IT & Security, in Plain English

A

Application allowlisting — Application control

Flips endpoint security from a blocklist to an allowlist: nothing runs on a computer unless it has been approved. An unapproved program — including the malware a phishing click tries to launch — is blocked before it starts. Included in CRC Cloud’s Secure IT plan; insurers and frameworks like CMMC increasingly ask for it by name.

B

BAA — Business Associate Agreement

A HIPAA-⁠required contract between a healthcare provider (or covered entity) and a vendor that handles protected health information on its behalf. It defines what the vendor safeguards and how breaches are reported. CRC Cloud signs a BAA when it manages systems that touch your PHI.

BCDR — Business Continuity & Disaster Recovery

The plan and technology that keep a business running through an outage and recover it afterward. Continuity is staying operational during the event; disaster recovery is restoring systems and data after it. See backup & DR.

BEC — Business Email Compromise

A fraud in which an attacker impersonates a trusted party over email — often to redirect a payment or wire. It targets process, not software, which is why training and verified callbacks matter as much as filtering.

C

CMMC — Cybersecurity Maturity Model Certification

A U.S. Department of Defense program that assesses whether defense contractors protect the government information they handle: federal contract information (FCI), generally Level 1, and Controlled Unclassified Information (CUI), generally Level 2 — the 110 requirements of NIST SP 800-⁠171. See CMMC.

CSP — Cloud Service Provider

A company that delivers computing, storage, or applications as a hosted service. CRC Cloud operates as a CSP on infrastructure it owns, alongside its MSP and MSSP roles.

CUI — Controlled Unclassified Information

Sensitive U.S. government information that is not classified but must still be protected by law or contract — common in defense supply chains. A defense contractor that holds it must protect it to NIST SP 800-⁠171, and a cloud service that stores it must be FedRAMP Moderate authorized or equivalent. CRC Cloud helps contractors prepare and secure environments built for CUI, such as Microsoft 365 GCC High, without its own systems ever holding CUI. See CMMC.

D

Dark-⁠web monitoring

Watching criminal marketplaces and leaked-⁠password dumps for your company’s email addresses and credentials, so a stolen password can be changed before someone uses it. Included in CRC Cloud’s Secure IT plan.

DKIM — DomainKeys Identified Mail

A digital signature added to each email you send and checked against a key published in your domain’s settings (DNS), so the receiver can tell the message really came from a system holding your key and was not altered on the way. One of three email-authentication records, with SPF and DMARC.

DMARC — Domain-⁠based Message Authentication, Reporting & Conformance

A short public record in your domain’s settings (DNS) that tells receiving email systems what to do with a message that claims to come from you but fails the SPF and DKIM checks: “none” (just watch and report), “quarantine” (send it to spam) or “reject” (refuse it). With no record, or with “none”, each recipient’s email provider decides for itself. SPF, DKIM and DMARC are monitored on both CRC Cloud plans, Core IT and Secure IT; see your own domain’s setting with our free domain check.

DNS filtering

Blocks connections to known malicious or unwanted websites at the moment a computer looks up a site’s address (a DNS lookup), before anything loads. It stops many phishing links and malware downloads even after someone clicks. CRC Cloud’s Core IT (and so Secure IT) sets it up on your office firewall and adds web filtering on every managed computer, so laptops stay protected away from the office.

E

EDR — Endpoint Detection & Response

Security software on each device (endpoint) that watches for malicious behavior, contains threats automatically, and gives responders a record of what happened. It is behavior-⁠based, so it catches attacks that signature antivirus misses.

EHR / EMR — Electronic Health / Medical Record

The clinical software a healthcare practice uses to store and manage patient records. Its uptime and its protection under the HIPAA Security Rule are core to healthcare IT.

Encryption

Scrambling data so it is unreadable without a key. “At rest” protects stored data; “in transit” protects data moving across a network. Most compliance frameworks treat it as effectively mandatory.

ESU — Extended Security Updates

Microsoft’s paid program that keeps delivering security fixes to a Windows version after its free support has ended — for Windows 10, sold to businesses one year at a time. A PC keeps working without it; what it stops getting is the security fixes. See Windows 10 at work.

F

FTC Safeguards Rule

A rule under the Gramm-⁠Leach-⁠Bliley Act (GLBA) requiring non-⁠bank “financial institutions” — a broad category including tax preparers, lenders, and investment advisers not registered with the SEC — to run a written security program. See FTC Safeguards.

G

GLBA — Gramm-⁠Leach-⁠Bliley Act

The U.S. law that requires financial institutions to protect customers’ nonpublic personal financial information. The FTC’s Safeguards Rule is how it is enforced for many businesses.

H

HIPAA — Health Insurance Portability & Accountability Act

The U.S. law governing the privacy and security of protected health information. Its Security Rule sets the administrative, physical, and technical safeguards for electronic PHI. See HIPAA.

I

Immutable backup

A backup copy that can’t be changed or deleted until its retention period ends — even by an account with administrator rights. That is what keeps a clean copy to restore from after a ransomware attack. CRC Cloud locks the most recent 30 days of restore points on every backup tier on its rate card; older restore points stay encrypted under separate credentials.

IR — Incident Response

The organized process of detecting, containing, investigating, and recovering from a security incident — and documenting it. A tested plan is the difference between a contained event and a crisis.

ITDR — Identity Threat Detection & Response

Detection and response aimed at identity attacks — stolen credentials, token theft, privilege abuse — rather than the device. It matters because attackers increasingly log in rather than break in. See ITDR for SMBs.

M

MDM — Mobile Device Management

Software that lets IT enroll, secure and manage phones, tablets and laptops centrally — enforcing a passcode and encryption, pushing apps and settings, and wiping a lost device. CRC Cloud configures and runs it through Microsoft Intune; the license stays yours, under your own Microsoft plan.

MDR — Managed Detection & Response

A service that pairs detection technology with human analysts who investigate and respond to threats around the clock. It is the “someone is actually watching” layer that a 24/7 SOC provides.

MFA — Multi-⁠Factor Authentication

Requiring more than a password to sign in — typically a code or approval on a second device. It blocks the large majority of account-⁠takeover attacks and is required by most compliance frameworks.

MSP — Managed Service Provider

A company that runs your IT — helpdesk, monitoring, patching, hardware, uptime — for a predictable fee. CRC Cloud’s Core IT is the MSP layer.

MSSP — Managed Security Service Provider

A provider focused on security — threat detection, response, and compliance alignment. CRC Cloud’s Secure IT adds the MSSP layer with a 24/7 SOC.

N

NAS — Network-⁠Attached Storage

A storage box on your office network that holds shared files on its own drives, usually mirrored so one failed drive loses nothing. It needs the same care as a server: drive-⁠health and free-⁠space monitoring, updates, and tight control over who can reach it. Mirrored drives are not a backup: a deleted or encrypted file is gone from every drive at once.

NIST CSF — NIST Cybersecurity Framework

A widely used U.S. framework organizing security into functions — Govern, Identify, Protect, Detect, Respond, Recover. CRC Cloud’s practice is built around CSF 2.0. See compliance.

NVR / DVR — Network / Digital Video Recorder

The box your security cameras record to. An NVR records network (IP) cameras; a DVR records older analog cameras. Either one sits on your network and needs patching and monitoring like any other device.

P

PCI DSS — Payment Card Industry Data Security Standard

The security standard every business that handles credit-⁠card data must meet under its merchant agreement. The current version is v4.0.1. See PCI DSS.

Penetration Test

An authorized, simulated attack run by security professionals to find exploitable weaknesses before a real attacker does. Unlike a scan, a pen test proves what an intruder could actually reach and is often required for compliance.

PHI — Protected Health Information

Individually identifiable health information covered by HIPAA. When it is electronic, it is ePHI, and the Security Rule governs how it must be protected.

Phishing

A social-⁠engineering attack that tricks a person into revealing credentials or clicking a malicious link, usually by email. Training plus email filtering are the two defenses that matter most.

R

Ransomware

Malware that encrypts a victim’s data and demands payment to release it. Locked backups and 24/7 detection are what turn a ransomware hit from a shutdown into a contained incident.

RMM — Remote Monitoring & Management

The tooling an MSP uses to monitor, patch, and manage devices remotely — the engine behind proactive support that resolves most issues before you notice them.

RTO / RPO — Recovery Time / Recovery Point Objective

Two recovery targets. RTO is how quickly systems must be back after an outage; RPO is how much data (measured in time) you can afford to lose. Together they size your backup and DR plan.

S

SASE — Secure Access Service Edge

A model that combines networking and security into one cloud-⁠delivered service, so remote users and offices connect through the same policy and protection wherever they are. It replaces the old “route everything through the office firewall” approach for a distributed workforce.

Session host

The server that runs shared hosted desktops: several people sign in to it at once, each in a private, isolated session. It is what a shared desktop in Cloud Complete runs on — never shared with another company — and CRC Cloud plans one for every 25 people.

SIEM — Security Information & Event Management

A system that centralizes logs from across your environment and correlates them to surface threats and provide an audit trail. It is the evidence layer behind detection and many compliance frameworks.

SLA — Service-⁠Level Agreement

A documented commitment to a level of service — for example a response-⁠time standard or an uptime percentage. CRC Cloud’s published standard is a 15-⁠minute response in business hours (6 AM–⁠6 PM Pacific, weekdays) and 60 minutes nights, weekends and holidays — targets, not guarantees.

SOAR — Security Orchestration, Automation & Response

Technology that automates repetitive security tasks and coordinates the tools in a security stack, so routine alerts are triaged and contained without waiting on a person. It multiplies what a 24/7 SOC can handle.

SOC — Security Operations Center

A team and facility that monitors an environment for threats around the clock and responds when one appears. The “24/7 SOC” is the human core of managed detection and response.

SOC 2

An independent audit report (from the AICPA framework) on how a service organization’s controls meet the Trust Services Criteria: security, plus — as scoped — availability, processing integrity, confidentiality and privacy. Often requested by enterprise customers. See SOC 2.

SPF — Sender Policy Framework

A public record in your domain’s settings (DNS) that lists the mail servers allowed to send email as you. Receiving systems check it to spot forged mail. One of three email-authentication records, with DKIM and DMARC.

T

Tokenization

Replacing sensitive data — like a card number — with a non-⁠sensitive stand-⁠in, so the real data never lives in your systems. A core way to shrink PCI scope.

U

UPS — Uninterruptible Power Supply

A battery backup for equipment: it keeps a firewall, switch or server running through a short power cut and lets it shut down cleanly in a longer one. It protects against sudden power loss, not data loss — it is not a backup of your data.

V

vCIO — Virtual Chief Information Officer

An outsourced IT strategist who provides budgeting, roadmap, and technology-⁠decision guidance without the cost of a full-⁠time executive. Included in every CRC Cloud plan, and central to co-⁠managed IT.

vCISO — Virtual Chief Information Security Officer

An outsourced security leader who runs your security program — policies, risk decisions, vendor risk, and reporting to leadership, auditors or insurers — without a full-⁠time executive hire. Unlike the vCIO, it is not part of a plan: CRC Cloud prices it separately, on the published rate card.

vCPU — Virtual CPU

A unit of processor capacity assigned to a virtual server or hosted desktop. Hosted servers are sized in vCPUs and memory — for example 8 vCPU and 32 GB — and extra processor capacity is priced per vCPU on the rate card.

VPN — Virtual Private Network

An encrypted connection that carries traffic privately across the internet. A site-⁠to-⁠site VPN links a whole office to another network — such as a hosted environment — through the office firewall; a remote-⁠user VPN connects one person working from home or on the road. Both are itemized on the rate card.

Vulnerability Assessment

A systematic scan and review that identifies, ranks, and reports security weaknesses across your systems. It answers “where are we exposed?” and feeds a prioritized remediation plan.

W

WISP — Written Information Security Plan

A documented security program some regulations require — notably the IRS for tax preparers, grounded in the GLBA Safeguards Rule. See IRS WISP.

X

XDR — Extended Detection & Response

Detection and response that correlates signals across endpoints, email, identity, and cloud into a single view — broader than EDR, which watches only the endpoint. The goal is to catch attacks that move between layers before they spread.

Z

Zero Trust

A security model that trusts no user or device by default — every access request is verified, regardless of network location. “Never trust, always verify” replaces the old idea of a trusted internal network.