# Cyber Essentials glossary

> 154 Cyber Essentials and IT security terms in plain English, each linked to the control and questions it affects. Terms marked as NCSC definitions quote section B of NCSC Requirements for IT Infrastructure v3.3.

Machine-readable version: https://cyberessentialspreparation.com/glossary.json. Site index: https://cyberessentialspreparation.com/llms.txt.

## Accounts and access
- [Account lockout](https://cyberessentialspreparation.com/glossary/account-lockout.md): Account lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
- [Active Directory (AD)](https://cyberessentialspreparation.com/glossary/active-directory.md): Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.
- [Administrator account](https://cyberessentialspreparation.com/glossary/administrator-account.md): An administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- [Authenticator app](https://cyberessentialspreparation.com/glossary/authenticator-app.md): An authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
- [Biometrics](https://cyberessentialspreparation.com/glossary/biometrics.md): Biometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
- [Brute-force attack](https://cyberessentialspreparation.com/glossary/brute-force-attack.md): A brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
- [Cloud tenant](https://cyberessentialspreparation.com/glossary/cloud-tenant.md): A cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
- [Conditional access](https://cyberessentialspreparation.com/glossary/conditional-access.md): Conditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.
- [Credential stuffing](https://cyberessentialspreparation.com/glossary/credential-stuffing.md): Credential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.
- [FIDO2](https://cyberessentialspreparation.com/glossary/fido2.md): FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
- [Global administrator](https://cyberessentialspreparation.com/glossary/global-administrator.md): A global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
- [Group policy](https://cyberessentialspreparation.com/glossary/group-policy.md): Group policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
- [Identity provider (IdP)](https://cyberessentialspreparation.com/glossary/identity-provider.md): An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
- [Joiners, movers and leavers (JML)](https://cyberessentialspreparation.com/glossary/joiners-movers-leavers.md): Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
- [Least privilege](https://cyberessentialspreparation.com/glossary/least-privilege.md): Least privilege is the rule that each person gets only the access they need to do their current job, and nothing more.
- [Multi-factor authentication (MFA)](https://cyberessentialspreparation.com/glossary/multi-factor-authentication.md): Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- [Passkey](https://cyberessentialspreparation.com/glossary/passkey.md): A passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- [Passphrase](https://cyberessentialspreparation.com/glossary/passphrase.md): A passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.
- [Password](https://cyberessentialspreparation.com/glossary/password.md): A password is a secret string of characters that you type to prove you are the person an account belongs to.
- [Password manager](https://cyberessentialspreparation.com/glossary/password-manager.md): A password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
- [Passwordless authentication](https://cyberessentialspreparation.com/glossary/passwordless-authentication.md): Passwordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or…
- [Privileged access](https://cyberessentialspreparation.com/glossary/privileged-access.md): Privileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- [Service account](https://cyberessentialspreparation.com/glossary/service-account.md): A service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
- [Shared account](https://cyberessentialspreparation.com/glossary/shared-account.md): A shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
- [Single sign-on (SSO)](https://cyberessentialspreparation.com/glossary/single-sign-on.md): Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.
- [SMS verification codes](https://cyberessentialspreparation.com/glossary/sms-verification-codes.md): SMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.
- [Standard user account](https://cyberessentialspreparation.com/glossary/standard-user-account.md): A standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
- [Throttling](https://cyberessentialspreparation.com/glossary/throttling.md): Throttling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
- [User account](https://cyberessentialspreparation.com/glossary/user-account.md): A user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
- [User Account Control (UAC)](https://cyberessentialspreparation.com/glossary/user-account-control.md): User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer.
- [Windows LAPS](https://cyberessentialspreparation.com/glossary/laps.md): LAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.

## Devices and software
- [Auto-run (AutoRun and AutoPlay)](https://cyberessentialspreparation.com/glossary/auto-run.md): Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.
- [Browser extension](https://cyberessentialspreparation.com/glossary/browser-extension.md): A browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
- [BYOD (bring your own device)](https://cyberessentialspreparation.com/glossary/byod.md): BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- [CVE (Common Vulnerabilities and Exposures)](https://cyberessentialspreparation.com/glossary/cve.md): A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
- [CVSS (Common Vulnerability Scoring System)](https://cyberessentialspreparation.com/glossary/cvss.md): CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- [Device unlocking](https://cyberessentialspreparation.com/glossary/device-unlocking.md): Device unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
- [Devices](https://cyberessentialspreparation.com/glossary/devices.md): Devices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.
- [End of support (end of life)](https://cyberessentialspreparation.com/glossary/end-of-support.md): End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
- [End-user device (EUD)](https://cyberessentialspreparation.com/glossary/end-user-device.md): An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
- [Extended Security Updates (ESU)](https://cyberessentialspreparation.com/glossary/extended-security-updates.md): Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.
- [Firmware](https://cyberessentialspreparation.com/glossary/firmware.md): Firmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
- [Hypervisor](https://cyberessentialspreparation.com/glossary/hypervisor.md): A hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
- [Jailbreaking and rooting](https://cyberessentialspreparation.com/glossary/jailbreaking-and-rooting.md): Jailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.
- [Licensed and supported software](https://cyberessentialspreparation.com/glossary/licensed-and-supported-software.md): Licensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- [Long-term support (LTS)](https://cyberessentialspreparation.com/glossary/long-term-support.md): Long-term support is a version of a product that the vendor commits to keep fixing for several years, rather than the shorter period a normal release gets.
- [Macros](https://cyberessentialspreparation.com/glossary/macros.md): A macro is a small program saved inside a document or spreadsheet that automates tasks, and it can run as soon as the file is opened.
- [Mobile device management (MDM)](https://cyberessentialspreparation.com/glossary/mobile-device-management.md): Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
- [Open-source software](https://cyberessentialspreparation.com/glossary/open-source-software.md): Open-source software is software whose source code is published for anyone to use, change and share under the terms of its licence, often at no cost.
- [Operating system (OS)](https://cyberessentialspreparation.com/glossary/operating-system.md): An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android.
- [Patch management](https://cyberessentialspreparation.com/glossary/patch-management.md): Patch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
- [Remote monitoring and management (RMM)](https://cyberessentialspreparation.com/glossary/remote-monitoring-and-management.md): Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance.
- [Secure configuration](https://cyberessentialspreparation.com/glossary/secure-configuration.md): Secure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
- [Security update (security patch)](https://cyberessentialspreparation.com/glossary/security-update.md): A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
- [Servers](https://cyberessentialspreparation.com/glossary/servers.md): Servers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- [Software](https://cyberessentialspreparation.com/glossary/software.md): In Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
- [Thin client](https://cyberessentialspreparation.com/glossary/thin-client.md): A thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
- [Unnecessary software](https://cyberessentialspreparation.com/glossary/unnecessary-software.md): Unnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use.
- [Vendor](https://cyberessentialspreparation.com/glossary/vendor.md): A vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws.
- [Virtual desktop infrastructure (VDI)](https://cyberessentialspreparation.com/glossary/virtual-desktop-infrastructure.md): Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
- [Virtual machine (VM)](https://cyberessentialspreparation.com/glossary/virtual-machine.md): A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
- [Vulnerability fixes](https://cyberessentialspreparation.com/glossary/vulnerability-fixes.md): Vulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- [Zero-day vulnerability](https://cyberessentialspreparation.com/glossary/zero-day.md): A zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.

## Malware, cloud and threats
- [Allow listing (application allow listing)](https://cyberessentialspreparation.com/glossary/allow-listing.md): Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.
- [Anti-malware software](https://cyberessentialspreparation.com/glossary/anti-malware-software.md): Anti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.
- [Application control](https://cyberessentialspreparation.com/glossary/application-control.md): Application control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else.
- [Attack surface](https://cyberessentialspreparation.com/glossary/attack-surface.md): An attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software.
- [Authenticated scan](https://cyberessentialspreparation.com/glossary/authenticated-scan.md): An authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.
- [Backup](https://cyberessentialspreparation.com/glossary/backup.md): A backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost.
- [Cloud service](https://cyberessentialspreparation.com/glossary/cloud-service.md): A cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- [Commodity attacks](https://cyberessentialspreparation.com/glossary/commodity-attacks.md): Commodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically.
- [EDR (endpoint detection and response)](https://cyberessentialspreparation.com/glossary/endpoint-detection-and-response.md): Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.
- [Encryption](https://cyberessentialspreparation.com/glossary/encryption.md): Encryption is scrambling information with a secret key so that only someone holding the right key can read it.
- [Exploit](https://cyberessentialspreparation.com/glossary/exploit.md): An exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in.
- [Full-disk encryption](https://cyberessentialspreparation.com/glossary/full-disk-encryption.md): Full-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first.
- [IaaS (Infrastructure as a Service)](https://cyberessentialspreparation.com/glossary/iaas.md): Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.
- [Malware](https://cyberessentialspreparation.com/glossary/malware.md): Malware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
- [Managed service provider (MSP)](https://cyberessentialspreparation.com/glossary/managed-service-provider.md): A managed service provider (MSP) is an outside company you pay to run or support your IT.
- [PaaS (Platform as a Service)](https://cyberessentialspreparation.com/glossary/paas.md): Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.
- [Penetration test](https://cyberessentialspreparation.com/glossary/penetration-test.md): A penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
- [Phishing](https://cyberessentialspreparation.com/glossary/phishing.md): Phishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
- [Ransomware](https://cyberessentialspreparation.com/glossary/ransomware.md): Ransomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
- [SaaS (Software as a Service)](https://cyberessentialspreparation.com/glossary/saas.md): Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- [Sandboxing](https://cyberessentialspreparation.com/glossary/sandboxing.md): Sandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
- [Security operations centre (SOC)](https://cyberessentialspreparation.com/glossary/security-operations-centre.md): A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
- [Shared responsibility model](https://cyberessentialspreparation.com/glossary/shared-responsibility-model.md): A shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job.
- [Signature-based detection](https://cyberessentialspreparation.com/glossary/signature-based-detection.md): Signature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.
- [Social engineering](https://cyberessentialspreparation.com/glossary/social-engineering.md): Social engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.
- [Supply chain security](https://cyberessentialspreparation.com/glossary/supply-chain-security.md): Supply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in.
- [Vulnerability scan](https://cyberessentialspreparation.com/glossary/vulnerability-scan.md): A vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.

## Networks and firewalls
- [Admin interface](https://cyberessentialspreparation.com/glossary/admin-interface.md): An admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.
- [Boundary firewall](https://cyberessentialspreparation.com/glossary/boundary-firewall.md): A boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.
- [Corporate VPN](https://cyberessentialspreparation.com/glossary/corporate-vpn.md): A corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply.
- [Default password](https://cyberessentialspreparation.com/glossary/default-password.md): A default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.
- [DMZ (demilitarised zone)](https://cyberessentialspreparation.com/glossary/dmz.md): A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.
- [DNS (Domain Name System)](https://cyberessentialspreparation.com/glossary/dns.md): DNS, the Domain Name System, is the internet's address book that turns names people can read, such as example.co.uk, into the number addresses computers use.
- [External vulnerability scan](https://cyberessentialspreparation.com/glossary/external-vulnerability-scan.md): An external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.
- [Firewall](https://cyberessentialspreparation.com/glossary/firewall.md): A firewall is a device or piece of software that sits between your computers and the internet and decides, using a set of rules, which traffic is allowed through.
- [Firewall rule](https://cyberessentialspreparation.com/glossary/firewall-rule.md): A firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is.
- [Guest Wi-Fi](https://cyberessentialspreparation.com/glossary/guest-wi-fi.md): Guest Wi-Fi is a separate wireless network for visitors that lets them reach the internet without joining the network your staff and business systems use.
- [Inbound connection](https://cyberessentialspreparation.com/glossary/inbound-connection.md): An inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start.
- [Internet service provider (ISP)](https://cyberessentialspreparation.com/glossary/internet-service-provider.md): An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.
- [Internet-facing](https://cyberessentialspreparation.com/glossary/internet-facing.md): Internet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.
- [IP address](https://cyberessentialspreparation.com/glossary/ip-address.md): An IP address is the number that identifies a device or internet connection on a network, so that traffic can be delivered to the right place.
- [NAT (network address translation)](https://cyberessentialspreparation.com/glossary/nat.md): NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through.
- [Network segregation](https://cyberessentialspreparation.com/glossary/network-segregation.md): Network segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.
- [Outbound connection](https://cyberessentialspreparation.com/glossary/outbound-connection.md): An outbound connection is a connection that one of your own devices starts towards something on the internet, such as a laptop opening a website.
- [Port (network port)](https://cyberessentialspreparation.com/glossary/port.md): A port is a numbered doorway on a device that a particular kind of network traffic uses, for example secure web pages usually arrive on port 443.
- [Port forwarding](https://cyberessentialspreparation.com/glossary/port-forwarding.md): Port forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
- [Remote Desktop Protocol (RDP)](https://cyberessentialspreparation.com/glossary/remote-desktop-protocol.md): Remote Desktop Protocol (RDP) is Microsoft's way of letting someone see and control a Windows computer or server from another device over a network.
- [Router](https://cyberessentialspreparation.com/glossary/router.md): A router is the box that connects your office or home network to the internet and passes traffic between the two.
- [Software firewall](https://cyberessentialspreparation.com/glossary/software-firewall.md): A software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
- [SSH (Secure Shell)](https://cyberessentialspreparation.com/glossary/ssh.md): SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it.
- [Static IP address](https://cyberessentialspreparation.com/glossary/static-ip-address.md): A static IP address is a public internet address that stays the same over time, unlike a dynamic address that your broadband provider can change without notice.
- [VLAN (virtual local area network)](https://cyberessentialspreparation.com/glossary/vlan.md): A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.
- [VPN (virtual private network)](https://cyberessentialspreparation.com/glossary/vpn.md): A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
- [WPA2 and WPA3](https://cyberessentialspreparation.com/glossary/wpa2-and-wpa3.md): WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.

## Scheme and certification
- [Applicant](https://cyberessentialspreparation.com/glossary/applicant.md): An applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact.
- [Assessor](https://cyberessentialspreparation.com/glossary/assessor.md): An assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
- [Board declaration](https://cyberessentialspreparation.com/glossary/board-declaration.md): The board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
- [Certificate expiry](https://cyberessentialspreparation.com/glossary/certificate-expiry.md): Certificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
- [Certificate register](https://cyberessentialspreparation.com/glossary/certificate-register.md): The certificate register is the public online record of Cyber Essentials certificates, where anyone can check whether an organisation is currently certified.
- [Certification Body](https://cyberessentialspreparation.com/glossary/certification-body.md): A Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
- [CREST](https://cyberessentialspreparation.com/glossary/crest.md): CREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.
- [Cyber Advisor](https://cyberessentialspreparation.com/glossary/cyber-advisor.md): A Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.
- [Cyber Essentials](https://cyberessentialspreparation.com/glossary/cyber-essentials.md): Cyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks.
- [Cyber Essentials certificate](https://cyberessentialspreparation.com/glossary/certificate-of-assurance.md): A Cyber Essentials certificate is the digital record, issued through a Certification Body, that an organisation has passed Cyber Essentials or Cyber Essentials Plus.
- [Cyber Essentials Plus](https://cyberessentialspreparation.com/glossary/cyber-essentials-plus.md): Cyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- [Cyber Essentials Readiness Tool](https://cyberessentialspreparation.com/glossary/readiness-toolkit.md): The Cyber Essentials Readiness Tool is a free online questionnaire from the NCSC, run with IASME, that asks about your IT and gives a personalised action plan for meeting Cyber Essentials.
- [Cyber insurance](https://cyberessentialspreparation.com/glossary/cyber-insurance.md): Cyber insurance is a policy that pays towards the costs of a cyber incident, such as a data breach or ransomware.
- [Danzell question set](https://cyberessentialspreparation.com/glossary/danzell-question-set.md): The Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026.
- [Def Stan 05-138](https://cyberessentialspreparation.com/glossary/def-stan-05-138.md): Def Stan 05-138 is the Ministry of Defence standard setting the cyber security controls defence suppliers must meet, graded by contract risk.
- [DSPT (Data Security and Protection Toolkit)](https://cyberessentialspreparation.com/glossary/dspt.md): The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.
- [Evidence](https://cyberessentialspreparation.com/glossary/evidence.md): Evidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place.
- [Gap analysis](https://cyberessentialspreparation.com/glossary/gap-analysis.md): A gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
- [IASME](https://cyberessentialspreparation.com/glossary/iasme.md): IASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.
- [IASME Cyber Assurance](https://cyberessentialspreparation.com/glossary/iasme-cyber-assurance.md): IASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.
- [ISO 27001](https://cyberessentialspreparation.com/glossary/iso-27001.md): ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.
- [NCSC (National Cyber Security Centre)](https://cyberessentialspreparation.com/glossary/ncsc.md): The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.
- [Organisational data](https://cyberessentialspreparation.com/glossary/organisational-data.md): Organisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.
- [Organisational service](https://cyberessentialspreparation.com/glossary/organisational-service.md): An organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.
- [PPN 014 (Procurement Policy Note 014)](https://cyberessentialspreparation.com/glossary/ppn-014.md): PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
- [Question set versions](https://cyberessentialspreparation.com/glossary/question-set-versions.md): Question set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
- [Re-mark](https://cyberessentialspreparation.com/glossary/re-mark.md): A re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.
- [Recertification](https://cyberessentialspreparation.com/glossary/recertification.md): Recertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.
- [Remediation](https://cyberessentialspreparation.com/glossary/remediation.md): Remediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
- [Requirements for IT Infrastructure](https://cyberessentialspreparation.com/glossary/requirements-for-it-infrastructure.md): Cyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
- [Retest](https://cyberessentialspreparation.com/glossary/retest.md): A retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.
- [Sampling](https://cyberessentialspreparation.com/glossary/sampling.md): Sampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.
- [Scope](https://cyberessentialspreparation.com/glossary/scope.md): Scope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- [Self-assessment questionnaire](https://cyberessentialspreparation.com/glossary/self-assessment-questionnaire.md): The self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.
- [Sub-set](https://cyberessentialspreparation.com/glossary/sub-set.md): A sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- [Test case](https://cyberessentialspreparation.com/glossary/test-case.md): A test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.
- [Whole-organisation scope](https://cyberessentialspreparation.com/glossary/whole-organisation-scope.md): A whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.