A plain English guide to the words people use when they talk to you about technology.
Most Accidental IT Leaders don’t have a technology degree and the jargon in IT can be overwhelming. We’ve heard from our community that one of the most helpful resources would be a glossary to help you clearly understand the decisions in front of you. We’ve put it all in one place so you don’t have to spend hours searching the internet or trying to prompt an AI into giving you the plain language version!
Each entry tells you what the word means and why it matters to you, as the person accountable rather than the person configuring things. You do not need to read it in order, just find the category or the phrase you need today.
If you need a place to start, these eight come up most often and cause the most trouble when they are misunderstood: shared responsibility, SLA, MFA, RTO and RPO, tenant, least privilege, end of support, and out of scope.
And if you’re ready to stop guessing and know once and for all what good looks like for IT, take our Lumenas IT Check.
Your provider relationship
MSP (managed service provider)
An external company you pay a regular fee to look after some or all of your technology. Your MSP is a supplier, not a department. They do what your contract says they do, which is usually narrower than you assume. Sometimes called your IT Provider.
Co-managed
An arrangement where your MSP handles some areas and your own staff handle others. These arrangements can run into trouble where both sides assume the other one is handling a particular job.
Break/fix
You pay only when something goes wrong, rather than a monthly fee for ongoing care. This can look cheaper on paper, but it often means that there is no proactive maintenance happening and can lead to long term challenges.
SLA (service level agreement)
The part of your contract promising how quickly your provider will respond to problems, graded by how serious the problem is. It is often the only enforceable promise about speed you have, so if you have never read yours, you do not know what you are entitled to.
Your IT Provider should be reporting back to you on how well they are meeting these.
Response time and resolution time
Response time is how long until someone acknowledges your problem. Resolution time is how long until it is actually fixed. Many contracts promise the first and say nothing about the second, which means a four-hour response on a problem that takes six days to fix is technically compliant.
SOW (statement of work)
A document describing one specific piece of work, what it will produce and what it will cost. This is often secondary to a Master Services Agreement, and you might get a new SOW for each project the provider undertakes.
It’s important to look for exclusions or anything missing from the SOW.
Out of scope
Work that falls outside your agreement, so it gets billed separately or refused. Hearing ‘out of scope’ often is a sign your contract no longer matches how your organisation actually works and it may be time for a review.
Vendor lock-in
When moving to a different provider or product would be so difficult or costly that you effectively cannot. Lock-in makes it very difficult to negotiate or hold your provider to account.
The protection is an exit clause obliging them to hand over your data in a usable format, your administrator credentials and your documentation within a set number of days. Few contracts include one unless somebody asks for it at signing.
Shared responsibility
Security and operations are split between you, your provider, and the companies whose software you use, with each party owning a defined part. Most serious failures happen in a responsibility nobody was covering, and assuming your provider covers something is not the same as them covering it.
Money and licensing
Capex and opex
Capital expenditure buys assets you own, like servers. Operating expenditure is ongoing running cost, like monthly subscriptions.
Moving to cloud services shifts technology spend from occasional large purchases to a steady monthly cost. Your total spend may not change much, but it stops being something you can defer in a tight year, and it moves out of the capital budget your board approves occasionally and into the operating budget.
Per-seat licensing
Paying for software based on how many people use it. Per-seat costs grow as you hire and do not shrink automatically when people leave, so licences for departed staff are one of the most common sources of waste.
True-up
A periodic reconciliation where a software vendor checks how many licences you are actually using and bills you for the difference. It can produce an unexpected invoice large enough to matter to your board.
Nonprofit and donated licensing
Discounted or free software offered by major vendors to eligible not-for-profits, usually accessed through a verification partner. Plenty of organisations pay full commercial rates for software they could get heavily discounted, simply because nobody checked.
TCO (total cost of ownership)
The full cost of a technology decision over its life, including implementation, training, support, integration and eventual replacement, not just the purchase price. Implementation and training are routinely left out of proposals, so make sure you check for those and ask about total cost of ownership to avoid surprises.
Refresh cycle
The planned schedule for replacing hardware such as laptops, usually every three to five years. Without one you get an unpredictable annual scramble and a fleet of ageing devices that can become a security or performance problem.
Security
MFA (multi-factor authentication)
Requiring something more than a password to sign in, usually a code or prompt on a phone. It is the highest value security control available to you and it is cheap. Most successful account compromises would have been stopped by it.
Sometimes called 2FA or two-factor authentication.
Phishing
Fake emails or messages designed to trick someone into handing over credentials or money. It is how many security incidents start, and it targets your people rather than your technology, which makes it your problem rather than purely your provider’s.
Business email compromise
A criminal gets into, or convincingly imitates, a real email account and uses it to redirect payments or extract information. This is the attack most likely to cost your organisation real money, and it often bypasses technical defences entirely because the email is genuine. A common control to avoid this is a standing rule that any change to bank details or major payments are verified by phone, on a number you already had.
Ransomware
Malicious software that locks up your data and demands payment. Increasingly the data is stolen as well and threatened with release. Your ability to recover depends almost entirely on decisions made before the incident, particularly about backups.
EDR (endpoint detection and response)vs antivirus
Antivirus blocks known bad software. EDR watches for suspicious behaviour and can respond to threats nobody has seen before.
The two are frequently confused in proposals, and EDR costs considerably more. The difference in value is not the software, it is whether a person is watching what the software reports and acting on it. EDR with nobody monitoring the alerts is much less effective – ask the provider how they will respond to alerts.
Patching
Applying updates that fix security flaws in software and devices. Unpatched systems are among the most common ways attackers get in. Patching is sometimes assumed in IT contracts – make sure you agree with your provider who will patch what, and how quickly.
Least privilege
Giving each person only the access they need to do their job, and no more. Over-generous access turns one compromised account into an organisation-wide incident, and it can make offboarding messy.
Privileged account
An account with elevated powers, able to change settings, add users or reach everything. These are the accounts attackers want, and they are also the ones most often shared informally between staff and providers.
Vulnerability scan vs penetration test
A vulnerability scan is an automated tool checking your systems against a list of known weaknesses. It runs in hours, costs in the hundreds to low thousands, and should be running regularly rather than once. A penetration test is a human expert spending days actively trying to break in, including by combining small weaknesses the tool would report separately. It is point-in-time and usually costs tens of thousands.
Commissioning a penetration test on an environment that has never been scanned and patched means paying expert rates for findings a cheap tool would have given you. Scan first, fix what it finds, then test. Buy a penetration test when you have something specific worth testing, such as a system holding sensitive client data or a new public-facing service, or when a funder, insurer or contract requires one.
Sometimes called vuln scanning or pen testing.
Essential Eight
Eight baseline security controls published by the Australian Signals Directorate, with maturity levels from zero to three. It gives you a recognised yardstick and language your board and funders will accept, and it is increasingly expected in government-funded work.
Security awareness training
Regular education for staff on recognising and reporting threats. Your people are the control that catches what technology misses, and annual compliance-tick training does not change behaviour. What changes behaviour is making it safe to report a mistake quickly, so ensure you’re building trust alongside skills.
Incident response plan
A written plan for who does what when something goes wrong. During an incident you may not be thinking clearly, and the plan is critical to keeping you on track. An untested plan is much less effective than one you have practised before you really need it.
Cyber insurance
Insurance covering costs arising from a cyber incident, such as recovery, legal advice and notification. Policies carry conditions, so if you declared that you have MFA and tested backups and you do not, you may not be covered at the point you need it.
There can be serious costs associated with down time for your business and the technology support to get things running again, so seriously consider the limits and wordings of cyber insurance.
Data and recovery
Backup and archive
A backup is a copy kept so you can recover from loss. An archive is long-term storage of information you must keep but rarely use, like tax information. They solve different problems and often get confused. Use archiving for long term storage, and backups in case data is lost or damaged, so you can restore it after an incident.
3-2-1 rule
Three copies of your data, on two different types of storage, with one copy held offsite (physically or digitally) or offline. It is a simple test you can apply without technical knowledge, and the separated copy is extremely important because modern ransomware deliberately targets backups that are stored in the same environment.
RTO and RPO (recovery time objective, recovery point objective)
RTO is how long you can be offline before the harm becomes serious. RPO is how much recent work you can afford to lose. If your RPO is 24 hours and your last backup ran last night, an incident this afternoon only costs you today’s work.
Both are business decisions rather than technical ones. Nobody but you can say whether your payroll team being offline for three days is survivable. They are also what makes competing quotes comparable, because an arrangement that restores you in two hours may cost several times one that restores you in two days.
Backup testing
Actually restoring data from a backup to confirm it works. Backups can fail without you knowing, and organisations regularly discover during a crisis that theirs have not run properly for months.
Data sovereignty
Which country your data is physically stored in, and therefore whose laws apply to it. Funding agreements and government contracts often require Australian storage, and many popular tools store data overseas by default. You can usually find a Trust Centre on a vendor website that will show you where data is stored.
Personal information
Information about an identifiable individual, defined in Australia by the Privacy Act. If you hold information about clients, members, donors or staff, you have legal duties regardless of your size or sector.
Notifiable Data Breaches (NDB) scheme
The Australian requirement to notify affected individuals and the Office of the Australian Information Commissioner when a breach is likely to cause serious harm. There are timeframes attached, so working out how you would assess and notify during the breach is far too late.
Data retention
How long you keep information before securely destroying it. Data you no longer need is still data that can be stolen, and still has to be disclosed if you are breached, so keeping everything forever increases both your storage bill and the size of the incident you would have to report. Retention periods are usually set by law or by your funding agreements, which makes this a question with an answer rather than a matter of preference.
Systems and infrastructure
Cloud
Software or computing power delivered over the internet from someone else’s data centre, rather than from equipment you own. Moving to cloud changes what you are responsible for but does not remove responsibility. The security of your accounts and the safety of your data usually remain yours, but you may not have to manage the server, depending on the service.
SaaS (software as a service)
Software you subscribe to and use through a browser, such as your finance system or CRM. Each one is a separate relationship with its own contract, its own data and its own risk. Often, organisations find their list of SaaS tools grows over time – it’s important to put in place restrictions on how new tools are purchased and decommissioned when no longer needed.
On-premise
Equipment and software running on hardware you own, usually in your own building. The costs that often get forgotten are power, physical security, replacement. In many cases, only one or two people have the skills and knowledge to maintain the equipment.
Tenant
Your organisation’s own private space inside a large cloud platform such as Microsoft 365. Your tenant is the boundary of your digital organisation, and whoever controls it controls your access to your own email, files and accounts.
Some providers set the tenant up under their own account for convenience, which means you cannot leave, or recover, without their cooperation. Consider if your organisation should be the registered owner, and at least one administrator account should sit with your own staff.
SSO (single sign-on) and identity provider
A central system that confirms who someone is and lets them sign in once to reach multiple applications. Central identity means you can remove someone’s access everywhere in one action. Without it, offboarding is a manual list and items may be missed.
MDM (mobile device management)
Software that lets you enforce settings on laptops and phones, and wipe them remotely if they are lost. Staff devices carry your data out of the building every day, and without management you have no way to enforce or prove anything about them.
End of life and end of support
The point where a vendor stops providing updates for a product, including security fixes. Running unsupported software is a known, dated and avoidable risk, which makes it very hard to defend to a board or an insurer afterwards.
API (application programming interface) and integration
An integration is a connection that lets two systems share information. An API is the technical interface that makes it possible.
Uptime
The percentage of time a service is available, often quoted as a number of nines. The figures usually exclude planned maintenance, and the compensation for missing them is typically a small service credit.
Shadow IT
Tools and subscriptions staff have adopted on their own, without anyone central knowing. It carries real data risk, but it is usually a signal that the official tools are not meeting a need.
Artificial intelligence
Generative AI
Software that produces new text, images, code or audio in response to an instruction, rather than retrieving something that already exists. Your staff are almost certainly already using it, so the decision in front of you is not whether to adopt it. It is whether the use already happening is happening safely.
LLM (large language model)
The kind of model behind most text-based AI tools. It works by predicting likely wording, which is why it is fluent and why it is not reliable in the way a database is. It is not looking anything up. It is producing the most plausible-sounding answer, which is usually right and is confidently wrong often enough to matter.
Prompt
The instruction you give an AI tool. Output quality depends heavily on the instruction, so two staff using the same approved tool can get very different results. That is a training problem rather than a technology one, and it is very important to consider this in AI deployments.
Hallucination
When an AI tool produces something false and presents it as fact, including invented citations, figures and legal references. AI can produce a plausible, well-written error that may look correct on the surface, so checking outputs is necessary.
Human in the loop
A requirement that a person reviews and approves AI output before it is used. This may be as simple as reviewing documents and cited sources, but can also apply to AI decision making systems and agents.
AI features in tools you already pay for
AI assistants built into products you already use, often switched on by the vendor. They arrive without a procurement decision, which means they can be in use across your organisation before anyone has checked if they meet your requirements.
Shadow AI
Staff using free or self-paid consumer AI tools on work information, without approval and usually without any intention to do harm. Board papers and client records pasted into a free tool have left your control, and on free accounts may have fed the vendor’s training data. It is a very common AI risk, and it can be caused by not offering an approved alternative.
Training data
The material a model was built from – often including large swathes of the internet. Separately, it can mean whatever you put into a tool, if the vendor’s terms allow them to use it to improve their models. Whether your information is used for training is a contract term, and it usually differs between the free and the paid version of the same product.
AI agent
An AI tool given the ability to take actions on its own, such as sending emails or updating records, rather than only producing text for a person to use. Agents change the risk from a bad answer to a bad action, so anything able to act needs the same access controls you would apply to a staff member, and usually tighter ones.
Automated decision-making
Using a system, with or without AI, to make or substantially influence a decision about a person, such as eligibility, prioritisation or assessment. Decisions about people carry obligations that ordinary software use does not, and for a service organisation it raises a fairness question your board will care about regardless of the law.
Bias
A pattern in a system’s output that disadvantages a particular group, usually inherited from the data it was built from. These issues can be hard to spot so it’s important to test systems that are used for decision making for bias and to review generative AI outputs for bias.
AI washing
Marketing that describes ordinary software as AI-powered in order to justify attention or price. It removes your ability to use the word as a signal, so the useful question is what specific task the product does and how you would know it did it well.
AI acceptable use policy
A short internal document saying which tools staff may use, on what kinds of information, and what must be checked by a person. It should name approved tools and forbidden data in plain terms, because a policy staff cannot remember is a policy staff will not follow.
AI register
A record of where AI is being used across your organisation, what data each use touches, and who is accountable for it. It is the AI equivalent of an asset register.
Governance and strategy
IT governance
The structures and decisions that determine how technology choices get made, funded and overseen. This can not be outsourced and your organisation will need to make these decisions.
Digital strategy and IT strategy
An IT or Digital strategy sets out your vision for how technology impacts your organisation, its customers or stakeholders and its staff. It doesn’t have to be long, but it should be specific enough to help us decide what to do and what not to do. Your strategy might position you at the cutting edge where tech is your competitive advantage, or it might be to maintain the most secure environment possible — there will always need to be trade-offs in your strategy and it should always link directly to your organisational strategy.
Technology roadmap
A sequenced view of planned technology work over the next one to three years, with rough timing and cost. It converts a stream of urgent requests into a plan you can fund and resource. Your roadmap should deliver on your strategy.
Risk register
A maintained list of risks, each with an owner, a rating and an agreed treatment. It should be refreshed annually or if your environment or threats change.
Risk appetite
How much risk your organisation has decided it is willing to accept in pursuit of its mission. Without an agreed appetite, every security decision can become a revisiting of similar issues.
Technical debt
The accumulated cost of past shortcuts and deferred upgrades, which makes future change slower and more expensive. It explains why simple requests keep turning out to be expensive and difficult.
Asset register
A record of the devices, systems, data sources and subscriptions you own or pay for. You cannot secure, budget for or decommission things you do not know you have, and this is the most basic and most commonly missing document.
BAU (business as usual) vs project work
BAU is the ongoing work of keeping things running. Project work is time-limited change with a defined outcome.
Change management
The work of helping people adopt a new system, including communication, training and support. Most failed technology projects were technically delivered and failed at adoption – this is often because of ineffective change management.
Technical change management is also important to ensure systems are configured correctly and continue to support business needs through change.
Maturity model
A framework describing progressive levels of capability, so you can see where you are now and what the next step looks like. It replaces the unanswerable question “are we doing enough?” with a position and a direction.
Business case
A structured argument for spending money, covering the problem, the options, the cost and the expected benefit. It should answer three questions: what does this let us do that we cannot do today, what happens if we do nothing, and what does it cost over three years rather than one.
