Look it up

Knowledge base IT security

The core terms of IT security, explained for people who run a business and have no IT department. Search for a term or browse the categories. Every entry answers first what the term means, and then gets specific.

Book a first call Go to the IT Check

Basics 6

What does IT security mean for an SME? IT security for SMEs IT security in a small or mid sized business means reliably doing the few things that stop most real attacks: current systems, tested backups, two-fa… Read on What is a vulnerability? Vulnerability and vulnerability assessment A vulnerability is a flaw or misconfiguration in software, hardware or settings that lets an attacker into a system. A vulnerability assessment searc… Read on What is an attack surface? Attack surface An attack surface is the sum of all the points through which someone could enter your IT: every reachable device, account, application and interface.… Read on What are the three security objectives of information security? Security objectives: confidentiality, integrity, availability The security objectives of information security are confidentiality, integrity and availability. Confidentiality means that only authorised people ca… Read on What is zero trust? Zero trust Zero trust is a security model in which every request for access is verified on its own, including requests that come from inside the company network… Read on What is an IT asset inventory? IT asset inventory An IT asset inventory is an up to date list of every device, application, account and service your business uses. It records what exists, where it ru… Read on

Audit and testing 7

What is an IT security check? IT security check An IT security check is a structured review of a company's IT. It records the current state of network, servers, workstations and access, rates the r… Read on What is an IT security audit? IT security audit An IT security audit reviews a company's IT security against a benchmark defined in advance. That benchmark can be a recognised standard, a set of le… Read on What is an IT audit? IT audit An IT audit is the systematic review of an organisation's information technology, meaning the systems, the processes and the evidence behind them. Read on What is a penetration test? Penetration test A penetration test is a commissioned, controlled attempt to attack your own systems. It proves whether a vulnerability can actually be exploited. Read on What is a vulnerability scan? Vulnerability scan A vulnerability scan is an automated review of systems for known security flaws and misconfigurations. Software compares the versions and settings it… Read on What is a gap analysis in IT security? Gap analysis A gap analysis compares the current state of IT security against a defined target state and records every gap between the two. The target comes from … Read on What is an audit findings report and action plan? Findings report and action plan An audit findings report is the written result of an IT review. It records what was examined, what was found and how serious each individual finding … Read on

Attacks 10

What is ransomware? Ransomware Ransomware is malware that encrypts your data and demands a ransom to release it. The data is often copied before encryption as well, so the attacker… Read on What is phishing? Phishing Phishing is an attempt to obtain credentials or money through faked messages. The message poses as a known sender and creates time pressure. Read on What is social engineering? Social engineering Social engineering is the deliberate manipulation of people in order to obtain credentials, information or money. The attacker poses as someone trust… Read on What is CEO fraud? CEO fraud and invoice fraud CEO fraud is a scam in which criminals pose as company management and order an urgent transfer. In the related invoice fraud, a genuine invoice is in… Read on What is malware? Malware Malware is software written to damage, spy on or remotely control a system. It covers viruses, trojans, ransomware, spyware and loaders whose only pu… Read on What is a password attack? Password attack A password attack is an attempt to sign in to an account using a password that has been guessed, stolen or leaked elsewhere. The targets are mainly t… Read on What is a supply chain attack? Supply chain attack A supply chain attack uses a third party as the route into your business, for example an IT provider with remote access, a software vendor or a tampe… Read on What is a DDoS attack? DDoS attack A DDoS attack floods a service with simultaneous requests from many sources until genuine users can no longer reach it. DDoS stands for distributed d… Read on What is a zero-day vulnerability? Zero-day vulnerability A zero-day vulnerability is a flaw in software for which the vendor has no update available yet. When it is exploited before a fix exists, the event … Read on What is a data breach? Data breach A data breach is an incident in which data reaches people who have no right to it, whether through an attack, a misconfiguration or a simple mistake.… Read on

Safeguards 15

What is a backup and why must it be tested? Backup and restore A backup is a copy of your data. What decides its value is the restore: only a tested restore run proves the copy will hold when it counts. Read on What is two-factor authentication? Two-factor authentication (2FA) Two-factor authentication asks for a second proof alongside the password at login, such as a code from an app or a security key you plug in. A stolen… Read on What is a permission model? Permission model and least privilege A permission model defines who may access which data. The principle of least privilege gives every account exactly the rights its job requires. Read on What are SPF, DKIM and DMARC? SPF, DKIM and DMARC SPF, DKIM and DMARC are three records in the management of your internet domain. Together they stop outsiders from sending email in your domain's nam… Read on What is the 3-2-1 backup rule? The 3-2-1 backup rule The 3-2-1 rule is a rule of thumb for backups: keep three copies of your important data, on two different types of storage media, with one copy held … Read on What is a password manager? Password manager A password manager is an application that stores a company's login credentials in an encrypted vault and enters them when you sign in. You remember o… Read on What is patch management? Patch management and updates Patch management is the disciplined handling of security updates. A patch is the correction a vendor issues to close a security flaw that has become … Read on What is a firewall? Firewall A firewall is a control point between your company network and the internet that permits or blocks every connection according to fixed rules. It deci… Read on What is a VPN? VPN A VPN (virtual private network) is an encrypted connection that lets staff working away from the office dial into the company network. Traffic travel… Read on What is encryption? Encryption Encryption converts readable data into an unreadable form using a secret key, so that only the holder of that key can read it again. In a company it … Read on What is EDR? Antivirus and EDR EDR (endpoint detection and response) is protective software for workstations and servers that spots suspicious sequences of activity, raises an aler… Read on What is network segmentation? Network segmentation Network segmentation divides a company network into separate zones, with only expressly permitted connections between them. If one device is taken ov… Read on What belongs in an IT emergency plan? IT emergency plan An IT emergency plan is a short written instruction setting out who does what during an IT outage or cyber attack, who is contacted, and in which ord… Read on What is security awareness training? Security awareness training Security awareness training is a short, regularly repeated briefing for staff that makes common attacks on people recognisable, such as forged invoic… Read on What are monitoring and logging in IT? Monitoring and logging Monitoring and logging mean that IT systems are watched continuously and that important events are written down, such as logins, errors and changes t… Read on

Law and standards 8

What are technical and organisational measures? Technical and organisational measures (TOMs) Technical and organisational measures are the safeguards the GDPR requires for the processing of personal data. Article 32 GDPR calls for a level of … Read on What is NIS2? NIS2 NIS2 is EU Directive 2022/2555 on network and information security. It obliges companies in certain sectors to run risk management, to report securit… Read on What is ISO 27001? ISO/IEC 27001 ISO/IEC 27001 is the international standard for an information security management system. It describes how an organisation records, treats and conti… Read on What is the GDPR? GDPR The GDPR is the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679). It has applied since 25 May 2018 and governs how… Read on What is DORA? DORA DORA is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It has applied since 17 January 2025 and requires finan… Read on When must a data breach be reported? Data breach notification duty The data breach notification duty requires a personal data breach to be reported to the supervisory authority within 72 hours of the organisation bec… Read on What is a data processing agreement? Data processing agreement (DPA) A data processing agreement (DPA) is the contract required by Article 28 GDPR wherever a provider processes personal data on behalf of, and on the in… Read on What does cyber insurance cover? Cyber insurance Cyber insurance covers the financial consequences of an attack on a company's IT. A policy usually combines first-party cover, for example business i… Read on

Sources for further reading

Public bodies whose publications these pages draw on. All freely accessible.

Note: This page reflects the state of knowledge to the best of our understanding and serves as general orientation. It is not legal advice. Legislation and standards change; what counts is always the version currently in force at the responsible body. For your specific case, please verify the details with the sources above or talk to us.

From the term to practice

Where does your business actually stand?

The IT Check reviews your IT across 8 audit areas with more than 100 individual checks and delivers documented findings with a prioritised action plan. From 1,299 € excl. VAT. The first call carries no charge.

Book a first call