Glossary

One plain definition for each term that comes up when screens go through a security or compliance review, from the frameworks a reviewer cites to the systems and signage words around them.

Compliance and security

The frameworks, documents and security terms a regulated buyer uses.

SOC 2: An auditor's report on a service company's security controls. Type I checks design at a date, Type II checks operation over a period. Screenly holds Type II. SOC 2 Type II
SOC 3: A public summary of a SOC 2 report.
ISO 27001: A certified information security management system. Screenly holds the 2022 edition. ISO/IEC 27001
ISO 27017, 27701, 42001: Cloud security, privacy and AI management extensions of ISO 27001.
Scope statement: The part of a certificate that says what was audited. Buyers check whether it covers the device.
HIPAA: The US health privacy and security law. There is no HIPAA certification. HIPAA
PHI, ePHI: Protected health information, and the electronic kind: anything that identifies a patient together with health details.
BAA: Business associate agreement: the contract a healthcare organization needs from a vendor that creates, receives, holds or sends PHI. What is a BAA, and does a signage vendor need to sign one?
HITRUST: A healthcare-oriented security certification built on HIPAA and other frameworks.
GDPR: EU and UK personal data law. Compliance is self-declared; buyers ask for a DPA, a hosting region and a sub-processor list. GDPR
DPA: Data processing agreement, the GDPR contract between a customer and a vendor.
Sub-processor: A company a vendor uses to process customer data, such as a cloud host. Sub-processors
NIS2: The EU directive on cybersecurity for essential and important entities. It binds the buyer, who passes duties to vendors.
Cyber Resilience Act (CRA): EU rules for products with digital elements, including players. Reporting applies from September 2026, most duties from December 2027.
IEC 62443: The industrial automation security standards. Utilities and plants ask suppliers for alignment.
NERC CIP: Reliability standards for the North American power grid's cyber assets. The utility decides whether a screen is in scope. NERC CIP and digital signage
NIST SP 800-53, 800-171: The US federal security control catalog, and the subset for protecting CUI at contractors.
FedRAMP: US federal authorization for cloud services, typically over $1M and a year to obtain. Hosting on FedRAMP infrastructure such as AWS GovCloud is not the same as the product being authorized.
GovRAMP, TX-RAMP: State-level equivalents of FedRAMP; TX-RAMP is Texas's and the cheapest to obtain.
CMMC: Cybersecurity Maturity Model Certification for US defense contractors. Self-assessment has applied since 10 November 2025; third-party certification at contract award was due on 10 November 2026 and was suspended on 13 July 2026.
CUI: Controlled unclassified information.
ITAR: US export rules on defense-related data.
STIG: DISA's hardening checklists for systems on US military networks.
ATO: Authority to operate: approval for a system to run on a federal or military network.
TAA, NDAA: US rules on where government-bought hardware may be made and which components are banned.
CJIS: The FBI's security policy for systems that touch criminal justice information.
PCI DSS: Card payment security. A screen is in scope only through its network placement.
Section 508, WCAG, ADA: The US federal accessibility rule for technology, the web accessibility guidelines, and the Americans with Disabilities Act. Accessibility
VPAT, ACR: A vendor's statement of how its product meets accessibility rules.
SIG, CAIQ, HECVAT: Standard vendor security questionnaires from Shared Assessments, the Cloud Security Alliance and higher education.
Trust center: A vendor portal where buyers download audit reports and certificates, usually under NDA.
Pen test: Penetration test: a paid attack on the product by a third party, whose summary letter buyers ask for.
SBOM: Software bill of materials: every component in the device's software. What is an SBOM, and why do signage buyers ask for one?
CVE, KEV: A published vulnerability identifier, and CISA's catalog of vulnerabilities known to be exploited.
CISA, Secure by Design: The US cybersecurity agency, and its pledge for vendors to ship secure defaults, MFA, patching and disclosure.
Zero trust: A design where nothing on the network is trusted by default and every connection is authenticated.
mTLS: Mutual TLS: both ends of a connection present certificates, so a device proves which device it is.
Secure Boot, TPM: Firmware that boots only signed software, and the chip that holds a device's keys.
802.1X, PEAP, EAP-TLS: Network access control at the port; PEAP uses a password, EAP-TLS a certificate, which buyers prefer. 802.1X for digital signage
VLAN: A separate network segment, used to keep signage away from payment, clinical or control systems.
SSO, SAML, SCIM, MFA: Single sign-on, its common protocol, automatic user provisioning, and multi-factor authentication.
Passkey: Passwordless sign-in backed by a device key that never leaves the device.
SIEM: The security team's log collector (Splunk, Sentinel); buyers ask for audit logs forwarded to it.
Audit log: A record of who changed what, when and from where.
Proof of play: A record that specific content played on a specific screen at a specific time. What is proof of play?
Retention: How long logs and records are kept; the rules regulated buyers cite need two to three years.

Banking and finance

The rules and roles behind screens in banks, credit unions and broker-dealers.

FDIC, NCUA: US bank and credit union deposit insurers, each with an official sign rule for branches.
Reg DD: Truth in Savings: how deposit rates are advertised and what records are kept.
FINRA Rule 2210: The broker-dealer communications rule; it names "video display, signs or billboards" and requires dates of use and the approving principal.
SEC 17a-4: The broker-dealer record-keeping rule.
FFIEC, OCC, CFPB, NYDFS: US banking examiners and regulators whose vendor-risk and advertising rules shape a bank's review.
UDAAP: Unfair, deceptive or abusive acts or practices: the standard bank advertising is judged against.
Vendor-risk review: The bank's assessment of a supplier before purchase, usually with a SIG or CAIQ questionnaire.

Healthcare and life sciences

The records, quality and lab terms in hospitals, pharma and medical devices.

EHR: Electronic health record (Epic, Cerner), the clinical system that feeds patient-facing boards.
GxP, GMP: Good practice rules for pharma and medical devices; GMP is the manufacturing one.
FDA 21 CFR Part 11: The US rule on electronic records and signatures in life sciences, the benchmark for an audit trail.
Part 211, Annex 11: US and EU rules on computerized systems in drug manufacturing.
ISO 13485, QMSR: The medical device quality standard, and the FDA rule that adopts it.
ALCOA: Attributable, legible, contemporaneous, original, accurate: the data-integrity standard for records.
CAPA: Corrective and preventive action, the follow-up record in a quality system.
CLIA, CAP, ISO 15189: Laboratory accreditation schemes.
Clean room: A controlled manufacturing area with rules on who enters and what the screen at the door shows.

Plants, utilities and safety

The operations and safety words used on plant floors and at utilities.

OT: Operational technology: systems that run physical processes. OT security teams can veto a purchase.
IT and OT separation: Keeping office networks apart from control networks, the first thing an industrial buyer asks.
SCADA, DCS: The control systems behind plant and grid control rooms.
OMS: Outage management system at a utility.
EHS: Environment, health and safety: the function that owns safety boards and incident counters.
TRIR: Total recordable incident rate, a standard injury measure on safety boards.
OSHA, PSM, MSHA: The US workplace safety regulator, its process safety rule for chemical plants, and the mine safety regulator.
ATEX, IECEx: Certifications for equipment in explosive atmospheres.
Andon: A plant-floor board that shows where a line has stopped and who is responding.
OEE: Overall equipment effectiveness: availability, performance and quality combined.
SOP: Standard operating procedure, a controlled document in regulated plants.
PPE: Personal protective equipment.

Public sector and education

How public bodies buy, and the rules that shape screens in public buildings and campuses.

RFP, RFQ: Request for proposal or quotation: how public bodies and large enterprises buy.
GSA Schedule, SAM.gov: US federal purchasing routes.
Open meeting laws: State laws requiring public notice of meetings for a set period, sometimes met by a screen.
EOC: Emergency operations center.
Clery Act: US campus safety law requiring two alert channels and documented tests.
Alyssa's Law: State laws requiring silent panic alerts in schools.
FERPA: US student privacy law, which decides whether student names can appear on screens.

Buyer systems

The systems a regulated buyer's screens draw data and alerts from.

MES: Manufacturing execution system: line status, batches, work orders.
ERP: Enterprise resource planning: orders, inventory, finance.
WMS, TMS, YMS: Warehouse, transport and yard management systems behind dock and pick boards.
CMMS: Maintenance management: work orders and downtime.
QMS: Quality management: holds, deviations, CAPA, audits.
LIMS: Laboratory information management: samples and instruments.
ACD: Automatic call distributor, the contact center system behind wallboards.
BI tool: Power BI, Tableau, Grafana, Looker: the source of most KPI walls.
Mass notification: Everbridge, Rave, Alertus, Singlewire: systems that send one alert to phones, sirens and screens. Mass notification and digital signage
CAP: Common Alerting Protocol: the XML format emergency alerts travel in. CAP alerts on digital signage
IPAWS: FEMA's system that distributes official US alerts as signed CAP messages.
GTFS-RT: The real-time transit feed behind arrival boards.
MDM: Mobile device management, sometimes used for players.
NOC, SOC: Network and security operations centers: staff-only rooms with status walls.

Signage and product terms

The signage words, and Screenly's own terms.

CMS: Content management system: the software that holds content, schedules and screens.
Player: The device behind a screen that runs the content.
ScreenlyOS: Screenly's own operating system for signage devices.
The Screenly app: Screenly on TVs, sticks and web browsers, for devices that cannot have ScreenlyOS installed.
Anthias: Screenly's open-source signage project, for self-hosting.
Now serving, ticket call: The queue screen that calls the next visitor by number to a counter.
Wayfinding: Directories and maps that get a visitor to a destination.
Touch kiosk: A screen people operate by touch, often free-standing: check-in, self-service ordering, directories. It needs input lockdown, its own hardware and accessibility rules for interactive devices. Screenly screens are for display.
Interactive display: Any screen that responds to the viewer (touch, a button, a QR code, a sensor), as opposed to one that only shows content.
Menu board: Prices and items on screens above a counter, in canteens, cafés and hospital food courts.
Video wall: Several displays arranged to show one picture or one layout across them.
Zones, multi-zone layout: One screen split into areas that each show their own content, such as a video, a clock and a news feed.
Dayparting: Showing different content at different times of day on the same screen.
Takeover, priority playlist: Content that replaces everything else on chosen screens, for an emergency or an announcement.
Commercial display, SoC display: A display built for signage, running all day, often with a computer inside (system on chip) that can run signage software without a separate player.
Approval workflow: A second person signs off content before it goes live, with the sign-off recorded.
Bundled CMS: Signage software that comes free with a display.
FIDS: Flight information displays at airports, owned by aviation IT vendors.
DOOH: Digital out-of-home: advertising on public screens, sold by the play.
Audience analytics: Cameras or sensors that measure who looks at a screen. Screenly does not do this.