Reference
Cyber Essentials glossary: IT security terms in plain English
154 Cyber Essentials and IT security terms explained in plain English for non-technical readers, each linked to the control and questions it affects.
Short answer
This Cyber Essentials glossary explains 154 terms, from firewall and malware to scope, MFA and CVSS. Each entry gives a one-sentence definition, what the scheme asks about the term and the questions it affects. Where the NCSC defines a term in section B of the requirements v3.3 or elsewhere in that document, the entry quotes its wording exactly.
Key facts
- Terms
- 154, A to Z
- Categories
- Scheme and certification (37); Networks and firewalls (27); Devices and software (32); Accounts and access (31); Malware, cloud and threats (27)
- NCSC definitions
- 56 entries quote the Requirements for IT Infrastructure v3.3 word for word, from section B, Definitions, or the control sections
- Sources
- Requirements for IT Infrastructure v3.3, CE Plus Test Specification v3.2, Danzell question set v16.3
- New in v3.3
- Cloud service (new); passwordless authentication (updated to include FIDO2)
Browse all terms
154 terms, A to Z. Terms marked NCSC definition quote the requirements v3.3 word for word.
A
13 termsBack to A to Z, from letter A- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.Also called Lockout policy, Account lockout threshold, Device lockoutAccounts and accessNCSC definition
- Active Directory (AD)Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.Also called Active Directory, AD, Windows domain, Active Directory Domain ServicesAccounts and access
- Admin interfaceAn admin interface is the settings page or login a device offers so that someone can manage it, such as your router's web settings page.Also called Administrative interface, Management interface, Web admin page, Remote managementNetworks and firewallsNCSC definition
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.Also called Admin account, Local administrator, Domain administrator, Administrative accountAccounts and access
- Allow listing (application allow listing)Allow listing is a malware protection option in which only approved applications, restricted by code signing, are allowed to execute on devices.Also called Application allow listing, WhitelistingMalware, cloud and threats
- Anti-malware softwareAnti-malware software is a program that checks files, downloads and websites for known harmful software and stops it before it can run.Also called Antivirus, Anti-virus software, AVMalware, cloud and threatsNCSC definition
- ApplicantAn applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact.Scheme and certificationNCSC definition
- Application controlApplication control is a setting or tool that decides which programs are allowed to run on a device and blocks everything else.Also called Application allow listing, Application whitelisting, App controlMalware, cloud and threats
- AssessorAn assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.Also called Cyber Essentials assessor, IASME assessorScheme and certification
- Attack surfaceAn attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software.Also called Attack surface reductionMalware, cloud and threats
- Authenticated scanAn authenticated scan is a vulnerability scan that logs in to a device, so it can see exactly which software and updates are installed.Also called Credentialed scan, Authenticated vulnerability scan, Patch scanMalware, cloud and threats
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.Also called MFA app, Microsoft Authenticator, Google Authenticator, TOTP appAccounts and access
- Auto-run (AutoRun and AutoPlay)Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.Also called AutoRun, AutoPlay, AutorunDevices and softwareNCSC definition
B
7 termsBack to A to Z, from letter B- BackupA backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost.Also called Backing up, Data backupMalware, cloud and threatsNCSC definition
- BiometricsBiometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.Also called Biometric authentication, Fingerprint unlock, Face recognition, Face ID, Windows HelloAccounts and accessNCSC definition
- Board declarationThe board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.Also called attestation, board sign-off, declarationScheme and certification
- Boundary firewallA boundary firewall is a network device that restricts inbound and outbound traffic between an organisation's network and the internet using firewall rules.Also called Perimeter firewallNetworks and firewallsNCSC definition
- Browser extensionA browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.Also called Browser add-on, Add-on, Plug-inDevices and software
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.Also called Brute force, Password guessing attackAccounts and access
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.Also called Bring your own device, Personal devices, User-owned devicesDevices and softwareNCSC definition
C
18 termsBack to A to Z, from letter C- Certificate expiryCertificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.Also called expiry date, certificate validityScheme and certification
- Certificate registerThe certificate register is the public online record of Cyber Essentials certificates, where anyone can check whether an organisation is currently certified.Also called IASME certificate search, Cyber Essentials certificate search, Supply Check ToolScheme and certification
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.Also called CBScheme and certification
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.Malware, cloud and threatsNCSC definition
- Cloud tenantA cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.Also called Tenant, Microsoft 365 tenant, Google Workspace account, Cloud subscriptionAccounts and access
- Commodity attacksCommodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically.Also called Commodity threats, Opportunistic attacksMalware, cloud and threats
- Conditional accessConditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.Also called Conditional Access policies, Microsoft Entra Conditional Access, Access policiesAccounts and access
- Corporate VPNA corporate VPN is a virtual private network that connects back to your office location, or to a virtual or cloud firewall, and that you administer so the firewall controls apply.Also called Company VPN, Virtual private networkNetworks and firewallsNCSC definition
- Credential stuffingCredential stuffing is when criminals take usernames and passwords leaked from one website and try them on other websites, betting that people reuse the same password.Also called Password reuse attack, Credential replayAccounts and access
- CRESTCREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.Also called CREST accreditation, CREST accreditedScheme and certification
- CVE (Common Vulnerabilities and Exposures)A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.Also called Common Vulnerabilities and Exposures, CVE IDDevices and software
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.Also called Common Vulnerability Scoring System, CVSS scoreDevices and softwareNCSC definition
- Cyber AdvisorA Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.Scheme and certification
- Cyber EssentialsCyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks.Also called CE, Cyber Essentials schemeScheme and certification
- Cyber Essentials certificateA Cyber Essentials certificate is the digital record, issued through a Certification Body, that an organisation has passed Cyber Essentials or Cyber Essentials Plus.Also called CE certificate, Cyber Essentials Plus certificateScheme and certification
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.Also called CE+, CE PlusScheme and certification
- Cyber Essentials Readiness ToolThe Cyber Essentials Readiness Tool is a free online questionnaire from the NCSC, run with IASME, that asks about your IT and gives a personalised action plan for meeting Cyber Essentials.Also called Cyber Essentials Readiness Toolkit, NCSC Readiness ToolScheme and certification
- Cyber insuranceCyber insurance is a policy that pays towards the costs of a cyber incident, such as a data breach or ransomware.Also called cyber liability insurance, included cyber insuranceScheme and certification
D
8 termsBack to A to Z, from letter D- Danzell question setThe Danzell question set is the current list of questions every Cyber Essentials applicant answers, published by IASME and used for assessments from 27 April 2026.Also called Danzell, 2026 Cyber Essentials question set, question set v16.3Scheme and certification
- Def Stan 05-138Def Stan 05-138 is the Ministry of Defence standard setting the cyber security controls defence suppliers must meet, graded by contract risk.Also called Defence Standard 05-138, DEFCON 658, Cyber Security for Defence SuppliersScheme and certification
- Default passwordA default password is the password a device or piece of software comes with from the factory, before anyone in your organisation has set their own.Also called Factory password, Pre-set password, Out-of-the-box passwordNetworks and firewallsNCSC definition
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.Also called Screen lock, Device lock, Lock screenDevices and softwareNCSC definition
- DevicesDevices, in Cyber Essentials, are all types of hosts, networking equipment, servers, networks and end user devices such as laptops, tablets and smartphones, whether physical or virtual.Also called EndpointsDevices and softwareNCSC definition
- DMZ (demilitarised zone)A DMZ, or demilitarised zone, is a separate part of a network, walled off by a firewall, where you put servers that people on the internet need to reach.Also called Demilitarised zone, Perimeter network, Screened subnetNetworks and firewalls
- DNS (Domain Name System)DNS, the Domain Name System, is the internet's address book that turns names people can read, such as example.co.uk, into the number addresses computers use.Also called Domain Name System, DNS record, DNS filteringNetworks and firewalls
- DSPT (Data Security and Protection Toolkit)The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.Also called Data Security and Protection Toolkit, NHS DSPTScheme and certification
E
8 termsBack to A to Z, from letter E- EDR (endpoint detection and response)Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.Also called EDR, Endpoint protectionMalware, cloud and threats
- EncryptionEncryption is scrambling information with a secret key so that only someone holding the right key can read it.Also called Data encryptionMalware, cloud and threats
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.Also called EOL, End of life, EOS, Unsupported softwareDevices and softwareNCSC definition
- End-user device (EUD)An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.Also called EUD, End user device, User deviceDevices and softwareNCSC definition
- EvidenceEvidence is any record, screenshot, report or document that shows a security control described in your Cyber Essentials answers is really in place.Also called supporting evidence, evidence packScheme and certificationNCSC definition
- ExploitAn exploit is a piece of code or a technique that takes advantage of a security flaw in software to make it do something its makers never intended, such as letting an attacker in.Also called Exploitation, Exploit codeMalware, cloud and threatsNCSC definition
- Extended Security Updates (ESU)Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.Also called ESU, Extended supportDevices and software
- External vulnerability scanAn external vulnerability scan is an automated check, run from the internet, that looks at every public address your organisation uses for services an attacker could reach and weaknesses in them.Also called Remote vulnerability assessment, External scan, Test case 1Networks and firewalls
F
5 termsBack to A to Z, from letter F- FIDO2FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.Also called FIDO2 authenticator, WebAuthn, FIDO security keyAccounts and accessNCSC definition
- FirewallA firewall is a device or piece of software that sits between your computers and the internet and decides, using a set of rules, which traffic is allowed through.Also called Network firewall, Hardware firewallNetworks and firewallsNCSC definition
- Firewall ruleA firewall rule is a single instruction on a firewall that says which traffic to allow or block, based on where it comes from, where it is going and what type it is.Also called Firewall policy, Access rule, ACLNetworks and firewallsNCSC definition
- FirmwareFirmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.Also called Router firmware, Firewall firmwareDevices and software
- Full-disk encryptionFull-disk encryption scrambles everything stored on a laptop, desktop or phone so the data cannot be read without unlocking the device first.Also called FDE, Device encryption, BitLocker, FileVaultMalware, cloud and threats
G
4 termsBack to A to Z, from letter G- Gap analysisA gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.Also called readiness review, pre-assessment, Cyber Essentials gap analysisScheme and certification
- Global administratorA global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.Also called Global Admin, Microsoft 365 global admin, Super admin, Tenant administratorAccounts and access
- Group policyGroup policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.Also called Group Policy, GPO, Group Policy ObjectAccounts and access
- Guest Wi-FiGuest Wi-Fi is a separate wireless network for visitors that lets them reach the internet without joining the network your staff and business systems use.Also called Guest wireless, Guest network, Visitor Wi-FiNetworks and firewalls
I
9 termsBack to A to Z, from letter I- IaaS (Infrastructure as a Service)Infrastructure as a Service (IaaS) is renting virtual servers and networks from a cloud provider, which your organisation then sets up and looks after much as it would physical equipment.Also called IaaS, Infrastructure as a Service, Cloud serversMalware, cloud and threatsNCSC definition
- IASMEIASME is the company that runs the Cyber Essentials scheme on behalf of the NCSC, as its Delivery Partner.Also called Delivery Partner, Cyber Essentials Delivery Partner, IASME ConsortiumScheme and certification
- IASME Cyber AssuranceIASME Cyber Assurance is IASME's own certification scheme for small and medium organisations that covers security governance as well as technical controls.Also called Cyber Assurance, Cyber Assurance Level 1, Cyber Assurance Level 2Scheme and certification
- Identity provider (IdP)An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.Also called IdP, Identity platform, Authentication serviceAccounts and access
- Inbound connectionAn inbound connection is a connection that someone on the internet starts towards a device or service inside your network, rather than one your own devices start.Also called Incoming connection, Inbound trafficNetworks and firewallsNCSC definition
- Internet service provider (ISP)An internet service provider, or ISP, is the company that supplies your internet connection and often the router that comes with it.Also called ISP, Broadband providerNetworks and firewalls
- Internet-facingInternet-facing describes a device or service that anyone on the internet can reach and try to connect to, such as a website, a VPN login page or an email server.Also called Public-facing, Externally exposed, Exposed serviceNetworks and firewallsNCSC definition
- IP addressAn IP address is the number that identifies a device or internet connection on a network, so that traffic can be delivered to the right place.Also called Internet Protocol address, Public IP address, IPv4, IPv6Networks and firewalls
- ISO 27001ISO 27001 is the international standard for running an information security management system, a documented and risk-based way of managing security.Also called ISO/IEC 27001, ISMS certificationScheme and certification
J
2 termsBack to A to Z, from letter J- Jailbreaking and rootingJailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.Also called Jailbreak, Jailbroken, Rooting, Rooted deviceDevices and software
- Joiners, movers and leavers (JML)Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.Also called JML, Starters and leavers process, Onboarding and offboardingAccounts and access
L
3 termsBack to A to Z, from letter L- Least privilegeLeast privilege is the rule that each person gets only the access they need to do their current job, and nothing more.Also called Principle of least privilege, PoLP, Need to know accessAccounts and accessNCSC definition
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.Also called Supported softwareDevices and softwareNCSC definition
- Long-term support (LTS)Long-term support is a version of a product that the vendor commits to keep fixing for several years, rather than the shorter period a normal release gets.Also called LTS, LTSC, Long-Term Servicing ChannelDevices and software
M
5 termsBack to A to Z, from letter M- MacrosA macro is a small program saved inside a document or spreadsheet that automates tasks, and it can run as soon as the file is opened.Also called Office macros, VBA macrosDevices and software
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.Also called Malicious software, Computer virusMalware, cloud and threatsNCSC definition
- Managed service provider (MSP)A managed service provider (MSP) is an outside company you pay to run or support your IT.Also called MSP, IT support company, Outsourced ITMalware, cloud and threatsNCSC definition
- Mobile device management (MDM)Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.Also called MDM, Unified endpoint management, UEMDevices and software
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.Also called MFA, 2FA, Two-factor authenticationAccounts and accessNCSC definition
N
3 termsBack to A to Z, from letter N- NAT (network address translation)NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through.Also called Network address translation, Carrier-grade NAT, CGNATNetworks and firewalls
- NCSC (National Cyber Security Centre)The NCSC, or National Cyber Security Centre, is the UK government's cyber security authority and the owner of the Cyber Essentials scheme.Also called National Cyber Security CentreScheme and certification
- Network segregationNetwork segregation is splitting a network into separate parts, so that devices in one part cannot freely reach devices in another.Also called Network segmentation, Network separationNetworks and firewallsNCSC definition
O
5 termsBack to A to Z, from letter O- Open-source softwareOpen-source software is software whose source code is published for anyone to use, change and share under the terms of its licence, often at no cost.Also called OSS, Free and open-source software, FOSSDevices and software
- Operating system (OS)An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android.Also called OSDevices and software
- Organisational dataOrganisational data is any electronic data belonging to your organisation, for example emails, documents, database data and financial data.Scheme and certificationNCSC definition
- Organisational serviceAn organisational service is any software application, cloud application, cloud service, user interactive desktop or mobile device management system your organisation owns or subscribes to.Scheme and certificationNCSC definition
- Outbound connectionAn outbound connection is a connection that one of your own devices starts towards something on the internet, such as a laptop opening a website.Also called Outgoing connection, Outbound trafficNetworks and firewallsNCSC definition
P
13 termsBack to A to Z, from letter P- PaaS (Platform as a Service)Platform as a Service (PaaS) is a cloud service where the provider runs the servers underneath and your organisation supplies and manages its own applications.Also called PaaS, Platform as a ServiceMalware, cloud and threatsNCSC definition
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.Also called Passkeys, FIDO2 passkeyAccounts and accessNCSC definition
- PassphraseA passphrase is a password made of several ordinary words strung together, such as three random words, which is long and hard to guess but easy to remember.Also called Three random words, Multi-word passwordAccounts and access
- PasswordA password is a secret string of characters that you type to prove you are the person an account belongs to.Also called Passcode, Login passwordAccounts and access
- Password managerA password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.Also called Password vault, Password safeAccounts and access
- Passwordless authenticationPasswordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.Also called PasswordlessAccounts and accessNCSC definition
- Patch managementPatch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.Also called Patching, Update management, Security update managementDevices and softwareNCSC definition
- Penetration testA penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.Also called Pen test, Pentest, Ethical hackingMalware, cloud and threats
- PhishingPhishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.Also called Phishing email, Spear phishingMalware, cloud and threats
- Port (network port)A port is a numbered doorway on a device that a particular kind of network traffic uses, for example secure web pages usually arrive on port 443.Also called Network port, TCP port, UDP port, Open portNetworks and firewalls
- Port forwardingPort forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.Also called Port mapping, Opening a port, Virtual server ruleNetworks and firewalls
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.Also called Procurement Policy Note 014, PPN 09/14, PPN 09/23Scheme and certification
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.Also called Special access privileges, Elevated privileges, Admin rightsAccounts and accessNCSC definition
R
9 termsBack to A to Z, from letter R- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.Also called Crypto-ransomwareMalware, cloud and threatsNCSC definition
- Re-markA re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.Also called remark, resubmissionScheme and certification
- RecertificationRecertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.Also called renewal, Cyber Essentials renewalScheme and certification
- RemediationRemediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.Also called remediate, fixing gaps, remediation reportScheme and certification
- Remote Desktop Protocol (RDP)Remote Desktop Protocol (RDP) is Microsoft's way of letting someone see and control a Windows computer or server from another device over a network.Also called RDP, Remote desktop, Remote Desktop ServicesNetworks and firewalls
- Remote monitoring and management (RMM)Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance.Also called RMM, RMM toolDevices and software
- Requirements for IT InfrastructureCyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.Also called Cyber Essentials: Requirements for IT Infrastructure, NCSC requirements v3.3, Cyber Essentials requirementsScheme and certification
- RetestA retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.Also called re-test, Cyber Essentials Plus retestScheme and certification
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.Also called Broadband router, Internet router, HubNetworks and firewallsNCSC definition
S
23 termsBack to A to Z, from letter S- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.Also called SaaS, Software as a Service, Cloud softwareMalware, cloud and threatsNCSC definition
- SamplingSampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.Also called sample testing, sample size, representative sampleScheme and certification
- SandboxingSandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.Also called Sandbox, Application sandboxingMalware, cloud and threats
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.Also called Certification scopeScheme and certificationNCSC definition
- Secure configurationSecure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.Also called Hardening, Device hardeningDevices and software
- Security operations centre (SOC)A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.Also called SOC, Security operations centerMalware, cloud and threats
- Security update (security patch)A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.Also called Security patch, Patch, HotfixDevices and softwareNCSC definition
- Self-assessment questionnaireThe self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.Also called SAQ, self-assessment, Cyber Essentials self-assessmentScheme and certification
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.Devices and softwareNCSC definition
- Service accountA service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.Also called Non-human account, System account, Application accountAccounts and access
- Shared accountA shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.Also called Shared login, Generic account, Group accountAccounts and access
- Shared responsibility modelA shared responsibility model is a cloud provider's written explanation of which security tasks it handles and which ones remain the customer's job.Also called Shared responsibilityMalware, cloud and threatsNCSC definition
- Signature-based detectionSignature-based detection is the way anti-malware software recognises known malware, by comparing files against a list of fingerprints, called signatures or definitions, supplied by the vendor.Also called Signature detection, Virus definitions, Malware signaturesMalware, cloud and threats
- Single sign-on (SSO)Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.Also called SSO, Sign in with Microsoft, Sign in with GoogleAccounts and access
- SMS verification codesSMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.Also called Text message codes, SMS one-time passcodes, SMS OTP, SMS MFAAccounts and accessNCSC definition
- Social engineeringSocial engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.Also called Pretexting, Confidence trickeryMalware, cloud and threats
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.Devices and softwareNCSC definition
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.Also called Host-based firewall, Personal firewallNetworks and firewallsNCSC definition
- SSH (Secure Shell)SSH, or Secure Shell, is an encrypted way for IT staff to log in to a server, firewall or other network device from another computer and type commands to manage it.Also called Secure Shell, SSH keyNetworks and firewalls
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.Also called Standard user, Non-admin account, Normal user accountAccounts and access
- Static IP addressA static IP address is a public internet address that stays the same over time, unlike a dynamic address that your broadband provider can change without notice.Also called Fixed IP address, Dynamic IP addressNetworks and firewalls
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.Also called SubsetScheme and certificationNCSC definition
- Supply chain securitySupply chain security is making sure the suppliers and service providers you rely on do not become the weak link that lets an attacker in.Also called Supplier assurance, Third-party riskMalware, cloud and threats
T
3 termsBack to A to Z, from letter T- Test caseA test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.Also called Cyber Essentials Plus test, sub-testScheme and certification
- Thin clientA thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.Devices and software
- ThrottlingThrottling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.Also called Login throttling, Rate limiting, Progressive delayAccounts and accessNCSC definition
U
3 termsBack to A to Z, from letter U- Unnecessary softwareUnnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use.Also called Bloatware, Unused softwareDevices and softwareNCSC definition
- User accountA user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.Also called Login, User login, AccountAccounts and access
- User Account Control (UAC)User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer.Also called UAC, User Account Control, Windows elevation promptAccounts and access
V
7 termsBack to A to Z, from letter V- VendorA vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws.Also called Software vendor, Supplier, ManufacturerDevices and softwareNCSC definition
- Virtual desktop infrastructure (VDI)Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.Also called VDI, Virtual desktop, Hosted desktopDevices and software
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.Also called VM, Virtual serverDevices and software
- VLAN (virtual local area network)A VLAN, or virtual local area network, is a way of splitting one physical office network into separate networks that cannot talk to each other unless you allow it.Also called Virtual local area network, Virtual LANNetworks and firewallsNCSC definition
- VPN (virtual private network)A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.Also called Virtual private network, Remote access VPN, Site-to-site VPNNetworks and firewalls
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.Also called PatchesDevices and softwareNCSC definition
- Vulnerability scanA vulnerability scan is an automated check in which software examines your devices or internet connections for known security weaknesses.Also called Vulnerability scanning, Vulnerability assessmentMalware, cloud and threats
W
3 termsBack to A to Z, from letter W- Whole-organisation scopeA whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.Also called whole organisation, full scope, whole company certificationScheme and certificationNCSC definition
- Windows LAPSLAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.Also called Local Administrator Password Solution, Windows LAPS, Local admin password managementAccounts and access
- WPA2 and WPA3WPA2 and WPA3 are the security settings that scramble Wi-Fi traffic and control who can join a wireless network, with WPA3 being the newer and stronger of the two.Also called Wi-Fi Protected Access, WPA2, WPA3, Wi-Fi encryptionNetworks and firewalls
Frequently asked questions
It is a plain-English reference to 154 terms you meet when preparing for Cyber Essentials, written for owners, office managers and finance teams rather than IT specialists. Each entry gives a one-sentence definition, explains what the scheme asks about the term, and links to the control and Danzell questions it affects.
Start with Cyber Essentials, scope, firewall, password, multi-factor authentication, security update, malware and cloud service. Between them they cover what the scheme is, what it applies to and the basic protections every assessor checks. Then use the category filter to read one area at a time.
Where the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026) defines or describes a term, in section B, Definitions, or in the control sections, the entry quotes that wording exactly and is marked "NCSC definition"; 56 entries carry it. Other terms are explained from the requirements, the CE Plus Test Specification v3.2 and the IASME Danzell question set v16.3.
Every term sits in one of five categories: scheme and certification; networks and firewalls; devices and software; accounts and access; malware, cloud and threats. The categories follow the way the scheme is organised, so terms that affect the same control are read together.
Cloud service was added, and passwordless authentication was updated to include FIDO2 authenticators. No other definition changes appear in the v3.3 list of what is new.
MFA uses two or more verification factors. Passwordless establishes identity with a factor other than knowledge. The two overlap: FIDO2 authenticators are passwordless and are regarded as MFA because user authentication is performed.
Related pages
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
Free readiness check
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh