The words, in plain English.

Everything you own that an attacker could reach and try.

Your website, your email, remote access, cloud accounts, and any device someone has plugged in and forgotten. It is usually larger than people expect, which is why an assessment starts by listing it rather than by recommending products.

A UK government-backed scheme that certifies a business has five basic security controls in place.

It covers firewalls, secure settings, access control, malware protection and keeping software up to date. Certification is issued by an accredited certification body, not by consultants, and it is increasingly asked for in public sector tenders and insurance applications. Most small firms can reach it in a few weeks.

The same five controls as Cyber Essentials, but verified by a hands-on technical audit rather than a questionnaire.

An assessor tests a sample of your devices and your email filtering themselves instead of taking your word for it. You have to hold standard Cyber Essentials first, usually within the previous three months. It costs more and takes longer, and some contracts specifically require it.

Security software on each laptop, desktop and server that spots suspicious behaviour and can isolate the machine.

It goes further than traditional antivirus, which matches known bad files. EDR watches what a program does, so it can catch something new by its behaviour. On its own it still needs a person to review what it finds, which is what MDR adds.

A backup copy that cannot be altered or deleted for a set period, even by an administrator.

Ransomware operators look for the backups first, and a backup on the same network with the same credentials is not a backup. Immutability, an off-site copy, and a restore you have actually rehearsed are what turn a bad week into a bad afternoon.

The plan and the practice for what you do in the hours after something goes wrong.

Who decides to pull the plug, who calls the insurer, who tells clients, and in what order. A plan nobody has rehearsed tends to fall apart under pressure, which is why the exercise matters more than the document.

An international standard for running a documented, audited information security management system.

It is a management framework rather than a checklist of technical controls, and it is a far bigger undertaking than Cyber Essentials. Certification is issued by an accredited certification body after an audit. It usually becomes worth it when large clients or regulators start asking for it by name.

A service where someone else watches your systems around the clock and acts when something is wrong.

Detection software alone produces alerts that nobody reads at three in the morning. MDR puts a staffed security operations centre behind those alerts, so an intrusion is investigated and contained rather than logged. It is the practical answer for a business with no security team of its own.

Requiring something more than a password to sign in, usually a code or a prompt on a phone.

It is the single most effective control available, because a stolen password on its own stops being enough. Cyber Essentials requires it on cloud services. App-based prompts and hardware keys are meaningfully stronger than codes sent by text.

Installing the fixes vendors release for security flaws in the software you run.

Most breaches exploit a flaw that was fixed months earlier. Cyber Essentials requires high-risk and critical updates within 14 days, and requires that you stop using software the vendor no longer supports at all.

An authorised, controlled attack on your systems by a specialist, to find what a real attacker could reach.

A tester works to an agreed scope and a fixed window, then reports what they got into and how. It is different from a vulnerability scan, which is automated and lists known weaknesses. A test tells you what someone skilled can actually chain together.

A message designed to trick someone into handing over credentials, money or access.

Most successful attacks start here rather than with anything technical. Modern attempts are well written, often reference real projects or suppliers, and increasingly arrive by text or phone as well as email.

Malicious software that encrypts your files and demands payment, usually after the attacker has already copied the data.

Paying does not reliably get the data back and does not undo the copy they took. What decides how bad it gets is whether you have backups an attacker cannot reach and have actually tested restoring from.

A system that collects logs from everything you run and correlates them into one picture.

Your firewall, your servers, your email and your laptops each record events separately, and an attack usually shows up as a pattern across several of them. A SIEM brings those together so the pattern is visible, and keeps the record for when you need to prove what happened.

Three DNS records that together stop other people sending email that appears to come from your domain.

SPF lists who may send on your behalf, DKIM signs your messages so tampering shows, and DMARC tells receiving mail servers what to do when a message fails those checks and reports back to you. Published but unenforced records are common and do almost nothing, which is why the free security check looks at the policy rather than just the record.

The UK's data protection law, which governs how organisations handle personal data.

It requires a lawful basis for processing, honesty about what you hold, appropriate security, and reporting serious breaches to the Information Commissioner's Office within 72 hours. It applies to a five-person firm in the same way it applies to a bank, at a scale proportionate to the risk.

A senior security lead you retain for a few hours a month instead of employing full time.

A Chief Information Security Officer sets security direction, owns the risk picture and answers to the board. A vCISO does the same job at a scale that suits a business of twenty or fifty people, typically writing the policies, running the supplier questionnaires and sitting in the meetings where security questions land.

A design principle that treats every request as untrusted, wherever it comes from.

The older model assumed anything inside the office network was safe. With laptops at home and data in cloud services, there is no inside any more, so access is granted per request based on who is asking and from what device, rather than on which network they are on.