Small Business IT Glossary: 60 Terms in Plain English

This IT terms glossary defines 60 words and acronyms small business owners hear from IT providers, insurers and Microsoft, in plain English, from access point to Wi-Fi site survey. Each entry is short and links to where we cover the topic in depth.

Most of these words turn up in a proposal, an insurance application or a Microsoft notice long before anyone explains them. Some are vendor jargon you can safely ignore, while a few, like EDR and MFA, quietly decide what you pay each month and what an insurer will actually agree to cover.

So I kept every definition short and wrote it the way I’d explain it across a desk. The technical detail in each one was checked against Microsoft’s documentation, the NIST Computer Security Resource Center glossary and CISA guidance. Where a term is part of what VJNetworks does through our managed IT services, I say so. Where we work differently from the textbook, I say that too.

Terms run alphabetically. Acronyms sit under the acronym, so EDR is filed under E. Tap a letter to jump.

A

Access point

The device, usually on the ceiling, that connects laptops and phones to your network over Wi-Fi. How many you need depends on walls, floors and layout far more than on headcount. One 45-person office my team supports runs on two. Why so few? The whole floor is open cubicles. We plan, install and manage Wi-Fi as part of our support, and the numbers are in what business Wi-Fi costs to install.

Active Directory

Microsoft’s directory for Windows networks that run on a server you own. It holds the list of users, computers and groups, checks each sign-in against that list, and applies the settings an administrator has chosen for who can log in where and what each computer is allowed to do. Older offices often still have one humming away in a closet. Its cloud cousin is Microsoft Entra ID. Plenty of businesses run both, kept in sync so people use the same password for both.

Antivirus

Software that checks files and programs against known threats and blocks or removes what it recognizes. Traditional antivirus works mainly from a catalogue of malware someone has already seen. Useful. Also its limit. Something brand new, or an attacker using ordinary admin tools, can slip past, which is the gap we cover in EDR versus antivirus.

Azure

Microsoft’s cloud platform, where servers, storage and databases run in Microsoft’s data centers instead of your back room. For a small business it usually comes up when an old server is due for replacement. Cheaper? Not per seat. Hosting people’s desktops in Azure costs noticeably more per seat than local machines. What you get back is recovery built into the setup itself. Costs are broken out in what it costs to move a server to Azure.

B

Backup

A copy of your data kept somewhere else, so a deleted file, a dead drive or ransomware doesn’t take the only copy with it. Two things matter more than which software runs it. Where the copies live. Whether anyone has actually tested a restore. My team backs up servers, keeps company data off individual workstations by design, and prices it by storage space. Our backup and disaster recovery service has the detail.

“We generally employ different tactics to make sure that the data that’s on a workstation isn’t only on the workstation. We generally just back up servers. And it isn’t really a per server cost. It’s really a space cost.”

Mike Stoveken, VJNetworks

Break-fix

Paying an IT company by the hour or by the job, only when something breaks, with no monthly fee. MSP marketing gives it a bad name, and that isn’t entirely fair. A business that buys good equipment, runs stable software and approves the work when it’s recommended can do fine on it, saving money every month and spending only when something actually needs attention. Where it goes wrong is when the recommended fix keeps getting put off. We compare the two in managed IT versus break-fix.

Business email compromise (BEC)

A scam where someone poses as a boss, a vendor or a client over email and talks a staff member into wiring money or changing bank details. Often there’s no malware involved at all. Just a convincing message, sometimes sent from a real mailbox that was broken into weeks earlier. The FBI’s Internet Crime Complaint Center ranks it among the costliest crimes reported to it. Our business email compromise explainer shows how one unfolds.

C

Cloud computing

Using computing power, storage and software from someone else’s data center over the internet instead of owning the hardware. NIST’s formal definition runs longer. The core is on-demand access you can scale up or down and pay for by use. For most of our clients in Rockland, Westchester and Bergen, the cloud means Microsoft 365 for email, files and Teams, and sometimes Azure for a server that used to sit in a closet down the hall. See our cloud and Microsoft 365 services.

Co-managed IT

Keeping your own IT person or team and adding an MSP alongside them. It adds to the internal team. It doesn’t replace it. The split follows what the client asks for, so some hand over servers, network, cloud and backups and keep desktop support in-house. With us there’s a standing check-in every two weeks. When the internal person takes a vacation, coverage doesn’t leave with them. More on our co-managed IT services page.

Conditional Access

A Microsoft Entra feature that decides whether to allow a sign-in based on conditions you set, such as who the user is, which device they’re on and where they’re signing in from. It can ask for a second factor, block the login or require a managed device. It needs Entra ID P1, which comes with Microsoft 365 Business Premium. Rules based on how risky a sign-in looks need Entra ID P2, which Premium doesn’t include on its own. Set it up carefully. A careless rule can lock out the whole office, admins included. The plan differences are laid out in Business Basic, Standard or Premium.

Cyber insurance

A policy that helps pay for what follows a cyber incident, such as investigation, notifying customers, restoring systems and legal claims, depending on the policy. The application is now a detailed security questionnaire. Insurers ask about MFA, backups and endpoint protection, and weak answers can mean a higher premium or no policy at all. Answer honestly. Our cyber insurance readiness work helps owners get those answers right.

D

Disaster recovery (DR)

The plan and the tools for getting systems running again after something big goes wrong. A dead server, a fire, a ransomware attack. Backup is the copy. Disaster recovery is the work of putting it back and getting people working. Restores are less forgiving than they look, and I don’t recommend anyone run one without knowing exactly what it will overwrite. Get it wrong and a shared folder, plus a day of everyone’s work, can vanish.

DKIM

Short for DomainKeys Identified Mail. Your mail system signs each outgoing message with a private key, and receiving servers check that signature against a public key published in your domain’s DNS. A valid signature tells them the message was signed by someone holding your domain’s key and that the signed parts weren’t altered in transit. It’s one of three records covered in our SPF, DKIM and DMARC guide.

DMARC

A DNS record that tells other mail servers what to do with a message that claims to come from your domain but fails the SPF and DKIM checks tied to it. Deliver it anyway, send it to spam, or reject it. DMARC also asks those servers to send you reports, so you can see who is sending mail in your name. Without it, spoofing your domain stays easy. The setup order is in stopping someone spoofing your domain.

E

EDR (endpoint detection and response)

Security software on each computer and server that records what’s happening, spots suspicious behavior and can act on it, isolating the machine or killing a process, instead of only matching known malware. Microsoft 365 Business Premium includes Microsoft Defender for Business, an EDR product, though Microsoft licenses its server protection as a separate add-on. Endpoint security with monitoring is part of our standard managed agreement. Why insurers care is in how EDR differs from antivirus.

“You definitely want EDR [endpoint detection and response] on all your workstations and servers. If you don’t have something like that, you’re just asking for it, really.”

Mike Stoveken, VJNetworks

Emergency access account

Also called a break-glass account. A spare global administrator account kept out of daily use, with its credentials stored securely, for the day the normal admin sign-in fails or the only admin leaves the company. Microsoft recommends at least two. In the roadmap order I recommend, securing admin accounts and setting this up comes fourth, right after protecting internet-facing accounts. Ownership questions are in who owns the company Microsoft account.

“Some companies don’t have that and lose access to their global admin, and then they can’t do anything.”

Mike Stoveken, VJNetworks

Encryption

Scrambling data so only someone with the right key can read it. It protects data sitting on a laptop or server (at rest) and data moving across a network or the internet (in transit). Insurance agencies were among the first of our clients to need encrypted email. For medical offices our standing advice is that anything carrying patient health information goes by encrypted email, and we build encrypted connections to the vendors they exchange it with.

End of support

The date a vendor stops providing routine security updates for a product. The software keeps running, and that’s the trap. It just stops getting fixes, so flaws found afterward stay open unless you pay for extended security updates where the vendor sells them. Microsoft publishes these dates on its lifecycle pages. Windows 10 reached end of support on October 14, 2025, and Windows Server 2016 follows on January 12, 2027, which we cover in our Windows Server 2016 guide.

Endpoint

Any device at the edge of your network that people use to get work done. Laptops, desktops, servers, phones, tablets. Endpoints are where staff click links, open attachments and plug in the occasional USB drive from home, so that’s where much of the protection has to sit, whatever else is in place. When a provider says endpoint security, that’s the list it means, and it’s a core part of our cybersecurity services.

Entra ID

Microsoft Entra ID is the cloud directory behind Microsoft 365. Until 2023 it was called Azure Active Directory. Same product, new name. Every user account, password reset, MFA setting and Conditional Access rule lives here. If you sign in to Outlook or Teams with a work address, Entra ID is the thing checking you. What the paid tiers add, and what they cost, is in what identity and access management costs.

F

Firewall

A device or software that sits between your network and the internet and decides, by rules, which traffic gets through. A business firewall usually adds paid security services on top, things like web filtering, intrusion prevention and threat updates, sold as a subscription. Who looks after it? Under our agreements the hardware is a separate purchase and the management is included. See managed firewall and network security.

G

Global administrator

The most powerful role in a Microsoft 365 tenant. A global admin can change any setting, reset any password and reach almost any data. Microsoft advises keeping fewer than five people in the role and using narrower admin roles for day-to-day work. Keep that list short. Lose the only global admin login and a business can be locked out of its own tenant, which is why the emergency access account exists.

H

Help desk

The people you contact when something isn’t working. You call, email or open a ticket, someone triages it and routes it to the right technician, and most problems get fixed remotely while you watch, without anyone needing to drive over. The calls we see most are passwords, printers, something that went missing, Outlook and QuickBooks, in about that order. VJNetworks responds within 15 minutes during business hours, and often sooner. Details are on our help desk support page.

I

Identity and access management (IAM)

Everything that controls who gets into which systems. User accounts, how people prove who they are, what each person is allowed to open, and how fast all of it is shut off when they leave. For a small office that mostly means one directory, MFA everywhere, sensible permissions and a clean offboarding routine. Why the second factor alone falls short is covered in why MFA alone isn’t enough.

Intune

Microsoft’s service for managing laptops, desktops and phones from the cloud. It pushes settings and apps, enforces encryption and screen locks, and can wipe company data from a lost device. Intune is included in Microsoft 365 Business Premium. It’s also how a device gets marked compliant, which Conditional Access can then require before it lets anyone sign in.

ITDR (identity threat detection and response)

Tools that watch sign-ins and identity systems for signs an account has been taken over, such as a login from an impossible location, a new mail forwarding rule or an admin role granted out of nowhere, and respond by cutting the session or locking the account. EDR watches devices. ITDR watches accounts. As attacks get more sophisticated, more tools like this drift from optional toward expected.

L

Least privilege

Giving each person, and each piece of software, only the access the job needs, and nothing extra. The bookkeeper gets the accounting folder, not the whole file server. Nobody browses the web from an admin account. Simple to say. Offices tend to drift away from it over the years as people change roles, pick up extra duties and quietly keep every permission they ever had, so it needs regular checking rather than a one-time setup.

Line-of-business application

The software a company actually runs on. Practice management, estimating and job costing, a design suite, an accounting package. If it stops, people stop. These apps often come with specific requirements, a database server or a license server behind them, and vendors who are particular about what they’ll support. Supporting them is part of our agreements where a client depends on one. Hosting options are in line-of-business apps that can’t move to the cloud.

M

MDR (managed detection and response)

A service, not a product. Someone else runs your detection tools, reviews the alerts and responds when something is real. MDR usually sits on top of EDR, and offerings differ mostly in who reviews the alerts and what they’re allowed to do about them. Ask any provider to explain that in plain terms before you sign. Ours is described on the managed detection and response page.

MFA (multi-factor authentication)

Proving who you are with two or more different kinds of evidence, something you know like a password, something you have like a phone or security key, or something you are like a fingerprint. On public-facing accounts, email above all, it’s one of the first controls I’d put in place. No exceptions for the boss. Microsoft stops sending its own text message and voice codes for Entra MFA on February 1, 2027 for most users, and July 1, 2027 for Global Administrators, and it is steering people to passkeys. Insurers’ angle is in MFA enforced versus available. If some staff have no smartphone, the sign-in options that don’t need one are compared here.

Microsoft 365

Microsoft’s subscription bundle of Outlook email, Teams, OneDrive, SharePoint and, on most business plans, the desktop Office apps. Security depends on the plan. Basic and Standard share one baseline, and Premium adds Conditional Access, Intune and Defender for Business. A lot of what protects a small office is license-gated, so the plan matters more than people expect. Check which one you’re on. Weighing it against Google’s suite? See Microsoft 365 vs Google Workspace.

MSP (managed service provider)

An IT company that looks after a business’s technology for a monthly fee under a written agreement, instead of billing by the hour. Ours covers unlimited support, endpoint security and monitoring, Microsoft 365 or Google Workspace management, network security, repairs, help meeting compliance goals, onboarding and offboarding, and vCIO strategy and roadmapping. Materials, hardware and toner are billed separately, and we spell out what isn’t covered before anyone signs. Plans start at $995/month. See what managed IT includes.

“You’re not gonna get a surprise bill for something that you didn’t approve of.”

Mike Stoveken, VJNetworks

MSSP (managed security service provider)

A company that specializes in security, monitoring and managing security tools for its clients. An MSP runs the whole IT environment and includes security inside it. Larger organizations with their own IT staff often hire an MSSP on top of everything else, because they want security specialists reviewing alerts that their internal team doesn’t have time to watch. Most small businesses don’t need two providers. They need one that covers the basics well and is honest about where its security service stops.

N

Network segmentation

Splitting one network into separate zones so a problem in one can’t spread freely into the others. Guest Wi-Fi on its own segment, office machines on another, printers or shop equipment on a third. It’s done with VLANs and firewall rules, and it is far easier to plan in at the start than to retrofit once devices pile up. The simplest version is separating guest Wi-Fi from the business network.

NIST Cybersecurity Framework (CSF)

A free framework from the National Institute of Standards and Technology for organizing security work. Version 2.0, released in February 2024, groups it under six functions, Govern, Identify, Protect, Detect, Respond and Recover. Compliance frameworks look different on paper and ask for much the same practices underneath, and CSF is a clean way to see that. We walk clients through it in a NIST CSF gap assessment.

O

Offboarding

Everything that has to happen to IT access when someone leaves. Disable the account, end active sessions and remove their MFA methods, collect devices, hand their mailbox and files to the right person, change any shared passwords they ever knew. The first hour matters most, especially when the departure isn’t friendly. Onboarding and offboarding are part of the HR side of our agreements. The order of steps is in what has to happen in the first hour.

Onboarding

Getting a new hire’s technology ready before day one. An account, a licensed mailbox, a configured laptop, MFA enrolled, access to the right shared folders and nothing more. Done well, the person starts work the first morning instead of waiting on a password. Rushed, they tend to inherit a predecessor’s permissions. A working list is in the new-hire IT onboarding checklist.

OneDrive

Microsoft’s per-user cloud storage, included with Microsoft 365. It syncs a person’s files across their devices and lets them share individual files. Where it gets misused is as the company file share. Easy mistake. OneDrive is built around one user, SharePoint around the company, and most businesses I see should be putting far more of their shared work in SharePoint than they do today. Which goes where is covered in SharePoint, OneDrive or a file server.

P

Passkey

A sign-in credential that replaces the password with a cryptographic key stored on your phone, laptop or a hardware security key. You unlock it with a fingerprint, your face or the device PIN, and it only works on the real site it was created for, so a fake login page can’t capture it. Once it’s set up on a device, the repeated code prompts largely stop. No code to type. Licensing notes are in the identity and access management cost guide. How passkeys change staff sign-in after February 1, 2027 is in our guide to passkeys at Microsoft sign-in.

Password manager

An encrypted vault that creates, stores and fills in passwords, so staff can use a different long password for every site without memorizing any of them. Business versions add shared folders for team logins and let you remove a departing employee from the shared vault in one step. BitWarden is our recommended system. What separates the good options is in password managers for small business teams.

Patch management

Finding, testing and installing updates for operating systems, applications and device firmware on a schedule, then confirming they actually installed. Attackers routinely go after flaws that already have a fix available, which is why CISA keeps a public catalog of known exploited vulnerabilities. Boring work, and it matters. Patching servers, workstations and network gear is ongoing maintenance in a managed agreement, not a chore left for whenever someone in the office happens to remember that the update prompt has been nagging for three weeks. For firewalls and VPNs specifically, see where firewall updates slip.

Phishing

A message built to trick someone into clicking a link, opening an attachment, typing a password or sending money. Email is the classic channel. Texts, phone calls and fake login pages count too. Filters catch a lot of it and never all of it, so the last line of defense is a person at a desk who pauses for two seconds before clicking a link that feels slightly off.

R

Ransomware

Malicious software that encrypts a victim’s files and systems and demands payment for the key. Many groups now steal a copy of the data first and threaten to publish it, so a clean backup alone doesn’t end the extortion. CISA’s StopRansomware guide is a sound place to start on prevention. Why no business is too small to be hit is covered in small business ransomware protection.

RMM (remote monitoring and management)

The software an IT provider uses to watch the health of computers and servers, push updates and connect remotely to fix things. It’s the reason support rarely means someone standing behind your chair anymore. We started deploying remote access tools around 2006 or 2007, and today most problems get looked at with you on a shared screen, which beats waiting half an hour for someone to show up and take over your desk. Because RMM tools have such deep access, CISA has warned that attackers abuse them too. Who holds those keys matters.

RPO (recovery point objective)

How much data, measured in time, a business can afford to lose. If backups run nightly and the server dies at 4 p.m., up to a day of work is gone, so the effective RPO is about a day. NIST describes it as the point in time to which data must be recovered after an outage. IT documentation uses the term constantly. Very few small business owners ever set one formally.

RTO (recovery time objective)

The longest a system can stay down before the outage does real harm, in other words the target for getting it back. Large organizations write these down system by system. In my career I’ve never had a client hand me one, and it isn’t a term I use with clients. We talk in plain estimates instead. Looks like another three hours for this restore.

“No one has ever said to me, ‘We need to be back up and running in 6.4 hours.’ Like, no one has ever said that to me. We just get them up and running as soon as we can.”

Mike Stoveken, VJNetworks

S

SaaS (software as a service)

Software you use through a browser or app and pay for by subscription, while the vendor runs the servers and the updates. Microsoft 365, QuickBooks Online and most CRMs are SaaS. The vendor handles the plumbing. You still own your data, your user accounts and who gets access, which is the part people forget, and the reason we wrote Microsoft secures the cloud, you secure what’s in it.

Security awareness training

Short, regular training that teaches staff to spot phishing, handle passwords properly and report anything odd, usually paired with simulated phishing emails to see who clicks. It’s the fifth step in the roadmap order I recommend, after the security baseline, endpoint protection, internet-facing accounts and admin accounts. The goal isn’t a quiz score. It’s people who stop falling for the same tricks.

Shadow IT

Apps, cloud services and devices staff use for work without IT knowing about them. A personal file-sharing account. A free PDF converter. A team signing up for a project tool on someone’s credit card. Usually well meant. Still a problem, because company data ends up in accounts nobody at the company controls, nobody backs up, nobody secures and nobody remembers to shut off when that person eventually leaves. More in shadow IT at a small business.

SharePoint

Microsoft 365’s shared document storage, organized into sites and libraries that belong to the company rather than to any one person. Think company filing cabinet. Permissions are set by group, files stay put when an employee leaves, and Teams keeps the files shared in its channels here behind the scenes. For a lot of the businesses we support, it’s a better home for shared work than a personal OneDrive or an aging file server. The trade-offs are in retiring a file server for SharePoint.

SIEM (security information and event management)

A system that pulls logs from firewalls, servers, sign-ins and security tools into one place, links related events and raises alerts. A SIEM is only as useful as the people tuning it and reading what it produces. Without them it’s an expensive log archive. Logs alone protect nothing. Larger organizations run one inside a SOC. Smaller businesses may get similar benefit through an MDR service instead.

SIM swapping

An attack where a criminal gets a mobile carrier to move your phone number onto a SIM card they control, then receives your text-message codes. A related technique abuses SS7, the old signaling network carriers use to route calls and texts. In my view text codes are still reasonably safe for most people in the US. The risk climbs with how valuable a target you are. Account protection beyond SMS is covered in identity and access management.

“It is a security risk, but it’s one of those, like, very scaled security risks. Very high effort. So it better be high reward.”

Mike Stoveken, VJNetworks

SLA (service level agreement)

The part of an IT contract that puts numbers on the service, usually how fast the provider responds and sometimes how fast it resolves. Read the definitions closely. A response and a fix are different things, and so are the hours the clock runs. Ours is simple. A response within 15 minutes during business hours, which we treat as a ceiling rather than a target. What’s reasonable is covered in IT support response times.

SOC (security operations center)

A team, and the platform it works from, dedicated to monitoring an organization’s security alerts and responding to incidents. Large companies build their own. Smaller ones usually reach one through an MSSP or an MDR provider. When a proposal mentions a SOC, ask who staffs it, what they’re authorized to do and how they reach you. Not to be confused with SOC 2, a CPA’s report on a service provider’s controls.

SPF (Sender Policy Framework)

A DNS record listing which mail servers may send email for your domain. Receiving servers check it, and mail from anywhere else looks suspect. The usual mistake is leaving out a service, a newsletter tool or a billing system, so its legitimate mail fails. SPF also limits each check to 10 DNS lookups, counting the ones inside included records, and going over makes the whole check fail. Busy domains trip over this. Our walkthrough is in the three records that stop spoofing.

V

vCIO (virtual chief information officer)

Part-time technology leadership from your IT provider. A vCIO looks at where the business is heading and plans the technology to match, budgets, replacements, security priorities and the order to tackle them in. We call it vCIO strategy and roadmapping, and for most small businesses an annual plan fits better than a standing calendar of meetings. Nobody likes extra meetings. My roadmaps start with a security baseline. More on our virtual CIO page.

vCISO (virtual chief information security officer)

Part-time security leadership. Where a vCIO plans the whole technology picture, a vCISO focuses on risk, security policy, insurance questionnaires and the security program behind them. Most small businesses don’t need a full-time security executive. Some do need one person accountable for those decisions. See vCISO services.

VPN (virtual private network)

An encrypted tunnel over the internet, between a device and the office network or between two offices. Remote staff connect and work as if they were at their desk. Nothing exotic. Companies with several locations can link them with site-to-site VPN. We use VPN for remote access, and for most businesses running three to ten sites, a well-configured site-to-site VPN mesh is still fine. Multi-site planning is in IT strategy for multiple locations.

Vulnerability assessment

A structured search for weaknesses, missing patches, exposed services, weak configurations, accounts that should have been closed months ago, then ranked by how much damage each one could do if someone else found it first. Scanners find a lot of it automatically. The judgment is in deciding what to fix first. It’s different from a penetration test, where someone actively tries to break in. Ours is described on security risk and vulnerability assessment.

W

Wi-Fi site survey

Measuring a space before installing Wi-Fi, mapping where signal is strong, weak or blocked by walls, glass, metal shelving or another floor, so access points go where they’re needed. A tiny office with a single access point rarely needs one. A larger floor, or several floors, usually does. That’s when we do it. Prices and the variables behind them are in our Wi-Fi installation cost guide.

Ten Pairs That Get Mixed Up

Half the confusion in IT conversations comes from two terms that sound alike and mean different things. The quick version of each, all covered above.

Questions Owners Ask About These Terms