Acceptable Use Policy — AUP

A policy that defines how users are permitted to use an information system, research infrastructure, digital service or computing resource.

It may specify permitted and prohibited activities, security requirements, responsible use of computing capacity, handling of data, consequences of misuse and procedures for reporting suspected violations.

Do not confuse with: Access policy. An access policy determines who may obtain access and under what conditions; an AUP governs behaviour after access has been granted.

Access policy

A policy defining who may access a resource or service, the eligibility conditions, available access levels, applicable restrictions and the procedure for requesting, approving, modifying or withdrawing access.

An access policy may also define user groups, resource limits, authentication requirements, selection procedures, costs and the responsibilities of users and providers.

See also: Acceptable Use Policy , Terms of Use.

Accountability

The obligation of a person, organisational unit or governance body to explain and justify its decisions, demonstrate that assigned responsibilities have been fulfilled and accept scrutiny of the resulting actions and outcomes.

Accountability normally requires documented authority, identifiable responsibilities, records of decisions, reporting arrangements and mechanisms for review or corrective action.

Do not confuse with: responsibility. Responsibility concerns performing an activity; accountability concerns answering for whether the required result was achieved appropriately.

Change management

A controlled process for planning, assessing, approving, implementing and reviewing changes to services, systems, configurations, policies or operational procedures.

Its purpose is to introduce necessary changes while limiting disruption, security risks, unintended consequences and adverse effects on users or dependent services.

See also: Risk management, Service continuity management .

Communication Officer

The designated EOSC Node role responsible for coordinating communication, dissemination and stakeholder information concerning the Node and its participation in the EOSC Federation.

The role may include maintaining communication channels, coordinating public information, supporting community engagement and ensuring that relevant Federation information reaches the Node's users, providers and participating organisations.

See also: Node Coordinator, EOSC Node Coordinators Committee .

Competence Centre

An organisational unit, collaborative structure or expert network that concentrates and coordinates knowledge, skills, training, consultation and support within a defined thematic, institutional, regional or national scope.

In Open Science and research data management, a Competence Centre may support researchers and institutions through guidance, training, consultations, reusable resources, community coordination and access to specialist expertise.

A Competence Centre may operate a helpdesk, but its functions are broader than responding to individual support requests.

See also: Helpdesk, User support network.

Compliance

The condition of meeting applicable legal, regulatory, contractual, policy, security, ethical or standards-based requirements.

Compliance should be supported by documented controls, assigned responsibilities, monitoring, evidence and procedures for addressing identified nonconformities.

See also: Accountability, Policy, Risk management.

Cybersecurity Officer

The designated EOSC Node role responsible for coordinating cybersecurity matters affecting the Node and its interaction with the EOSC Federation.

The role may coordinate security contacts, incident communication, implementation of security requirements, risk assessment and cooperation with technical teams or computer security incident response functions.

Designation of this role does not remove the security responsibilities of service providers, system administrators or participating organisations.

See also: Information security management , Incident management.

Data controller

A natural or legal person, public authority, agency or other body that determines why and how personal data is processed.

The controller is responsible for ensuring that the processing has an appropriate legal basis, that data-protection principles are followed and that the rights of data subjects can be exercised.

Two or more organisations may be joint controllers when they jointly determine the purposes and means of processing.

See also: Data processor, Data Protection Officer .

Data curator

A specialist who reviews, organises, documents and improves research data or a data publication package so that it can be understood, validated, preserved, published and reused.

Curation may include checking files and formats, improving metadata, documenting provenance, verifying identifiers, reviewing README and manifest files, recording quality information and preparing data for repository deposit.

The curator supports the quality and usability of the package but does not normally verify the scientific correctness of every research result.

See also: Data steward, Repository manager.

Data governance

The system of decision-making authority, policies, roles, responsibilities and oversight used to control how an organisation or collaboration manages, protects, shares and derives value from data.

Data governance may cover data quality, access, security, privacy, metadata, retention, ownership claims, stewardship, interoperability and compliance.

Do not confuse with: data management. Governance determines authority and rules; data management implements activities under those rules.

Data management support

Organised assistance provided to researchers and research teams in planning, organising, documenting, protecting, storing, publishing, preserving and sharing research data.

Support may be delivered through consultations, training, templates, reviews, repository assistance, technical services, guidance materials and referral to legal, ethical or information-security specialists.

See also: Data steward, User support.

Data manager

A person responsible for coordinating or performing operational data management activities for a project, research group, facility, database or organisation.

Activities may include organising data flows, applying naming and versioning conventions, controlling access, coordinating transfers, maintaining documentation, checking data quality and preparing data for analysis or publication.

The exact boundary between data manager and data steward varies between organisations.

See also: Data steward, Data curator.

Data owner

An organisational role assigned authority and accountability for decisions concerning a defined collection or category of data.

The data owner may approve access rules, quality expectations, retention requirements, classifications and permitted uses, while operational tasks are delegated to data stewards, managers or system administrators.

Important: the term does not necessarily establish legal ownership, copyright or the status of data controller under data-protection law. Its meaning must be defined in the applicable institutional policy.

Data processor

A natural or legal person, public authority, agency or other body that processes personal data on behalf of a data controller and according to the controller's documented instructions.

The responsibilities of the processor must be defined through a contract or another applicable legal instrument.

See also: Data controller, Legal/Privacy Officer .

Data Protection Officer — DPO

An independent data-protection function that advises an organisation on its obligations, monitors compliance with applicable data-protection rules and acts as a contact point for data subjects and supervisory authorities.

Appointment of a DPO is required only in circumstances defined by applicable legislation. The DPO must be able to perform the role independently and without receiving instructions concerning the exercise of the DPO's tasks.

Do not confuse with: Legal/Privacy Officer . The latter is an operational role within an EOSC Node and is not automatically the institution's legally designated DPO.

Data steward

A professional who supports researchers and organisations in implementing appropriate research data management and FAIR data practices before, during and after a research project.

A data steward connects research practice with institutional policies, funder requirements, standards, repositories, metadata, infrastructures and specialist support.

Data stewards may work at institutional, disciplinary, project, infrastructure or research-group level and may specialise in policy, research processes, data curation or technical infrastructure.

See also: Embedded data steward , Data stewardship.

Data stewardship

The responsible planning, oversight and practical care of data throughout its lifecycle so that the data remains appropriately managed, protected, documented, accessible and reusable.

Data stewardship combines policies, professional expertise, infrastructure, standards and day-to-day practices. It is therefore broader than the work of any single data steward.

See also: Data governance, Data management support .

Embedded data steward

A data steward who works within or in close continuing contact with a particular research group, department, project or scientific community.

This model allows the steward to understand domain-specific methods, workflows, terminology and data practices while connecting the group to wider institutional policies and support services.

Do not confuse with: a central data steward. A central steward normally supports several units or the institution as a whole, although the two models may be combined.

Escalation

The transfer of responsibility for a request, incident, problem or decision to another person or group that has the required expertise, authority, capacity or access rights.

Functional escalation transfers the case to a specialist with different competence. Hierarchical escalation transfers it to a higher level of authority or management.

See also: First-line support, Second-line support, Third-line support.

EOSC Node Coordinators Committee — NCC

The EOSC Federation forum in which appointed representatives of participating Nodes conduct strategic discussion, align priorities and consider policies and recommendations relevant to the Federation.

During the Federation build-up phase, the Committee connects the perspective of Node participants with the wider EOSC governance process and cooperates with the Node Operations Committee and Federation working groups.

See also: Node Coordinator, EOSC Node Operations Committee .

EOSC Node Operations Committee — NOC

The EOSC Federation body supporting operational and technical coordination among participating Nodes during the Federation build-up and transition to production.

Its work may cover federated authentication, catalogues, monitoring, service management, operational readiness and coordination with technical working groups.

See also: Operations Manager, EOSC Node Coordinators Committee .

EOSC Tripartite Governance

The strategic coordination arrangement bringing together the European Commission, the EOSC Steering Board representing Member States and countries associated with Horizon Europe, and the EOSC Association representing the research and Open Science community.

It provides strategic direction and alignment for EOSC development and the build-up of the EOSC Federation.

See also: Governance, EOSC Node Coordinators Committee .

First-line support

The initial point of contact for users seeking assistance or reporting an incident.

First-line support registers and classifies the request, collects essential information, provides standard guidance, resolves known issues and escalates cases that require specialist knowledge or additional authority.

See also: Service desk, Second-line support.

Governance

The system through which authority is assigned, strategic decisions are made, responsibilities are defined and organisational performance and accountability are overseen.

Governance establishes who has the right to decide, which principles and policies apply, how stakeholders are represented and how decisions are reviewed.

Do not confuse with: Service management. Governance directs and oversees; management plans and coordinates implementation.

Governance body

A formally established board, committee, council or similar group with defined authority to make, approve, review or oversee decisions within a specified scope.

Its mandate should define membership, decision-making powers, voting or consensus procedures, reporting lines, meeting arrangements and rules for managing conflicts of interest.

See also: Mandate, Accountability.

Guideline

A document providing recommended practices, explanations or instructions for carrying out an activity or applying a policy, standard or principle.

A guideline is normally advisory unless an applicable policy, agreement or regulation explicitly makes compliance with it mandatory.

Do not confuse with: Policy or Procedure.

Helpdesk

A user-facing contact function through which questions, requests and incidents are received, recorded, answered or directed to an appropriate specialist.

A helpdesk may use email, online forms, a ticketing system, telephone, scheduled consultations or other documented communication channels.

Do not confuse with: Competence Centre. A helpdesk handles individual cases, whereas a Competence Centre normally also develops expertise, training, guidance and professional networks.

Incident management

The process for recording, classifying, investigating and resolving unplanned service disruptions or reductions in expected service quality.

The immediate objective is to restore agreed service operation as quickly as reasonably possible and minimise adverse effects on users.

Do not confuse with: Problem management. Incident management restores service; problem management investigates and addresses underlying causes.

Information security management

The coordinated management of policies, risks, controls, responsibilities and processes used to protect the confidentiality, integrity and availability of information and related services.

It includes risk assessment, access control, security monitoring, incident response, awareness, continuity planning and periodic review of security measures.

See also: Information security policy , Cybersecurity Officer .

Information security policy

A formally approved statement of principles, objectives, rules and responsibilities for protecting information and information systems.

It establishes the organisational direction for security and is implemented through more detailed controls, standards, procedures and operational practices.

Key performance indicator — KPI

A selected metric used to monitor the performance, effectiveness or efficiency of a service, process, project or organisational objective.

A KPI should be connected to a defined goal, measured consistently and interpreted within an agreed reporting context.

Not every available metric is a KPI; KPIs are the measures considered most important for evaluating progress or performance.

Knowledge base

A maintained collection of reusable information that helps users and support staff understand services and resolve recurring questions or problems.

It may contain instructions, frequently asked questions, troubleshooting guides, known issues, standard responses, templates and links to relevant policies or documentation.

See also: Helpdesk, User support.

Legal/Privacy Officer

The designated EOSC Node role that coordinates legal and privacy matters relevant to the Node and its participation in the EOSC Federation.

The role may support the review of agreements, access conditions, privacy information, data-sharing arrangements, intellectual property matters and the allocation of responsibilities between participating organisations.

The officer should refer matters requiring formal legal authority or independent data-protection oversight to the appropriate institutional legal service, controller or Data Protection Officer.

See also: Data Protection Officer , Data controller.

Mandate

A formal authorisation defining the purpose, authority, scope, responsibilities and limitations of a role, organisational unit, committee, project or collaborative structure.

A mandate may be established by legislation, institutional regulation, formal decision, contract, memorandum or another authorised document.

See also: Governance body, Memorandum of Understanding .

Memorandum of Understanding — MoU

A document recording the shared intentions, principles, responsibilities and cooperation arrangements agreed between two or more parties.

An MoU may define governance, participation, contributions, information exchange, decision-making and dispute-resolution arrangements.

Its legal effect depends on its wording, applicable law and the intention of the parties; the title alone does not determine whether its provisions are legally binding.

Node Coordinator

The designated EOSC Node role responsible for coordinating the Node's institutional participation and representing it in Federation-level governance and strategic coordination.

The Node Coordinator connects participating organisations, ensures that required Node roles and responsibilities are assigned and acts as a principal contact for strategic matters concerning the Federation.

The role does not necessarily include day-to-day management of all technical services.

See also: Operations Manager, EOSC Node Coordinators Committee .

Operational Level Agreement — OLA

A documented agreement between a service provider and an internal supplier or organisational unit that specifies the supporting service components to be provided and the corresponding operational targets.

In a federation, an OLA may define operational commitments between the coordinating body and participating federation members.

Do not confuse with: Service Level Agreement . An SLA is agreed with the customer; an OLA supports delivery internally.

Operations Manager

The designated EOSC Node role responsible for coordinating the Node's operational interaction with the EOSC Federation.

The role may coordinate service operations, readiness information, monitoring, incident communication, operational reporting and participation in the EOSC Node Operations Committee.

The Operations Manager does not personally operate every service. Individual service providers and service owners retain responsibility for their respective services.

See also: Node Coordinator, Service manager.

Policy

A documented set of intentions, objectives, rules, expectations and requirements approved by an authorised person or governance body.

A policy establishes what should be achieved or observed. Processes and procedures translate it into coordinated activities and practical steps.

See also: Guideline, Procedure.

Policy maker

A person or body involved in developing, approving, coordinating, implementing or reviewing policies at institutional, funding, governmental, infrastructure or collaborative level.

In research data management, policy makers align requirements concerning data quality, security, openness, FAIR principles, responsibilities, infrastructure and compliance.

Policy-making authority should be distinguished from advisory participation in drafting a policy.

Principal Investigator — PI

The researcher with primary scientific leadership and oversight responsibility for a research project, research group or defined part of a collaborative programme.

Data-related responsibilities commonly include establishing the project's data-management strategy, assigning team responsibilities, planning resources, addressing ethical and legal requirements and monitoring research integrity and compliance with funder conditions.

The PI may delegate individual data-management tasks but normally retains overall responsibility for ensuring that they are appropriately organised.

Procedure

A specified sequence of steps or instructions used to perform one or more activities within a process.

A procedure should identify the responsible roles, required inputs, actions, records, decision points and expected outputs where these are necessary for consistent execution.

Do not confuse with: Policy. A policy states rules and intended outcomes; a procedure explains how an activity is carried out.

Problem management

The process for identifying, investigating and managing the underlying causes of one or more incidents.

Its objective is to prevent incidents from recurring or reduce their frequency and impact through root-cause analysis, corrective actions, known-error records and documented workarounds.

See also: Incident management, Knowledge base.

RACI matrix

A responsibility-assignment table that identifies how roles participate in an activity, process, decision or deliverable.

R means Responsible for performing the work; A means Accountable for the result; C means Consulted before or during the work; and I means Informed about progress or outcomes.

A RACI matrix clarifies responsibility but does not replace formal mandates, job descriptions, procedures or legal agreements.

Repository manager

A person responsible for coordinating the policies, workflows, services and day-to-day management of a digital repository.

Responsibilities may include deposit procedures, user support, metadata quality, access arrangements, preservation planning, licensing information, persistent identifiers, reporting and coordination with technical administrators.

The repository manager is not necessarily the system administrator or the curator of every deposited dataset.

Researcher

A person who conducts research and creates, collects, analyses, interprets or reuses data, software and other research outputs.

Researchers are responsible for applying appropriate research, disciplinary, institutional, ethical, legal and funder requirements to the data and outputs under their control.

Support from data professionals does not remove the researcher's responsibility for scientific integrity and accurate documentation of the research process.

Research Software Engineer — RSE

A professional who applies software-engineering expertise to the design, development, testing, documentation and maintenance of software used in research.

An RSE connects scientific requirements with technical implementation and may support workflows, data processing, reproducibility, scalability, security, version control and sustainable software maintenance.

See also: Data manager, Service provider.

Research support professional

A broad term for a professional who supports the planning, conduct, management, communication, compliance or reuse of research without necessarily being a member of the scientific team producing the research results.

The category may include data stewards, librarians, repository staff, research software engineers, project managers, legal advisers, information specialists, trainers and infrastructure support staff.

Risk management

A coordinated process for identifying, analysing, evaluating, treating and monitoring uncertain events or conditions that may negatively affect objectives, services, information, research outputs or stakeholders.

Risk treatment may include avoiding the activity, reducing likelihood or impact, transferring part of the risk, accepting the residual risk or establishing contingency measures.

See also: Information security management , Service continuity management .

Second-line support

Specialist support that investigates cases not resolved by first-line support.

It may be provided by data stewards, repository specialists, service administrators, infrastructure engineers, security staff or other subject experts with deeper knowledge and additional system access.

See also: First-line support, Third-line support.

Service continuity management

The process for preparing a service to maintain or restore essential functions during and after major disruption, emergency, infrastructure failure or disaster.

It may include impact assessment, recovery priorities, backup and restoration arrangements, alternative capacity, communication plans, documented continuity procedures and periodic testing.

See also: Risk management, Incident management.

Service desk

A coordinated organisational function that manages communication between users and a service provider throughout the handling of incidents, service requests, access questions and service information.

A service desk commonly maintains the ticketing process, user communication, request status, escalation and links to knowledge-base materials.

The term is sometimes used interchangeably with helpdesk, although a service desk normally has a broader service-management scope.

Service Level Agreement — SLA

A documented agreement between a customer and a service provider that identifies the service to be provided and the service targets defining the expected level of delivery.

Targets may address availability, support hours, response and resolution times, capacity, performance, reporting, security or continuity.

See also: Operational Level Agreement , Service provider.

Service management

The coordinated set of activities through which a service provider plans, delivers, operates, controls, reviews and improves services offered to customers and users.

Service management is implemented through policies, processes, procedures, roles, agreements, plans, records, tools and supporting resources.

See also: Service manager, Service owner.

Service manager

A role responsible for coordinating the planning, delivery, operation, monitoring and improvement of one or more services.

Depending on the organisational model, the service manager may coordinate staff, suppliers, incidents, changes, reporting, service levels and communication with users.

Do not confuse with: Service owner. The service owner holds overall accountability for a specific service, while a service manager may coordinate its operational management.

Service owner

The role with overall responsibility and accountability for a particular service throughout its lifecycle.

The service owner acts as the principal contact for service-wide concerns, maintains the core service description, follows significant events and changes and represents the service within relevant management processes.

One person may own more than one service, but each service should have an identifiable accountable owner.

Service provider

An organisation, federation or organisational unit that manages and delivers one or more services to customers or users.

The provider is responsible for organising the resources, personnel, processes, suppliers and controls necessary to deliver the service according to its description and applicable agreements.

Do not confuse with: Service owner. The provider is an organisational entity; the owner is an assigned role.

Support ticket

A structured record used to register, track and document a user question, incident, access request, service request or other support case.

A ticket normally records the requester, category, priority, affected service, assigned support group, communication, actions, status, resolution and closure information.

The ticket is the record of the case; it is not the support process itself.

Terms of Use

The conditions governing the relationship between a user and the provider of a website, platform, resource or service.

They may cover user eligibility, account responsibilities, permitted use, intellectual property, data handling, warranties, limitations of liability, suspension, termination and applicable dispute procedures.

Do not confuse with: Acceptable Use Policy . Terms of Use define the wider user-provider relationship; an AUP focuses on acceptable and prohibited behaviour.

Third-line support

Advanced support provided for cases that require detailed product, software, infrastructure or system-level expertise beyond the capacity of first- and second-line teams.

It may be delivered by developers, system architects, infrastructure operators, vendors or maintainers of an external service component.

Third-line support may implement code changes or permanent technical corrections, but not every escalated case requires software development.

Trainer

A person who designs, delivers or evaluates structured learning activities intended to develop knowledge, skills or professional competence.

In research data management and Open Science, trainers may develop curricula, learning outcomes, exercises, webinars, workshops, assessments and reusable learning materials for researchers and support professionals.

Subject expertise alone does not automatically provide the instructional design and facilitation skills required for effective training.

User support

The organised provision of information, advice, troubleshooting, consultation and assistance that enables users to understand and use a resource or service effectively.

User support may combine documentation, training, helpdesk services, consultations, knowledge bases, community forums and specialist escalation.

Support should have defined scope, communication channels, responsibilities and expected response arrangements.

User support network

A coordinated group of institutional, disciplinary, technical and specialist support providers that cooperate to respond to users whose needs cross organisational or professional boundaries.

A support network may connect local contact points, data stewards, competence centres, repositories, infrastructure operators, legal experts, security teams and external service providers.

Effective operation requires documented referral routes, shared terminology, assigned responsibilities and mechanisms for exchanging reusable guidance without unnecessarily disclosing confidential information.

See also: Competence Centre, Escalation.