Glossary
IT and security jargon, explained in plain English.
Short, honest definitions of the terms your IT provider, insurer or auditor keeps using — and why each one matters to a small practice or business.
60 terms. Looking for something practical rather than a definition? Try our guides and free tools.
0–9
- 3-2-1 backup rule
- Keep three copies of your data, on two different kinds of storage, with one copy kept off site.
B
- BitLocker
- Microsoft’s full-disk encryption built into business editions of Windows, which makes a lost or stolen PC’s data unreadable.
- Business associate agreement (BAA)
- A BAA is the written contract HIPAA requires between a covered entity (like your practice) and any vendor that creates, receives, stores or transmits patient information on your behalf.
- Business continuity
- Your plan for keeping the business serving customers or patients during a disruption — not just restoring IT afterwards.
- Business email compromise (BEC)
- Business email compromise is a fraud where criminals impersonate or take over a real business email account to trick staff, clients or vendors into sending money or sensitive information.
C
- Conditional Access
- Conditional Access is the Microsoft Entra ID feature that decides, at every sign-in, whether to allow, block or require extra checks based on who is signing in, from what device, and from where.
- Cyber insurance
- Insurance that helps pay for the costs of a cyberattack or data breach — investigation, recovery, notification, legal costs and sometimes lost income.
D
- Disaster recovery (DR)
- The plan and tools for getting your systems and data back after a serious failure such as ransomware, a fire, a flood or a dead server.
- DKIM (DomainKeys Identified Mail)
- DKIM adds a digital signature to every email you send, so receiving servers can confirm it really came from your domain and wasn't altered on the way.
- DLP (data loss prevention)
- Tools and policies that spot sensitive information — like Social Security numbers or patient records — and stop it from being shared where it shouldn’t go.
- DMARC
- DMARC is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks — and sends you reports about it.
E
- EDR (endpoint detection and response)
- EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
- Encryption at rest
- Scrambling stored data — on laptops, servers, phones or in the cloud — so it’s unreadable to anyone without the key.
- Encryption in transit
- Protecting data while it travels between devices or across the internet, so it can’t be read or altered on the way.
- Endpoint
- Any device that connects to your network or data — laptops, desktops, phones, tablets and servers — and is used by a person or runs business software.
- ePHI (electronic protected health information)
- ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
- ESU (Extended Security Updates)
- A paid Microsoft program that keeps delivering critical security fixes to Windows 10 PCs for a limited time after official support ended.
F
- Failover
- Automatically switching to a backup system or connection when the main one fails, so work carries on with little or no interruption.
- Firewall
- A device or piece of software that controls what network traffic is allowed in and out, blocking connections that don’t match its rules.
- FTC Safeguards Rule
- A Federal Trade Commission rule requiring non-bank financial businesses — including tax preparers and many accounting firms — to run a written information security program.
H
- Help desk
- The team (and system) your staff contact when something IT-related breaks or they need help, with every request tracked to completion.
- HIPAA Security Rule
- The HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.
I
- Immutable backup
- A backup copy that can’t be changed or deleted — by anyone, including an attacker with admin rights — until a set retention period ends.
- Incident response plan
- A written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.
L
- Least privilege
- Least privilege means giving every person, account and program only the access it needs to do its job — nothing more, and for no longer than necessary.
M
- MDR (managed detection and response)
- MDR is a service where a team of security analysts watches your security tools' alerts, investigates them, and takes action to contain threats on your behalf.
- MFA (multi-factor authentication)
- MFA means signing in with something you know (a password) plus something you have or are (a phone app, security key or fingerprint), so a stolen password alone isn't enough.
- Microsoft 365 Business Premium
- Microsoft 365 Business Premium is Microsoft's top small-business plan (up to 300 users), combining Office apps, email and Teams with device management and advanced security.
- Microsoft Defender for Business
- Microsoft Defender for Business is Microsoft's endpoint security product for organizations of up to 300 users, combining next-generation antivirus with EDR and automated investigation.
- Microsoft Entra ID
- Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service — the system that holds your users' accounts and controls how they sign in to Microsoft 365 and other apps.
- Microsoft Intune
- Microsoft Intune is Microsoft's cloud service for managing and securing company computers, phones and tablets — settings, apps, updates and encryption — from one place.
- MSP (managed service provider)
- An MSP is an outside company that runs and supports your IT on an ongoing basis — help desk, monitoring, updates, security and planning — usually for a predictable monthly fee.
- MSSP (managed security service provider)
- An MSSP is a company that provides ongoing, outsourced security services — such as threat monitoring, log analysis and incident response — rather than general IT support.
P
- Passkey
- A password replacement that signs you in with your device’s fingerprint, face or PIN, using cryptography that can’t be phished.
- Password manager
- An encrypted app that creates, stores and fills in strong, unique passwords, so staff don’t have to remember or reuse them.
- Patch management
- Patch management is the ongoing process of installing security updates on operating systems, applications and devices — on a schedule, with tracking, so nothing is left unprotected.
- Penetration test
- An authorized simulated attack in which security testers try to break into your systems, to show which weaknesses an attacker could really use.
- PHI (protected health information)
- PHI is any health information that can be linked to a specific person and is created or held by a healthcare provider, health plan or their vendors.
- Phishing
- Phishing is a scam message — usually an email, but also texts and phone calls — designed to trick someone into handing over a password, opening malware or sending money.
R
- Ransomware
- Ransomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.
- RMM (remote monitoring and management)
- RMM is the software IT providers install on computers and servers to monitor their health, install updates, run maintenance and connect remotely to fix problems.
- RPO (recovery point objective)
- The maximum amount of recent work, measured in time, that you could lose in a disaster and still be OK.
- RTO (recovery time objective)
- The longest your business can afford to be without a system before the outage causes serious harm — your target for getting it back.
S
- SD-WAN (software-defined wide area network)
- Technology that manages several internet connections together, sending traffic over the best one and switching automatically when one fails or slows down.
- Security risk assessment
- A security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
- SIEM (security information and event management)
- A SIEM is a system that collects logs from across your environment in one place, keeps them, and analyzes them to spot and investigate security problems.
- SLA (service level agreement)
- An SLA is the part of a service contract that defines measurable commitments — such as how quickly a provider responds to and resolves problems — and what happens if they miss them.
- SOC (security operations center)
- A SOC is a team — in-house or outsourced — whose job is to watch an organization's security alerts, investigate them and respond to attacks.
- SOC 2
- An independent audit report, based on AICPA criteria, that shows how a service company protects the data it handles for its clients.
- SPF (Sender Policy Framework)
- SPF is a public DNS record that lists which mail servers are allowed to send email for your domain, so receiving servers can spot forged senders.
- SSO (single sign-on)
- Signing in once with one strong company account to reach many different apps, instead of a separate password for each.
T
- TPM (Trusted Platform Module)
- A security chip (or chip-level feature) in a computer that stores encryption keys and checks the computer hasn’t been tampered with.
V
- VLAN (virtual local area network)
- A way to split one physical office network into separate, isolated networks so devices in one group can’t freely reach devices in another.
- VoIP (voice over internet protocol)
- Phone service that carries calls over your internet connection instead of traditional copper phone lines.
- VPN (virtual private network)
- An encrypted tunnel across the internet that lets a remote device connect to your office network as if it were plugged in at the office.
- Vulnerability scan
- An automated check of your computers, network and software for known security weaknesses such as missing updates or risky settings.
W
- Windows Autopilot
- Windows Autopilot lets a brand-new Windows PC set itself up for your business the first time an employee signs in — no imaging or hands-on setup required.
- WISP (written information security plan)
- A written document describing how your business protects sensitive customer information — required for tax and accounting professionals under federal rules.
X
- XDR (extended detection and response)
- XDR connects security signals from computers, email, sign-ins and cloud apps so an attack can be seen and stopped as one connected incident instead of scattered alerts.
Z
- Zero trust
- Zero trust is a security approach that never assumes a user or device is safe just because it's inside the office network — every access request is verified based on identity, device health and context.
Still sounds like alphabet soup?
Book a free 20-minute call. We'll explain what your setup actually needs — in plain English.