the benefit is the drop in ALE, so the backup service's ROI is about 167%.
Right to audit: A contract clause, usually in the MSA, that lets the customer or its chosen auditor examine the vendor's controls, records and facilities. With large providers it often becomes a right to receive independent reports, plus a right to audit after a breach.
Risk: The chance that something bad happens, together with the harm it would cause.
Risk acceptance: Choosing to live with a risk instead of fixing it, usually because the fix costs too much. It is not allowed when a regulation, law or contract requires the control.
Risk appetite: How much risk a business is willing to take on, a term from the earlier book. It never overrides a legal or regulatory requirement.
Risk register: A record of a business's risks and their figures, like Alex's table of AV, EF and ARO for the flood and defacement risks.
Risk tier: A rating in the vendor registry of how much harm a vendor's failure could do (critical, high, low). Tiering sends review effort to the riskiest vendors.
Rules of engagement: The written, signed rules for a security test: authorization, scope, timing, allowed methods, contacts, stop conditions, data handling and reporting. An example is Alex's rules for testing the staging shop with Ridgeline's sign-off.

S

Safeguards Rule: The GLBA rule, enforced by the FTC for many non-bank businesses, that makes covered financial businesses protect customer data and oversee their service providers by contract.
Sanctions list: A government list of people, firms and countries, including terrorist groups, that US businesses must not deal with. OFAC publishes one.
SAQ A (Self-Assessment Questionnaire A): The smallest PCI DSS self-assessment, for merchants like Kettle & Crane whose card data goes straight to the payment company. As of November 2026 the merchant must also confirm that its web pages are protected against script attacks.
Scope: What a piece of work or a test includes and, just as important, what it leaves out. In an SOW it bounds the job. In rules of engagement it names the exact targets that may and may not be tested.
Script attack: An attack that changes a web page, such as a payment page, inside the customer's browser. SAQ A requires merchants to confirm they are protected against it.
Security patch: An update that fixes a security weakness. Ridgeline's SLA requires critical patches within 3 days.
Security questionnaire: A standard list of questions about a vendor's controls, used to gather evidence in a vendor assessment. Answers without proof count for little.
Self-attestation: A statement a business or vendor makes about itself, such as a vendor's own questionnaire answers. It is cheap but weak evidence, since the vendor is marking its own work.
Separation of duties: Splitting the steps of a task between people. For example, the person who chooses a vendor should not also approve its invoices, so no one person can favor a vendor unseen.
Service credit: Money off the next bill when a vendor misses an SLA target. It is a small refund, not payment for your lost sales.
Service-level agreement (SLA): A contract, or part of one, that sets measurable service levels (uptime, patch times, breach notice) and the remedies when they are missed. Ridgeline's SLA with Kettle & Crane is an example.
Service-level indicator (SLI): The actual measurement behind a target, for example 'the shop answered 99.95% of checks this month'.
Service-level monitoring: Measuring a vendor's real service against its SLA targets, using your own checks as well as the vendor's reports, then acting on misses. Alex's outside uptime check found that Ridgeline managed only 99.83% in October.
Service-level objective (SLO): One specific, measurable service target, such as 99.9% monthly uptime. On its own it carries no penalty; the SLA adds that.
Shadow IT: A service bought and used by staff without IT knowing, like Sam's loyalty software. The vendor registry helps defend against it.
Shortlist: A small group of vendors chosen from EOI replies to invite to the next selection step.
SIG (Standardized Information Gathering) questionnaire: A widely used standard vendor security questionnaire from Shared Assessments.
Single loss expectancy (SLE): The money expected to be lost each time one event happens: AV × EF. One ransomware attack on the $40,000 order server at 50% EF has an SLE of $20,000.
SOC 1 report: An independent report on a service organization's controls that affect a customer's financial reporting, such as a payroll provider's.
SOC 2 report: An independent accountant's report, under AICPA standards, on a service organization's controls against the Trust Services Criteria. It is the main attestation Alex reads from Ridgeline.
SOC 2 Type 1 and Type 2: Type 1 checks whether controls are designed well on one date. Type 2 tests whether they actually worked over a period, often 6 to 12 months, and is the stronger evidence.
SOC 3 report: A short public summary of a SOC 2 report, without the detail.
Social engineering: Tricking people instead of attacking systems, for example by phishing staff. Kettle & Crane's rules of engagement forbid it unless it is listed.
Software bill of materials (SBOM): A list of the libraries and components inside a software product, used in supply chain analysis.
SOX (Sarbanes-Oxley Act): A US law that makes public companies keep accurate financial records and controls over them. Their top officers must personally certify the financial reports and internal controls.
Staffing limitations: Limits on the people available for vendor risk work: too few staff, too little time or missing skills. An example is Alex's four hours a month.
Statement of work (SOW): A document describing one specific job (scope, deliverables, timeline, acceptance criteria and price), usually sitting under an MSA. Ridgeline's migration SOW is an example.
Stop conditions: The events in the rules of engagement that make testers pause at once, such as an outage, signs of a real attacker or finding data outside scope.
Structuring: Splitting payments to stay under a reporting limit such as $10,000, which is a crime in itself. North Pine Roasters asking to pay in three $9,500 cash visits is an example.
Supply chain analysis: Looking past a vendor to its own suppliers (your fourth parties) and to the components in its products.
Surveillance audit: The yearly check during the life of an ISO/IEC 27001 certificate that the vendor still meets the standard.

T

Terrorism financing: Providing money, clean or dirty, to support terrorism.
Test environment: A copy of a system used for trying things safely, like staging.shop.kettleandcrane.com. It may differ from production in ways that hide problems.
Third party: Any outside organization that works with your business, such as a supplier, cloud provider, contractor or payment company.
Third-party attestation: An attestation signed by an independent auditor, such as a SOC 2 report or an AOC from an outside assessor. It gives stronger assurance than self-attestation.
Third-party risk: The risk that a vendor's weakness becomes your problem. You can outsource the work but not the responsibility.
Tipping off: Warning a customer that they are being checked or reported for suspected money laundering. AML/CTF training teaches staff never to do it, as Sam does not warn North Pine Roasters.
Trade secret: Valuable confidential business information. NDAs may protect it for longer than other information.
Trust Services Criteria: The criteria a SOC 2 report tests against: security (always included), plus availability, processing integrity, confidentiality and privacy where chosen.

U

UK Bribery Act 2010: A UK law covering both public and private bribery, which allows no facilitation payments. It makes a company guilty when someone acting for it pays a bribe, unless the company had adequate procedures to prevent it.
Unilateral NDA: An NDA that binds only the side receiving information, such as the one a new contractor signs before seeing the order system.
Uptime: The share of time a service is available. Each extra nine cuts the allowed downtime tenfold: 99.9% of a 30-day month allows 43,200 × 0.001 = 43.2 minutes down.

V

Vendor: A third party that sells you a product or service, like Ridgeline Hosting.
Vendor assessment: A structured, repeated review of one vendor's security and risk, often by questionnaire and evidence. It runs on a schedule set by the vendor's tier, or after a trigger such as a breach.
Vendor life cycle: The stages of a vendor relationship that objective 5.3 follows: selection, agreements, monitoring, and limits and testing. Selection and contract happen once, while monitoring repeats until the relationship ends.
Vendor lock-in: When leaving a vendor becomes so hard or costly that you are stuck, even if its price or security gets worse. Causes include proprietary formats, long terms and exit fees.
Vendor monitoring: The ongoing checking, for as long as the relationship lasts, that a vendor still meets its agreements and deserves trust. Due diligence, by contrast, happens before signing.
Vendor registry: The central list of all of a business's third parties, with each one's service, data, risk tier, owner, contract dates and review dates.
Vulnerability scan: A check that lists possible weaknesses without trying to exploit them, unlike a penetration test.

W

Warranty: A vendor's promise that its service will work as described. It is one of the protection-type assurance mechanisms.
Work order (WO) or purchase order (PO): A short order for one job or one purchase under an existing agreement. It plays the same role as a small SOW.