IT Glossary for Small Business Owners

Updated October 22, 2026

IT providers, cyber insurers, and auditors use a lot of jargon. Here’s what the most common terms mean, in plain English.

A–D

Backup. A separate, versioned copy of your data that can be restored if the original is lost, deleted, or encrypted. Sync services like OneDrive aren’t backups on their own. See backup and disaster recovery.

BAA (business associate agreement). A contract required by HIPAA between a healthcare provider and any vendor that handles patient information on its behalf. See IT for medical and dental practices.

BEC (business email compromise). Fraud where criminals use a hacked or spoofed email account to trick someone into sending money or sensitive information. See how to spot phishing.

Break-fix. Paying for IT support by the hour when something breaks, as opposed to a managed services agreement.

Cloud. Software and storage run by a provider over the internet (Microsoft 365, a cloud EHR, QuickBooks Online) rather than on equipment in your office.

Conditional Access. A Microsoft 365 feature (in Business Premium and higher) that allows or blocks logins based on rules, such as location, device, or risk.

Cyber insurance. Insurance covering costs from cyber incidents: investigation, recovery, notification, legal fees, and sometimes ransom and lost income. Applications usually ask about your security controls.

DKIM, DMARC. Email authentication records that prove email from your domain is genuine. See SPF, DKIM, and DMARC explained.

DNS (Domain Name System). The internet’s address book. DNS records for your domain control where your website and email go.

E–L

EDR (endpoint detection and response). Security software that watches computers for suspicious behavior, not just known viruses, and can isolate an infected device. A step up from traditional antivirus.

Encryption. Scrambling data so it can only be read with a key. Laptop encryption (BitLocker on Windows, FileVault on Mac) means a lost laptop doesn’t expose your data.

Endpoint. Any device that connects to your network: laptops, desktops, phones, tablets, servers.

Firewall. A device or software that controls traffic between your network and the internet.

Immutable backup. A backup that can’t be changed or deleted for a set period, even by an administrator. A key defense against ransomware.

Intune. Microsoft’s device management service, included in Microsoft 365 Business Premium.

M–P

MDM (mobile device management). Software that lets a business secure, configure, and remotely wipe phones, tablets, and laptops.

MFA (multi-factor authentication). Requiring something beyond a password, such as an app approval or security key, to log in. See how to set up MFA.

MSP (managed service provider). An IT company that manages your technology for a recurring monthly fee. See managed IT pricing.

MSSP (managed security service provider). A provider focused specifically on security monitoring and response.

Passkey. A newer, phishing-resistant way to sign in that uses a credential stored on your device instead of a password.

Patch. A software update that fixes bugs or security holes.

Phishing. Fraudulent messages designed to steal passwords, money, or information, or to install malware.

PCI DSS. The security standard for businesses that accept credit cards.

R–Z

Ransomware. Malware that encrypts your files and demands payment to unlock them, often after stealing a copy of your data.

RMM (remote monitoring and management). Software IT providers install on your computers to monitor, update, and support them remotely.

RPO / RTO. Recovery point objective (how much data you can afford to lose) and recovery time objective (how long you can afford to be down).

Safeguards Rule. The FTC rule requiring many financial businesses, including tax preparers, to maintain an information security program. See IT for accounting and tax firms.

SIEM / SOC. A security information and event management system collects logs for analysis. A security operations center is the team that watches them.

SPF. An email record listing which services may send email for your domain.

Tenant. Your organization’s instance of a cloud service such as Microsoft 365. You should own and control your tenant.

VPN (virtual private network). An encrypted connection, often used to reach office systems remotely.

WISP (written information security plan). A document describing how a business protects sensitive information. Expected of tax professionals by the IRS.

Zero-day. A security flaw that attackers exploit before the vendor has released a fix.