Cyber security terms, explained

Plain-English definitions of 53+ Cyber Essentials and cyber security terms, with no jargon left unexplained.

A

Access Control: One of the five Cyber Essentials technical controls: making sure user and administrator accounts only have the access they actually need, with strong, unique passwords or multi-factor authentication protecting privileged accounts.
Assessor: The individual at an IASME-licensed Certification Body who reviews your Cyber Essentials submission, checks it against the scheme's requirements, and confirms whether it passes.See how the process works
Asset Register: A list of every device, application, and cloud service your organisation uses. Not a formal Cyber Essentials requirement on its own, but the practical starting point for defining your assessment scope accurately.
Attack Surface: The total number of points where an unauthorised user could try to access or extract data from your systems, e.g. every internet-facing device, open port, and user account. Reducing it is the practical goal behind most of the five Cyber Essentials controls.

B

Backup and Disaster Recovery: Keeping regular, tested copies of your data so it can be restored after a ransomware attack, hardware failure, or accidental deletion. Not one of the five Cyber Essentials controls directly, but a core part of most SMEs' wider security posture.
Boundary Firewall: A device or software that controls traffic between your internal network and the internet, blocking unauthorised access at the network's outer edge.
Business Continuity Plan: A documented plan for keeping your organisation running, or recovering quickly, after a disruptive incident such as a cyber attack, fire, or major outage.
Business Email Compromise (BEC): A scam where an attacker impersonates a senior employee or supplier by email, usually to trick someone into making a fraudulent payment or sharing sensitive information. One of the most common and costly threats facing UK SMEs.

C

Certification Body: An organisation accredited by IASME to assess Cyber Essentials submissions and issue certificates on NCSC's behalf.See how the process works
Corrective Action Plan: In Cyber Essentials Plus, if a technical test finds an issue, you're given a defined window to fix it and provide evidence, rather than automatically failing the whole assessment.Compare Cyber Essentials Plus
Credential Stuffing: An automated attack that tries usernames and passwords leaked from one breach against other websites and services, betting that people reuse the same login details.
CVE (Common Vulnerabilities and Exposures): A publicly catalogued, uniquely numbered entry for a known security vulnerability, e.g. CVE-2024-12345. Vendors and security teams reference CVEs when patching or reporting issues.
CVSS: Common Vulnerability Scoring System: an industry-standard scale (0–10) used to rate the severity of a security vulnerability.
Cyber Assessment Framework (CAF): NCSC's framework for assessing cyber resilience in essential services and government, broader and more detailed than Cyber Essentials. Underpins schemes like GovAssure for higher-assurance central government requirements.
Cyber Essentials: A UK government-backed certification scheme verifying five core technical controls that protect against common internet-based attacks.About Cyber Essentials
Cyber Essentials Plus: An enhanced version of Cyber Essentials that includes an independent, hands-on technical audit rather than a self-assessment.Compare Cyber Essentials Plus
Cyber Liability Insurance: Insurance covering costs arising from a cyber incident, e.g. data breach response, business interruption, and legal costs. UK organisations with turnover under £20 million get free basic cover automatically included when they certify to Cyber Essentials.About Cyber Essentials

D

Data Breach: An incident where personal or confidential data is accessed, disclosed, or lost without authorisation. Serious breaches must be reported to the ICO within 72 hours under UK GDPR.
DCPP / Cyber Security Model (CSM): The Defence Cyber Protection Partnership's Cyber Security Model: the framework the MOD uses to set risk-appropriate Cyber Essentials (or higher) requirements across its supply chain.Cyber Essentials for defence & aerospace
Distributed Denial of Service (DDoS): An attack that floods a website or network with traffic from many sources at once, aiming to knock it offline rather than steal data.

E

EDR (Endpoint Detection and Response): Software that monitors laptops, servers, and other devices for suspicious activity in real time, going beyond traditional antivirus by detecting and responding to threats as they happen.
Encryption: Converting data into a coded form that can only be read with the correct key, protecting it if a device is lost, stolen, or intercepted in transit.
Endpoint Protection: Security software installed on individual devices (laptops, desktops, servers, mobiles) to detect and block malware. Directly supports the Malware Protection control in Cyber Essentials.

F

Firewall: A network security control that monitors and filters incoming and outgoing traffic based on a defined rule set, blocking connections that don't meet it. Cyber Essentials requires firewalls at both the network boundary and on individual devices.

G

GDPR (UK GDPR): The UK's data protection law, setting rules for how organisations collect, store, and use personal data. Separate from Cyber Essentials, but the two are often assessed together since good technical controls support GDPR compliance.
GovAssure: The UK government's assurance scheme for assessing cyber resilience across departments and arm's-length bodies, based on NCSC's Cyber Assessment Framework rather than Cyber Essentials.Cyber Essentials for government suppliers

I

IASME: The IASME Consortium, the organisation appointed by NCSC to manage the Cyber Essentials scheme and accredit certification bodies.
ICO (Information Commissioner's Office): The UK's independent regulator for data protection and information rights, responsible for enforcing GDPR and investigating data breaches.

M

Malware: Malicious software designed to damage, disrupt, or gain unauthorised access to a computer system.
Malware Protection: One of the five Cyber Essentials technical controls: using anti-malware software, application allow-listing, or sandboxing to stop malicious software running on your devices.
MFA (Multi-Factor Authentication): A login method requiring two or more independent credentials, e.g. a password plus a one-time code.

N

NCSC: The National Cyber Security Centre, the UK's authority on cyber security, part of GCHQ.

P

Patch Management: The process of applying software updates (patches) to fix known security vulnerabilities in a timely manner. Cyber Essentials formally calls this control “Security Update Management” and requires critical patches within 14 days of release.
Penetration Testing: Authorised, simulated cyber attacks carried out by security professionals to identify exploitable weaknesses before a real attacker does.Browse our services
Phishing: A scam email, text, or message designed to trick the recipient into clicking a malicious link, downloading malware, or handing over login details. The starting point for most successful cyber attacks against SMEs.
PPN 014: Procurement Policy Note 014: UK government guidance listing public sector contracts that require Cyber Essentials certification.Cyber Essentials for government suppliers

R

Ransomware: Malware that encrypts a victim's files, with attackers demanding payment for the decryption key.
Readiness Review: A check of your Cyber Essentials submission before it goes for formal assessment, flagging anything likely to cause a failed first attempt.Why businesses choose us
Renewal: Cyber Essentials certification is valid for 12 months. Renewing means completing the assessment again against the current version of the standard, reflecting any changes to your systems since you last certified.How renewal works
Risk Assessment: The process of identifying what could go wrong, how likely it is, and how much damage it could cause, used to decide where to focus security effort and budget first.

S

Scope: The specific set of devices, networks, and cloud services covered by a Cyber Essentials assessment. It can cover your whole organisation or a defined sub-set, as long as the boundary is sensible and defensible.See how the process works
Secure Configuration: Ensuring systems are set up to minimise vulnerabilities, e.g. removing default passwords, disabling unnecessary services, and locking down settings on every device.
Security Awareness Training: Training staff to recognise phishing emails, social engineering, and other common threats. Not a formal Cyber Essentials control, but one of the most cost-effective ways to reduce risk.
Self-Assessment Questionnaire (SAQ): The set of questions you answer about your organisation's IT setup for standard Cyber Essentials, covering all five technical controls. Reviewed and verified by an assessor before certification is issued.See how the process works
SIEM (Security Information and Event Management): Software that collects and analyses security log data from across an organisation's systems in one place, used to spot suspicious patterns that a single device or user account wouldn't reveal on its own.
Social Engineering: Manipulating someone into breaking normal security procedures, e.g. by impersonating IT support or a senior colleague, rather than exploiting a technical flaw.
Software Firewall: A firewall running on an individual device rather than at the network boundary, filtering traffic to and from that specific laptop, desktop, or server. Cyber Essentials requires both boundary and software firewalls to be correctly configured.
Supply Chain Attack: An attack that compromises a trusted supplier, vendor, or piece of software in order to reach its customers, rather than attacking the target directly. A growing reason clients ask their suppliers for Cyber Essentials.

T

Two-Factor Authentication (2FA): A specific, common form of multi-factor authentication using exactly two credentials, typically a password plus a code from an app or text message.

V

VPN (Virtual Private Network): A service that encrypts your internet connection and routes it through a remote server, commonly used to protect data when working from public Wi-Fi or connecting to office systems remotely.
Vulnerability Scanning: Automated testing that identifies known security weaknesses across a network or application.Browse our services

Z

Zero Trust: A security approach that assumes no user or device should be trusted by default, even inside the network, and requires verification for every access request.
Zero-Day Vulnerability: A software flaw that's exploited by attackers before the vendor has released a fix, leaving no patch available at the time of the attack.

Get certified in as little as 5 days

Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.

Get a Quote Request a callback