IT & Security, in Plain English

A

Application allowlisting — Application control

Flips endpoint security from a blocklist to an allowlist: nothing runs on a computer unless it has been approved. An unapproved program — including the malware a phishing click tries to launch — is blocked before it starts. Included in CRC Cloud’s Secure IT plan; insurers and frameworks like CMMC increasingly ask for it by name.

B

BAA — Business Associate Agreement

A HIPAA-required contract between a healthcare provider (or covered entity) and a vendor that handles protected health information on its behalf. It defines what the vendor safeguards and how breaches are reported. CRC Cloud signs a BAA when it manages systems that touch your PHI.

BCDR — Business Continuity & Disaster Recovery

The plan and technology that keep a business running through an outage and recover it afterward. Continuity is staying operational during the event; disaster recovery is restoring systems and data after it. See backup & DR.

BEC — Business Email Compromise

A fraud in which an attacker impersonates a trusted party over email — often to redirect a payment or wire. It targets process, not software, which is why training and verified callbacks matter as much as filtering.

C

CMMC — Cybersecurity Maturity Model Certification

A U.S. Department of Defense framework that requires defense contractors to meet defined cybersecurity practices to handle federal contract information. See compliance.

CSP — Cloud Service Provider

A company that delivers computing, storage, or applications as a hosted service. CRC Cloud operates as a CSP on infrastructure it owns, alongside its MSP and MSSP roles.

E

EDR — Endpoint Detection & Response

Security software on each device (endpoint) that watches for malicious behavior, contains threats automatically, and gives responders a record of what happened. It is behavior-based, so it catches attacks that signature antivirus misses.

EHR / EMR — Electronic Health / Medical Record

The clinical software a healthcare practice uses to store and manage patient records. Its uptime and its protection under the HIPAA Security Rule are core to healthcare IT.

Encryption

Scrambling data so it is unreadable without a key. “At rest” protects stored data; “in transit” protects data moving across a network. Most compliance frameworks treat it as effectively mandatory.

F

FTC Safeguards Rule

A rule under the Gramm-Leach-Bliley Act (GLBA) requiring non-bank “financial institutions” — a broad category including tax preparers, lenders, and advisers — to run a written security program. See FTC Safeguards.

G

GLBA — Gramm-Leach-Bliley Act

The U.S. law that requires financial institutions to protect customers’ nonpublic personal financial information. The FTC’s Safeguards Rule is how it is enforced for many businesses.

H

HIPAA — Health Insurance Portability & Accountability Act

The U.S. law governing the privacy and security of protected health information. Its Security Rule sets the administrative, physical, and technical safeguards for electronic PHI. See HIPAA.

I

IR — Incident Response

The organized process of detecting, containing, investigating, and recovering from a security incident — and documenting it. A tested plan is the difference between a contained event and a crisis.

ITDR — Identity Threat Detection & Response

Detection and response aimed at identity attacks — stolen credentials, token theft, privilege abuse — rather than the device. It matters because attackers increasingly log in rather than break in. See ITDR for SMBs.

M

MDR — Managed Detection & Response

A service that pairs detection technology with human analysts who investigate and respond to threats around the clock. It is the “someone is actually watching” layer that a 24/7 SOC provides.

MFA — Multi-Factor Authentication

Requiring more than a password to sign in — typically a code or approval on a second device. It blocks the large majority of account-takeover attacks and is required by most compliance frameworks.

MSP — Managed Service Provider

A company that runs your IT — helpdesk, monitoring, patching, hardware, uptime — for a predictable fee. CRC Cloud’s Core IT is the MSP layer.

MSSP — Managed Security Service Provider

A provider focused on security — threat detection, response, and compliance alignment. CRC Cloud’s Secure IT adds the MSSP layer with a 24/7 SOC.

N

NIST CSF — NIST Cybersecurity Framework

A widely used U.S. framework organizing security into functions — Govern, Identify, Protect, Detect, Respond, Recover. CRC Cloud’s practice is built around CSF 2.0. See compliance.

P

PCI DSS — Payment Card Industry Data Security Standard

The security standard every business that handles credit-card data must meet under its merchant agreement. The current version is v4.0.1. See PCI DSS.

Penetration Test

An authorized, simulated attack run by security professionals to find exploitable weaknesses before a real attacker does. Unlike a scan, a pen test proves what an intruder could actually reach and is often required for compliance.

PHI — Protected Health Information

Individually identifiable health information covered by HIPAA. When it is electronic, it is ePHI, and the Security Rule governs how it must be protected.

Phishing

A social-engineering attack that tricks a person into revealing credentials or clicking a malicious link, usually by email. Training plus email filtering are the two defenses that matter most.

R

Ransomware

Malware that encrypts a victim’s data and demands payment to release it. Immutable backups and 24/7 detection are what turn a ransomware hit from a shutdown into a contained incident.

RMM — Remote Monitoring & Management

The tooling an MSP uses to monitor, patch, and manage devices remotely — the engine behind proactive support that resolves most issues before you notice them.

RTO / RPO — Recovery Time / Recovery Point Objective

Two recovery targets. RTO is how quickly systems must be back after an outage; RPO is how much data (measured in time) you can afford to lose. Together they size your backup and DR plan.

S

SASE — Secure Access Service Edge

A model that combines networking and security into one cloud-delivered service, so remote users and offices connect through the same policy and protection wherever they are. It replaces the old “route everything through the office firewall” approach for a distributed workforce.

SIEM — Security Information & Event Management

A system that centralizes logs from across your environment and correlates them to surface threats and provide an audit trail. It is the evidence layer behind detection and many compliance frameworks.

SLA — Service-Level Agreement

A documented commitment to a level of service — for example a response-time target or an uptime percentage. CRC Cloud targets a 15-minute business-hours response.

SOAR — Security Orchestration, Automation & Response

Technology that automates repetitive security tasks and coordinates the tools in a security stack, so routine alerts are triaged and contained without waiting on a person. It multiplies what a 24/7 SOC can handle.

SOC (Security Operations Center)

A team and facility that monitors an environment for threats around the clock and responds when one appears. The “24/7 SOC” is the human core of managed detection and response.

SOC 2

An independent audit report (from the AICPA framework) on how a service organization handles security, availability, and confidentiality. Often requested by enterprise customers. See SOC 2.

T

Tokenization

Replacing sensitive data — like a card number — with a non-sensitive stand-in, so the real data never lives in your systems. A core way to shrink PCI scope.

V

vCIO — Virtual Chief Information Officer

An outsourced IT strategist who provides budgeting, roadmap, and technology-decision guidance without the cost of a full-time executive. Included in every CRC Cloud plan, and central to co-managed IT.

Vulnerability Assessment

A systematic scan and review that identifies, ranks, and reports security weaknesses across your systems. It answers “where are we exposed?” and feeds a prioritized remediation plan.

W

WISP — Written Information Security Plan

A documented security program some regulations require — notably the IRS for tax preparers, grounded in the GLBA Safeguards Rule. See IRS WISP.

X

XDR — Extended Detection & Response

Detection and response that correlates signals across endpoints, email, identity, and cloud into a single view — broader than EDR, which watches only the endpoint. The goal is to catch attacks that move between layers before they spread.

Z

Zero Trust

A security model that trusts no user or device by default — every access request is verified, regardless of network location. “Never trust, always verify” replaces the old idea of a trusted internal network.