Free resource

    IT and cyber security glossary for small businesses

    Plain English definitions of the terms you will meet in an IT audit, security review or supplier conversation.

    A

    Antivirus and anti malware
    Software that detects and blocks malicious programs on a device before they can cause harm.
    Asset inventory
    A maintained list of every device, system and piece of software a business owns or uses.

    B

    Backup
    A copy of data kept separately so it can be restored after loss, corruption or a ransomware attack.
    Business continuity plan
    A documented approach for keeping essential work running during and after a disruption.

    C

    Cloud service
    Software or storage delivered over the internet, such as Microsoft 365, rather than run on your own servers.
    Cyber Essentials
    A UK Government backed certification covering five core security controls that protect against most common attacks.
    Cyber Essentials Plus
    The higher level of Cyber Essentials, where an independent assessor tests your controls in person.
    Cyber insurance
    Insurance that covers costs from cyber incidents, such as recovery, legal advice and business interruption.

    D

    Data breach
    Any incident where personal or sensitive data is lost, stolen or accessed without permission.
    DMARC
    An email record that tells receiving servers how to handle messages that fail SPF or DKIM checks, reducing impersonation.
    DKIM
    A digital signature added to outgoing email that proves it genuinely came from your domain.

    E

    Encryption
    Scrambling data so only people with the right key can read it, protecting lost devices and data in transit.
    Endpoint
    Any device that connects to your network, such as a laptop, phone, tablet or server.

    F

    Firewall
    A barrier that controls which network traffic is allowed in and out of your systems.

    G

    GDPR
    UK data protection law setting how organisations collect, store and protect personal data.

    I

    ICO
    The Information Commissioner's Office, the UK regulator for data protection. Serious breaches must be reported within 72 hours.
    Incident response plan
    A short written plan describing who does what when a security incident happens.
    IT audit
    A structured review of technology, security, processes and costs that produces prioritised recommendations.
    IT security audit
    An IT audit focused on how well systems, people and processes protect against cyber threats.

    L

    Least privilege
    Giving each person only the access they need to do their job, and nothing more.

    M

    MDM
    Mobile device management. Tools that let a business secure, update and remotely wipe company devices.
    MFA
    Multi factor authentication. Requiring a second proof of identity, such as an app prompt, as well as a password.

    P

    Patch management
    The process of applying software and security updates promptly across all devices.
    Phishing
    Fraudulent emails or messages designed to trick people into revealing information or making payments.

    R

    Ransomware
    Malicious software that locks or encrypts data and demands payment to release it.
    RPO
    Recovery point objective. The maximum amount of data, measured in time, a business can afford to lose.
    RTO
    Recovery time objective. How quickly a system must be back up after an outage.

    S

    SPF
    An email record listing which servers are allowed to send email for your domain.

    V

    VPN
    Virtual private network. An encrypted connection that lets remote staff reach business systems securely.

    Z

    Zero trust
    A security approach that verifies every user and device every time, rather than trusting anything inside the network.