Plain English Cybersecurity Glossary for SMEs

Normal day-to-day business operations.

A plan for keeping the business running during disruption.

Staff using their own phones, tablets or laptops for work.

Software used to manage customers, leads, sales and communication history.

How a business restores systems and data after a major failure.

Software that manages major business processes like stock, accounts and operations.

The people, payroll, hiring and staff management side of a business.

A number used to measure whether something is working well.

An outsourced IT company that looks after computers, networks, updates and support.

Like an MSP, but focused on cybersecurity monitoring and protection.

A company that makes original parts, devices or software used in another company's product.

A till, checkout or payment system.

Whether the money spent on a product or service gives enough value back.

How much data loss is acceptable after a failure.

How quickly a system needs to be restored after an outage.

A promise about support response times, uptime or service quality.

Another way of saying SME, often used in software and IT sales.

A small or medium-sized business. Usually not a huge corporation, but big enough to need proper systems and security.

A written step-by-step process for doing a task properly.

The full cost of something over time, including setup, support, licences and maintenance.

A type of MFA using two login checks.

A skilled attacker or group that stays hidden and targets organisations over time.

Software that detects and blocks known malware.

Copies of important files and systems that can be restored after mistakes, failure, theft, or attack.

Security controls placed between users and cloud services.

A public reference number for a known software security weakness.

A score showing how serious a vulnerability is.

Tools and rules that stop sensitive data being leaked or sent to the wrong place.

Security software that watches laptops, desktops and servers for suspicious activity.

A barrier that controls what network traffic is allowed in or out.

Controlling who can log in, what they can access and what they can change.

A system that spots possible attacks.

A clue that a system may have been attacked, such as a bad IP address or suspicious file.

A system that can block possible attacks.

A managed service where security experts monitor and respond to threats for you.

Logging in with more than just a password, such as a code, app prompt or security key.

A more advanced firewall with deeper inspection and security features.

Extra control over powerful admin accounts.

Giving people access based on their job role.

A system that collects security logs and helps spot suspicious behaviour.

Tools that automate parts of security investigation and response.

A team or service that monitors security alerts and incidents.

One login used to access multiple systems.

The methods attackers use.

A security appliance or service combining several protections in one place.

A secure connection used to access systems remotely or protect network traffic.

Protection for websites and web apps against common attacks.

Security monitoring across multiple areas, such as devices, email, cloud and network.

A security flaw that is being used before a fix is available.

A scam where criminals use email to trick staff into paying money or sharing information.

A scam where an attacker pretends to be the boss and asks for urgent payment or action.

An attack that tricks a logged-in user's browser into performing an unwanted action.

A larger DoS attack using many devices at once.

An attack that tries to make a website or system unavailable.

An attack where someone secretly intercepts communication between two parties.

A knowledge base describing how cyber attackers operate.

Information gathered from public sources such as websites, social media, records and search engines.

Malware that lets an attacker control a device remotely.

A serious flaw that lets an attacker run commands on a system from elsewhere.

An attack where database commands are inserted into website forms or requests.

A website attack where malicious script runs in a user's browser.

A framework used to assess cyber resilience, especially in regulated or essential services.

A UK government-backed cybersecurity certification covering basic protective controls.

Cyber Essentials with independent technical testing.

UK legislation intended to update and strengthen cyber resilience rules.

UK data protection legislation that works alongside UK GDPR.

A risk assessment for projects that may affect people's privacy.

A person responsible for advising on and monitoring data protection compliance.

Another name for a Subject Access Request.

UK government department responsible for areas including digital, technology and cyber policy.

A provider of digital services such as cloud, search or online marketplaces.

Rules allowing access to certain public authority information.

Data protection law covering how personal data is handled.

Organisation involved in Cyber Essentials delivery and SME-focused assurance.

The UK regulator for data protection and information rights.

The policies, processes and controls used to manage information security.

An organisation that publishes international standards.

A recognised standard for managing information security properly.

The UK's national technical authority for cybersecurity.

UK/EU rules focused on security and resilience for important digital and essential services.

An organisation providing important services such as energy, transport, water or healthcare.

Security rules for organisations that handle card payments.

UK rules covering electronic marketing, cookies and similar communications.

Health-related personal information, mainly used in healthcare contexts.

Information that can identify a person, directly or indirectly.

UK government procurement guidance for public sector buying.

A record of what personal data an organisation processes and why.

A request from an individual asking what personal data an organisation holds about them.

The UK version of GDPR after Brexit.

The system that automatically gives devices their network settings.

The system that turns website names into IP addresses.

An older method for moving files between systems.

The basic protocol used by websites.

The secure version of HTTP, using encryption.

The system used to send data across networks.

A number that identifies a device on a network or the internet.

A network inside a building or site.

A hardware address used to identify a network device.

A method that lets many devices share one public internet address.

Network settings that prioritise important traffic such as voice or video.

A way to remotely control a Windows computer.

A secure method for transferring files.

A secure way to log in to and manage remote systems.

Older term still commonly used for website security certificates.

A reliable method for sending data over networks.

The modern security technology behind HTTPS.

A faster, less strict method for sending network data.

A separated network created inside a larger network.

Phone calls carried over the internet.

A network spread across multiple locations or the internet.

A Wi-Fi network.

A DNS record pointing a domain to an IPv4 address.

A DNS record pointing a domain to an IPv6 address.

A network that helps websites load faster and can add protection.

Website software such as WordPress, Shopify or similar platforms.

A DNS alias pointing one name to another.

A button or message asking the visitor to do something, such as "Buy Now" or "Contact Us".

A system that digitally signs email to prove it was not altered.

A policy that tells mail systems what to do if SPF or DKIM checks fail.

DNS records that tell the internet where email for a domain should go.

Improving a website so search engines can understand and rank it.

The results page shown by a search engine.

A DNS record that says which servers are allowed to send email for a domain.

A DNS record often used for verification and email security settings.

The visible buttons, menus, screens and controls a user interacts with.

How easy and pleasant a website, app or system is to use.

A way for software systems to talk to each other.

Automatically preparing or releasing software updates.

Automatically testing code when changes are made.

A text-based way to control software using commands.

The styling language used for web pages.

A simple spreadsheet-style text file.

A structured place where information is stored.

A way of working that connects software development, deployment and operations.

DevOps with security built into the process.

A tool for packaging software so it runs consistently.

A system for tracking changes in code and files.

A platform used to store, review and collaborate on code.

A visual interface with windows, buttons and menus.

The structure language used for web pages.

Cloud servers, storage and networking rented instead of owned.

Software used to write, test and manage code.

A programming language commonly used for websites and apps.

A common data format used by software and APIs.

A system for managing lots of containers.

The simplest working version of a product that proves the idea.

A cloud platform for building or running applications.

Software used online, usually by subscription.

Tools and code that help developers build with a platform.

A language used to work with databases.

A software-based computer running inside another computer.

A rented virtual server, usually hosted in a data centre.

An older structured data format still used by many systems.

A human-readable configuration file format.

An AI system that can take steps toward a task, not just answer one question.

Software that can perform tasks normally associated with human intelligence.

A secret code that lets software access an online service.

A setup where the user supplies their own API key instead of the provider holding it.

A type of AI language model used for text, chat and content generation.

A chip used for graphics and heavy AI processing.

When AI produces something that sounds confident but is wrong or unsupported.

An AI model trained to understand and generate text.

A type of AI where systems learn patterns from data.

Technology that helps computers understand human language.

A chip designed to run AI tasks efficiently.

Technology that reads text from images, scans or photos.

The instruction or question given to an AI system.

AI that looks up information from documents or databases before answering.

Technology that turns speech into written text.

Technology that turns written text into spoken audio.

Staff using personal devices for work.

A company-owned device that staff can also use personally.

The main processor in a computer.

Staff choosing from approved company devices.

Older-style spinning disk storage.

A connection for video and audio to screens.

Software used to manage company phones, tablets and laptops.

Short-range wireless communication, often used for contactless payments.

A square barcode scanned by a phone.

Short-term working memory used while a device is running.

Fast storage used in modern computers.

Managing many types of devices from one system.

A common connection for devices, charging and data.

A modern reversible USB connector.

Rules and checks designed to prevent criminal money movement.

A digital till and sales system.

The UK tax authority.

Checks used to confirm a customer's identity.

UK tax rules requiring digital records and submissions for some businesses.

The card payment security ecosystem.

Security rules for handling payment card data.

The system where a customer pays.

A company that processes payments, such as card or online payments.

A tax added to many goods and services.

The UK government organisation that supports public sector procurement.

Essential services and systems such as energy, water, transport and healthcare.

A public sector purchasing system suppliers can join if they qualify.

An NHS information governance and security self-assessment tool.

A UK public sector framework for buying cloud services.

NHS organisation responsible for planning health services in a local area.

Local partnerships between NHS, councils and other organisations.

A formal invitation to bid for work.

The UK public healthcare system.

Public sector procurement guidance.

A request asking suppliers to propose a solution and price.

A request asking suppliers to provide pricing.