IT, Microsoft & cloud terms, in plain English

#

3-2-1 Backup Rule

Keep at least three copies of your data, on two different types of storage, with one copy held off site. It is still a sound baseline, but with ransomware in mind the off-site copy now also needs to be immutable or offline, so an attacker holding admin rights cannot delete it.See: Backup & Disaster Recovery · Backup and restore readiness checklist

A

Active Directory (AD DS)

Microsoft's on-premises directory service, which holds the users, groups and computers of a Windows domain and applies Group Policy to them. Many organisations still run it alongside Entra ID, synchronising identities to the cloud, and Windows Server session hosts for RDS and AVD Hybrid commonly join it.See: Endpoint Management · Azure Virtual Desktop Hybrid

Agent 365 (Microsoft Agent 365)

Microsoft's control layer for AI agents across a tenant: an inventory of agents with their owners, and the governance and security controls, such as extending Conditional Access to agent identities, that treat an agent more like a member of staff. It is included in Microsoft 365 E7 and sold as an add-on to E5, A5 and Business Premium.See: AI agents on Microsoft Foundry

Agent ID (Microsoft Entra Agent ID)

An identity in Microsoft Entra issued to an AI agent rather than to a person or an application, so the agent's access can be scoped, owned, sponsored, reviewed and revoked like any other account. Agent identities appear in the Entra admin center under Agent ID, alongside Copilot Studio agents.See: AI agents on Microsoft Foundry · AI agents governance checklist

AI Agent

An AI system that does more than answer questions: it is given a job, tools and access, and takes actions such as updating a record, raising a ticket or sending a message. Because it acts rather than advises, it needs its own identity, least-privilege access to its tools, human approval for consequential actions and a named owner.See: AI agents on Microsoft Foundry · AI agents governance checklist

AiTM (Adversary-in-the-Middle)

A phishing technique that sidesteps multi-factor authentication by proxying the login and stealing the resulting session token, so the attacker inherits an already-authenticated session. Defended with phishing-resistant MFA, device-bound Conditional Access and token protection.See: Microsoft 365 security gaps · Security Services

App Attach

An Azure Virtual Desktop feature that attaches applications to a user's session at sign-in from a disk image on a file share, instead of installing them in every image, so the base image stays lighter and an application can be updated without a rebuild. It takes MSIX, Appx and App-V packages, and is included with Azure Virtual Desktop rather than licensed separately.See: Application Packaging & MSIX · CI/CD packaging workflows

App Protection Policy (MAM)

An Intune policy that protects company data inside specific apps, such as Outlook and Teams on a personal phone, without enrolling or controlling the whole device. It can require a PIN, stop copying into personal apps and wipe only the work data, which makes it the usual approach for BYOD.See: Endpoint Management · Intune device management checklist

App-V (Application Virtualization)

A Microsoft technology that virtualises applications into isolated packages so they run without being fully installed on the operating system. Extended support for the App-V server components (Management, Publishing and Reporting) ended on 14 April 2026, while the client in Windows 10 and 11 Enterprise follows the Windows lifecycle. Microsoft's investment is in MSIX, and Systech migrates App-V estates to it.See: App-V to MSIX migration · Application Packaging & MSIX

Application Capture

Recreating an installable package for an application from a machine where it already runs, when the original installer, media or vendor is no longer available. It is the route for legacy line-of-business software that has to move to a new operating system but cannot be reinstalled the normal way.See: Legacy Modernisation & OS Migration · EtherApps Forge

Application Modernisation

Moving the applications a business relies on onto modern, supported platforms, incrementally rather than via a risky big-bang rewrite, often replatforming onto Azure and the Microsoft stack.See: Development & Application Modernisation · Modernisation without a rewrite

Application Repackaging

Turning a vendor's installer into a standard, tested package, typically MSIX or an Intune Win32 app, with the settings, licensing and silent install your estate needs. Done once and properly, every device gets the same result; done by hand on each machine, it is where configuration drift starts.See: Application Packaging & MSIX · CI/CD packaging workflows

Autopilot (Windows Autopilot)

A Microsoft service that configures a new device into your standard build from its out-of-box state, so a replacement machine can be shipped straight to a person rather than imaged by hand first. It delivers whatever configuration you have defined, which means it is only as good as the state of your Intune configuration underneath it.See: Endpoint Management · Intune device management checklist

Autoscale (AVD scaling plans)

Azure Virtual Desktop's scheduled scaling, which starts, stops and deallocates session hosts to match demand across the working day, and one of the larger cost levers in cloud AVD. It relies on the service managing the hosts, so it is not available in AVD Hybrid.See: AVD cost optimisation · Azure Virtual Desktop consultancy

Azure

Microsoft's public cloud platform for hosting virtual machines, storage, databases, networking and more. Systech helps businesses migrate to, optimise and control the cost of their Azure estate.See: Cost Management & Azure Optimisation · Cutting Azure waste

Azure Arc

A Microsoft service that registers servers and other resources running outside Azure, on premises or in another cloud, so they can be managed, governed and monitored from Azure. AVD Hybrid uses it to connect your own session hosts to the Azure Virtual Desktop service.See: Azure Virtual Desktop Hybrid

Azure Hybrid Benefit

A licensing benefit that lets you use Windows Server and SQL Server licences you already own, with active Software Assurance or a qualifying subscription, to pay a lower rate for the same workloads in Azure. Often missed in migration cost models, and one of the first checks in an Azure cost review.See: Licensing & Cost Management · Cost Management & Azure Optimisation

Azure Local (formerly Azure Stack HCI)

Microsoft's own on-premises infrastructure platform, run on validated hardware in your building and managed through Azure. Azure Virtual Desktop can place session hosts on Azure Local at version 23H2 or later, including Windows 11 and Windows 10 Enterprise multi-session, with its own platform and per-vCPU fees. It is a different offering from AVD Hybrid, which uses the hypervisor or servers you already run.See: AVD Hybrid vs Azure Local · AVD, Windows 365 and hybrid decision guide

Azure Virtual Desktop (AVD)

Microsoft's cloud virtual desktop (VDI) service, delivering Windows desktops and applications from Azure to any device. It supports Windows 11 Enterprise multi-session, so several users can share one host, which makes it flexible and cost-effective at scale. Session hosts can also run on premises through AVD Hybrid or Azure Local.See: Azure Virtual Desktop consultancy · Windows 365 vs AVD · AVD cost optimisation

Azure Virtual Desktop Hybrid (AVD Hybrid)

Azure Virtual Desktop with the session hosts on infrastructure you already own: Windows virtual machines on your existing hypervisor, or headless physical Windows Server machines, onboarded through Azure Arc, while the AVD service stays in Azure. It does not support Windows 11 or Windows 10 Enterprise multi-session, and autoscale, power management and Start VM on Connect are not available. It suits applications that need to sit next to on-premises data, and it is not the same as AVD on Azure Local.See: Azure Virtual Desktop Hybrid · AVD, Windows 365 and hybrid decision guide

B

Backup (3-2-1 & immutable)

Keeping recoverable copies of servers, endpoints and Microsoft 365 data. Good backup is monitored and regularly restore-tested, and keeps immutable, ransomware-resilient copies that an attacker cannot alter or delete.See: Backup Services

BEC (Business Email Compromise)

A targeted attack where a criminal impersonates a trusted person, often an executive or supplier, to trick staff into transferring money or data. Impersonation protection and email security defend against it.See: Email Security & Archive · Microsoft 365 security gaps

Break-fix

Paying for IT help only when something has already gone wrong, with no ongoing contract or coverage in between. It looks like the cheapest model because there is no monthly baseline, but nothing is monitored, patched or protected between incidents, so cost moves out of a predictable line item and into downtime, data-loss risk and premium emergency call-out pricing. Generally the most expensive model in practice for any business with real dependencies on its systems.See: Managed IT vs in-house vs break-fix

Break-glass Account (emergency access)

An administrator account kept out of everyday use so someone can still sign in when normal admin access fails, for example after a Conditional Access mistake or an MFA outage. Microsoft recommends at least two, cloud-only, protected by a passkey or certificate different from your usual admin method, excluded from blocking Conditional Access policies, alerted on every sign-in and tested at least every 90 days.See: Microsoft 365 security posture

BYOD (Bring Your Own Device)

Staff using personally owned phones or laptops for work. It is usually cheaper and almost always harder to evidence, because personal devices accessing organisational data are in scope for frameworks like Cyber Essentials whether or not anyone counted them.See: Endpoint Management · Cyber Essentials Certification

C

Call-Off Contract (day packs)

A block of days bought up front and drawn down as needed, rather than quoting each piece of work separately. Common in public sector procurement and increasingly used privately, mainly because it removes the purchase order that otherwise sits in front of every small job.See: Call-off day packs

Cat 6A

Twisted-pair copper cabling rated for 10 Gbps Ethernet over a full 100 metre channel, and the specification the DfE expects for new or replacement network cabling in schools. Cabling outlasts several generations of switches and access points, so specifying it properly once avoids pulling cable again.See: Networking · DfE digital standards

CI/CD (Continuous Integration / Delivery)

An automated pipeline that builds, tests and deploys software, or application packages, repeatably, replacing slow, manual, person-dependent work. Systech builds CI/CD packaging workflows for customers.See: CI/CD packaging workflows · Application Packaging & MSIX

CIS Benchmark

Consensus configuration guidance published by the Center for Internet Security for specific products, including Microsoft 365, Windows and Azure, setting out recommended settings and how to check each one. A useful independent yardstick for a tenant, read alongside Microsoft's own Secure Score.See: Microsoft 365 security posture · Microsoft 365 Security Posture Assessment

Citrix (Citrix Virtual Apps and Desktops)

A long-established platform for publishing virtual desktops and applications, on premises or in the cloud. A licence renewal is the usual point at which an estate compares it with Azure Virtual Desktop and Parallels RAS, and the comparison turns on licensing model, what transfers and where the session hosts need to run.See: Citrix vs Parallels RAS vs AVD · Citrix to AVD migration

Cloud PC

A dedicated Windows desktop that runs in Microsoft's cloud and is assigned to one user, which is what Windows 365 provides. Unlike a pooled Azure Virtual Desktop host it is not shared, it keeps its state between sessions, and it has a fixed monthly price per user.See: Windows 365 consultancy · AVD vs Windows 365

Co-managed IT

An arrangement where internal IT staff and an external provider divide responsibility for one estate deliberately. Typically the internal side keeps user-facing support, business priorities, vendor relationships and project ownership, while the provider takes monitoring, patching, security tooling, out-of-hours cover and occasional specialist work. Common in organisations at the upper end of the 10 to 250 user range. The failure mode is both sides assuming the other is watching something, which a written responsibility matrix prevents.See: Co-managed IT support · Co-managed IT responsibility matrix · MSP vs internal IT

Co-management

Running Microsoft Intune and Configuration Manager against the same Windows devices at once, with individual workloads moved from one to the other a piece at a time. It is the supported route away from an on-premises estate, and it is reversible, which is why it is safer than a cutover.See: Endpoint Management

Compliance Pack

The set of policies, procedures and standard operating procedures that a framework such as Cyber Essentials, ISO 27001 or the DSP Toolkit expects you to have, written around how your organisation actually works. Its value is in being followed and kept current, which a downloaded template rarely is.See: Compliance Packs & Audit Readiness · Compliance pack starter kit

Compliance Policy (Intune)

An Intune rule set defining what a 'healthy' device looks like (encryption, OS version, security settings). Paired with Conditional Access, it ensures only compliant, managed devices can reach company data.See: Intune management & reporting · Intune device management checklist

Conditional Access

Microsoft Entra policies that control who can access Microsoft 365 and under what conditions, for example requiring MFA, a compliant device or a trusted location. The backbone of a strong identity security posture.See: Microsoft 365 security gaps · Security Services

Configuration Manager (SCCM/MECM)

Microsoft's long-standing on-premises management product for Windows devices and servers, now called Microsoft Configuration Manager. Still stronger than Intune at complex application deployment, task-sequence operating system builds and bandwidth-constrained networks, which is why plenty of estates keep it deliberately.See: Endpoint Management

Connection Broker (RD Connection Broker)

The Remote Desktop Services role that decides which session host a user lands on, balances load across the farm and reconnects people to sessions they left running. Without it, or a highly available pair, new sessions cannot start even when every host is healthy.See: Remote Desktop Services · RDS health checklist

Copilot (Microsoft 365 Copilot)

Microsoft's AI assistant embedded across Microsoft 365 apps, which Microsoft now calls Microsoft Copilot in its business documentation. The paid licence grounds answers in your organisation's mail, files and meetings through Microsoft Graph, and it inherits each user's existing access, so a readiness assessment of data and permissions is essential before switching it on.See: AI Solutions · Copilot readiness · Copilot Readiness Assessment

Copilot Agent

A configured Copilot with its own instructions and a defined set of sources, published for other people to use. The governance question changes at the point of publishing, because an agent answers from whatever it has been pointed at, to whoever can reach it.See: AI & Copilot Adoption

Copilot Chat (Microsoft Copilot Chat)

The AI chat included at no extra cost for users signed in with a work account and a qualifying Microsoft 365 subscription. It is grounded in the web and in content a user uploads or has open, but unlike the paid Copilot licence it cannot reason across your organisation's mail, files and meetings through Microsoft Graph.See: AI & Copilot Adoption

Copilot Studio

Microsoft's low-code tool for building agents that extend Copilot, connect to other data sources and automate business processes. Agents made in it sit alongside other agent identities in Microsoft Entra, so they belong in the same inventory, each with an owner and a review date.See: AI agents on Microsoft Foundry · AI agents governance checklist

Credential Stuffing

Automated login attempts using username and password pairs stolen from some other breach, on the assumption that people reuse passwords. It is why a password that has never leaked from your systems can still be the one that lets somebody in.See: Security Services

CSP (Cloud Solution Provider)

Microsoft's partner programme for reselling and supporting Microsoft 365 and Azure subscriptions. A CSP partner bills you directly rather than Microsoft doing so, can adjust licence counts, and provides first-line support for the subscriptions themselves. It describes a licensing and billing relationship, not a scope of managed work, so Microsoft CSP status says nothing on its own about who answers when a server stops responding.See: MSP vs CSP vs MSSP · Licensing & Cost Management

Cyber Essentials

A UK government-backed certification covering five basic security controls, assessed through a self-assessment questionnaire that a Certification Body marks. Increasingly required for public-sector and supply-chain contracts and by cyber insurers. Systech holds it and helps clients prepare; certification itself comes from a Certification Body.See: Cyber Essentials in 30 days · Cyber Essentials checklist · Cyber Essentials Certification

Cyber Essentials Plus

The independently audited version of Cyber Essentials, where an assessor verifies the controls through hands-on technical testing rather than self-assessment.See: Cyber Essentials vs Plus · Security Services

D

Data Loss Prevention (DLP)

Policies that detect sensitive information, such as card numbers or personal data, and warn, block or log when someone tries to share it outside approved boundaries. In Microsoft 365 it is part of Purview and covers email, SharePoint, OneDrive, Teams and devices.See: Microsoft 365 · Security Services

Data Residency

Where your data is physically stored and processed. Microsoft 365 and Azure can keep data in UK datacentres, but backups, add-ons and AI services can sit elsewhere unless someone checks, which matters for client confidentiality terms, public sector contracts and the DfE's cloud expectations for schools.See: Microsoft 365

Defender for Business (Microsoft Defender for Business)

Microsoft's endpoint security product for organisations of up to 300 users, bringing endpoint detection and response, antivirus and automated investigation to Windows, macOS and mobile devices. It is included in Microsoft 365 Business Premium.See: Security Services · Business Premium value

Defender for Office 365 (Microsoft Defender for Office 365)

Microsoft's email and collaboration protection on top of the filtering built into Exchange Online: Safe Links checks links when they are clicked, Safe Attachments opens attachments in a sandbox first, and Plan 2 adds investigation tools and attack simulation training. Plan 1 is included in Business Premium.See: Email Security & Archive · Mimecast and Defender for Office 365

DfE Digital and Technology Standards

The Department for Education's guidance on the digital infrastructure and technology schools and colleges in England should have, across twelve topic areas. Six are core standards that schools and colleges should be working towards by 2030; filtering and monitoring should be met now, because it sits under statutory safeguarding guidance.See: DfE digital standards · Where to start before 2030

DfE Plan Technology for Your School

The DfE's free online service for schools and colleges in England to assess themselves against the digital and technology standards and plan next steps. It gives a self-reported position, so an independent look at the tenant, the network cabinet and the contracts usually finds what a questionnaire cannot.See: Where to start before 2030 · DfE digital standards

Disaster Recovery (DR)

The plan and tooling for restoring systems and data quickly after a major incident such as ransomware, hardware failure or human error. Only as good as the last tested restore.See: Backup Services

DMARC, SPF & DKIM

Email authentication records that prove a message genuinely came from your domain, making it far harder for attackers to spoof you. A core part of defending against phishing and BEC.See: Email Security & Archive · Microsoft 365 security gaps

DPIA (Data Protection Impact Assessment)

An assessment UK GDPR requires before processing that is likely to result in a high risk to people's rights, such as large-scale use of sensitive data or new technology like AI. It records what the processing is, why it is necessary, the risks and how they are reduced, and it has to be done before the processing starts.See: AI assessment & shadow AI audit · Compliance Packs & Audit Readiness

DSP Toolkit (Data Security and Protection Toolkit)

The NHS self-assessment that organisations handling health and care data complete annually to evidence their data security position. Required of suppliers as well as providers, which catches out businesses who did not think of themselves as being in healthcare.See: Compliance Packs & Audit Readiness

DUAA (Data (Use and Access) Act 2025)

UK legislation that amends UK GDPR, the Data Protection Act 2018 and PECR. Among other changes it relaxed the general restriction on solely automated decisions with significant effects, except where special category data is involved, while requiring safeguards: telling people, letting them make representations and contest the decision, and giving them human review.See: Automated decisions after the DUAA · AI assessment & shadow AI audit

E

eDiscovery and Legal Hold

Finding, preserving and exporting electronic information, such as email, chat and files, for a legal case, investigation or subject access request. In Microsoft 365 it runs through Purview, and a hold stops relevant content being deleted or altered while the case is open.See: Email Security & Archive · Compliance Packs & Audit Readiness

EDR (Endpoint Detection and Response)

Security technology that continuously monitors devices (endpoints) for threats and enables rapid investigation and response, going well beyond traditional antivirus.See: Security Services

Egress Charges

What a cloud provider bills for moving data out of its platform. Frequently missed in cloud cost modelling, and worth understanding before a migration rather than after, because it is one of the few costs that grows when you decide to leave.See: Cost Management & Azure Optimisation · Cutting Azure waste

Email Archiving

Keeping a complete, searchable, tamper-proof record of every message independent of the mailbox, for compliance, legal hold and reconstructing what happened after an incident.See: Email Security & Archive

Entra ID (formerly Azure AD)

Microsoft's cloud identity service, and the thing that actually decides who can reach what across Microsoft 365 and Azure. Renamed from Azure Active Directory in 2023, which is why documentation and job adverts still use both names for the same product.See: Microsoft 365

Entra ID P1 and P2

The paid tiers of Microsoft Entra ID. P1 brings Conditional Access and is included in Business Premium and Microsoft 365 E3; P2 adds ID Protection's risk-based sign-in and user risk policies, Privileged Identity Management and access reviews, and comes with E5.See: Microsoft 365 licensing guide · Business Premium value

EU AI Act

The EU's regulation on artificial intelligence, which classifies systems by risk and attaches obligations accordingly. It applies to UK businesses selling into the EU or serving EU users, and it phases in over several years, so what is currently in force matters more than the headline dates: the transparency duties and the high-risk obligations have different timelines. Unlike ISO 42001 it is law rather than a voluntary standard, and certification to a standard does not confer conformity with it.See: What actually started in August 2026

Extended Security Updates (ESU)

Paid security patches Microsoft offers for an operating system after free support ends, buying time to migrate. In use for Windows 10 following its October 2025 end of life, and the next decision for Windows Server 2016, whose extended support ends on 12 January 2027.See: Windows 10 ESU vs Windows 11 vs Cloud PC · Windows Server 2016 end of support

F

Filtering and Monitoring (schools)

The systems that stop pupils reaching harmful or inappropriate content online, and alert staff to concerning activity on school devices and networks. Keeping Children Safe in Education makes appropriate filtering and monitoring a responsibility of governing bodies and proprietors, and the DfE standard expects named leads, a documented approach and a review at least once every academic year.See: The DfE filtering and monitoring standard · IT for education

FinOps

The practice of managing cloud spend as an ongoing discipline rather than an annual clean-up, by attributing costs to the teams and projects that create them so the people making the decisions can see what they cost.See: Cost Management & Azure Optimisation · A monthly cloud cost routine

FSLogix (profile containers)

Microsoft's technology for keeping a user's Windows profile in a virtual disk (a VHD or VHDX file) on network storage, attached at sign-in so the profile appears local to whichever session host the user lands on. It is the standard profile approach for Azure Virtual Desktop and is widely used on Remote Desktop Services in place of roaming profiles and User Profile Disks.See: Azure Virtual Desktop consultancy · Remote Desktop Services

G

Gap Analysis

Comparing what a framework requires against what you actually do, and listing the difference. The useful version produces a ranked list of what would fail today; the less useful version restates the framework back at you.See: Compliance Packs & Audit Readiness · Cyber Essentials Certification

GDAP (Granular Delegated Admin Privileges)

Microsoft's model for giving a partner administrative access to a customer's tenant: limited to specific roles, time-bound, and only in place once the customer explicitly approves it. It replaced the older arrangement in which partners could hold broad Global Administrator rights by default, and it is the access model to ask any provider about.See: Managed IT Services · Co-managed IT support

Golden Image

The master operating system image that session hosts or devices are built from, with the agreed applications, settings and updates already in place. Versioning it and rolling it out in stages keeps every host the same; letting it go stale means every rebuild starts months behind on patches.See: Azure Virtual Desktop consultancy · Application Packaging & MSIX

Grounding

Constraining an AI model to answer from specific source material rather than from what it absorbed in training. It is the mechanism that makes an answer traceable, and its absence is why an ungrounded model produces confident, plausible, unverifiable text.See: AI Engineering

Group Policy

The Active Directory mechanism for pushing settings to domain-joined Windows devices and their users. It still works for machines that never leave the network, but it does not reach cloud-only or remote devices the way Intune does, so most estates moving to Intune run both for a while and retire policies deliberately.See: Endpoint Management

H

Hallucination

An AI model stating something false with the same fluency it states something true. Not a bug to be patched out, but a property of how these systems generate text, which is why production systems need retrieval, citations and an explicit route to saying they do not know.See: AI Engineering

Host Pool

In Azure Virtual Desktop, a group of session hosts built from the same configuration and presented to users as one service. A pooled host pool shares its hosts between many users; a personal one gives each user their own machine.See: Azure Virtual Desktop consultancy · AVD cost optimisation

Human in the Loop

Designing an AI system so a named person reviews and approves an action before it takes effect, particularly anything consequential such as paying money, changing records or contacting customers. Microsoft's guidance for agents that call tools is to require approval for high-risk operations and to log both the approvals and the tool calls.See: AI agents on Microsoft Foundry · AI agents governance checklist

Hybrid Join (Microsoft Entra hybrid join)

A device state in which a Windows machine is joined to on-premises Active Directory and also registered with Microsoft Entra ID, so it can take Group Policy and still reach cloud services under Conditional Access. A common bridge for estates on the way to cloud-only Entra join.See: Endpoint Management · Azure Virtual Desktop Hybrid

Hypervisor

The software layer that runs virtual machines on a physical server and shares its processors, memory and storage between them, such as Microsoft Hyper-V or VMware ESXi. Which one you run, how it is backed up and when its licence renews often shape a server or virtual desktop roadmap.See: VM backup compared · Azure Virtual Desktop Hybrid

I

IaaS, PaaS & SaaS

The three cloud service models, distinguished by how much you still run yourself. Infrastructure as a Service gives you virtual machines and leaves the operating system to you; Platform as a Service runs the platform and leaves you the application; Software as a Service is the finished product. The practical consequence is where your responsibility for patching and backup stops.See: Development & Application Modernisation

IASME

The organisation that delivers the Cyber Essentials scheme for the National Cyber Security Centre, licensing the Certification Bodies that assess applicants and setting the published certification fees. Certificates are issued through those Certification Bodies; Systech helps organisations prepare for assessment and is not one of them.See: Cyber Essentials Certification · What Cyber Essentials costs

ICO (Information Commissioner's Office)

The UK's independent regulator for data protection, which enforces UK GDPR, the Data Protection Act 2018 and the electronic marketing rules, publishes guidance and receives reports of personal data breaches. A reportable breach has to be notified to it within 72 hours of the organisation becoming aware of it.See: Automated decisions after the DUAA · Compliance Packs & Audit Readiness

Immutable Backup

A backup that cannot be altered or deleted for a set period, including by an administrator. It is the control that separates a backup which survives ransomware from one an attacker encrypts alongside everything else, and insurers increasingly ask about it by name.See: Backup & Disaster Recovery · VM backup compared

Internal Audit

Checking your own controls against a framework before somebody external does. The point is not the report, it is finding the things that would fail while there is still time and no deadline attached to fixing them.See: Compliance Packs & Audit Readiness

Intune (Microsoft Intune)

Microsoft's cloud device management (MDM) service. Intune enrols, secures, patches, reports on and, if needed, wipes company and personal devices, and enforces compliance through Conditional Access.See: Intune management & reporting · End-User Computing · Intune device management checklist

ISMS (Information Security Management System)

The policies, risk assessments, controls and review cycle an organisation uses to manage information security as an ongoing process rather than a project. ISO 27001 sets out the requirements for one, and certification audits the system as a whole rather than any single technical control.See: ISO 27001 audit partnership · Compliance Packs & Audit Readiness

ISO 27001

The international standard for information security management systems (ISMS). Certification demonstrates a structured, audited approach to managing information security risk.See: ISO 27001 audit partnership · Security Services

ISO 9001

The international standard for quality management systems, covering how an organisation plans, delivers, measures and improves its work. Systech is certified to it alongside ISO 27001, both by NDC Certification Services.See: Our certifications

ISO/IEC 42001 (AI Management System)

The first international standard for governing artificial intelligence, published in December 2023 and certifiable. It follows the same shape as ISO 27001, with management system clauses 4 to 10 and 38 Annex A controls under nine objectives, of which you implement the ones your risk assessment calls for rather than all of them. It certifies that your organisation governs AI competently, not that any particular AI system is safe, and it does not by itself make you compliant with the EU AI Act.See: Compliance Packs & Audit Readiness

K

KCSIE (Keeping Children Safe in Education)

The DfE's statutory safeguarding guidance for schools and colleges in England, revised most years. For IT it is where the duty for appropriate filtering and monitoring comes from, with governing bodies and proprietors responsible for making sure it is in place and reviewed.See: The DfE filtering and monitoring standard · IT for education

Kemp LoadMaster

A load balancer and application delivery controller, now owned by Progress, often found in front of Exchange, Remote Desktop Services and web applications. Licensing and support terms have changed since the acquisition, so older units are worth checking against their end of support dates.See: Kemp LoadMaster support and lifecycle · LoadMaster health check

L

Landing Zone

A pre-built Azure environment with the identity, network, policy and cost controls already in place, so workloads arrive into a governed structure rather than into an empty subscription. Cheaper to build first than to retrofit once several teams are already running things.See: Cost Management & Azure Optimisation

Least Privilege

Giving an account only the access it needs to do its job, and only for as long as it needs it. Simple to state and awkward to maintain, because access accumulates quietly through role changes and nobody is ever thanked for removing some.See: Security Services · Microsoft 365 security gaps

Legacy Modernisation & OS Migration

Moving off end-of-life operating systems and applications onto modern, supported platforms, including capturing legacy apps that have no install media and repackaging them for a current OS.See: Legacy Modernisation & OS Migration · Legacy apps: security, cost & carbon · Legacy Migration Roadmap

LLM (Large Language Model)

A general-purpose AI model trained on vast amounts of text, able to understand and generate language. LLMs power tools like Copilot and custom AI applications.See: AI Engineering & Custom AI Solutions

Load Balancer

A device or service that spreads incoming connections across several servers and stops sending traffic to one that fails a health check. It tends to be installed once and forgotten while it works, which is why firmware, certificates and support contracts on load balancers are so often out of date.See: Kemp LoadMaster support and lifecycle

M

Managed Detection and Response (MDR)

An outsourced service where people monitor your security alerts around the clock and act on the ones that matter. The distinction from buying an EDR product is that somebody is watching it, which is the part most businesses cannot staff themselves.See: Security Services

Managed Firewall

A firewall service that is continuously monitored, backed up, patched and reported on, rather than installed once and forgotten. Systech's runs on an in-house built platform.See: Managed Firewall · Managed firewall vs DIY · Managed Firewall: what's included

Managed IT Services

Outsourced day-to-day IT: monitoring, a service desk, patching, backup oversight and device management for a predictable monthly fee, rather than reactive break-fix support. Out-of-hours and 24/7 cover are usually options on top rather than part of the base service.See: Managed IT Services · Pricing · vs in-house and break-fix

MCP (Model Context Protocol)

An open protocol, introduced by Anthropic in 2024 and now supported by Microsoft among others, for connecting AI models and agents to tools and data sources through one standard interface. Each MCP server an agent can call is a route into your systems, so Microsoft advises requiring approval for high-risk tool calls and treating results from remote servers as untrusted input.See: AI agents on Microsoft Foundry · AI agents governance checklist

MFA (Multi-Factor Authentication)

Requiring more than a password to sign in, typically a code or approval on a second device. Essential, but on its own it does not stop token-theft attacks, which is why Conditional Access and phishing-resistant methods matter.See: Microsoft 365 security gaps · Security Services

Microsoft 365

Microsoft's cloud productivity and security suite (Exchange, Teams, SharePoint, OneDrive, identity, Intune and more). Systech deploys, governs, secures and supports the whole platform.See: Microsoft 365 · SharePoint vs Teams vs OneDrive

Microsoft 365 Backup

Microsoft's own backup product for OneDrive, SharePoint and Exchange Online, which keeps restore points inside the Microsoft 365 service boundary and is billed by the amount of data protected. It restores quickly at scale, but because the copies stay inside Microsoft 365 it is not an independent, off-platform copy, which some organisations still need.See: Microsoft 365 backup · Microsoft 365 Backup pricing

Microsoft 365 Business Premium

The Microsoft 365 plan that bundles the productivity apps with the security stack (Defender, Intune, Conditional Access), best value for most SMBs up to 300 users.See: Business Premium value · Microsoft 365

Microsoft 365 E3, E5 and E7

The enterprise Microsoft 365 plans, which have no 300-user cap. E3 covers the apps, device management and Entra ID P1; E5 adds Entra ID P2, the higher Defender tiers and fuller Purview capabilities; E7, generally available since 1 May 2026, is E5 plus the Copilot licence, the full Microsoft Entra Suite and Agent 365.See: Microsoft 365 licensing guide · Microsoft 365 licensing review

Microsoft Foundry

Microsoft's Azure platform, formerly Azure AI Foundry, for building, testing and running AI applications and agents, with a catalogue of models, tools and evaluation. Agents built there can run under their own Entra agent identity and be published to Teams and Microsoft 365 Copilot.See: AI agents on Microsoft Foundry · AI Engineering

Microsoft Purview

Microsoft's family of data governance and compliance tools: sensitivity labels, data loss prevention, retention, eDiscovery, audit and Insider Risk Management. Much of what an organisation needs before switching on Copilot is already licensed in Purview; the usual gap is that it was never configured.See: SharePoint checks before Copilot · Microsoft 365

MSIX

Microsoft's modern, native Windows application packaging format, the supported successor to App-V. MSIX uses built-in container isolation and integrates with Intune and App Attach.See: App-V to MSIX migration · Application Packaging & MSIX

MSP (Managed Service Provider)

A company that takes ongoing, contracted responsibility for running some or all of your IT estate for a recurring fee, rather than charging per incident. The defining test is that an MSP is responsible for keeping things in an agreed state, not only for responding when they are not. The term carries no certification of its own, so ISO 27001, Cyber Essentials and vendor partner status are the signals worth checking. Outside IT, MSP also means Member of the Scottish Parliament and, in retail, minimum selling price.See: MSP vs CSP vs MSSP · MSP vs internal IT · Managed IT Services

MSSP (Managed Security Service Provider)

A provider specialising in threat detection and response, typically running a security operations centre with analysts monitoring telemetry continuously, threat hunting and contracted incident response. Distinct from an MSP, which covers IT operations broadly including preventive security controls. Most small and mid-sized businesses are better served by an MSP delivering managed EDR/XDR than by a separate MSSP contract, until a regulatory obligation or threat profile justifies one.See: MSP vs CSP vs MSSP · Security Services

Multi-session (Windows Enterprise multi-session)

Editions of Windows 11 and Windows 10 Enterprise that let several users sign in to one virtual machine at once, like a Windows Server session host but with the desktop Windows experience. Available for Azure Virtual Desktop in Azure and on Azure Local, but not in AVD Hybrid or Windows 365.See: Azure Virtual Desktop consultancy · AVD vs Windows 365

N

NCSC (National Cyber Security Centre)

The UK's technical authority on cyber security, part of GCHQ. It owns the Cyber Essentials scheme, which IASME delivers, and publishes practical security guidance for organisations of every size.See: Cyber Essentials Certification · Security Services

O

Outsourced IT

Handing IT work to an external company rather than employing the people who do it. Managed services are a form of outsourcing, but not all outsourcing is a managed service: traditional outsourcing buys capacity that works to your direction and processes, usually billed against time or headcount, while a managed service buys an outcome and the provider brings its own tooling and process. The practical test is who decides how the work gets done.See: IT outsourcing vs managed services

Oversharing (data governance)

The gradual build-up of over-permissive sharing links, stale guest access and unlabelled sensitive files in Microsoft 365. Long a risk, and an urgent one once Copilot can surface anything a user can access.See: Copilot readiness · Microsoft 365 Security Posture Assessment

P

Parallels RAS

Parallels Remote Application Server, a platform for publishing virtual desktops and applications from on-premises hypervisors, Azure or both, licensed per concurrent user. It is commonly weighed as a Citrix replacement, particularly for on-premises and hybrid estates.See: Parallels RAS as a Citrix replacement · Citrix vs Parallels RAS vs AVD

Password Manager

Software that generates and stores unique credentials so people are not reusing one password everywhere. The security question worth asking is not whether to use one, it is where the encrypted vault lives, since a shared public vault service is a concentrated target in a way a vault inside your own tenant is not.See: Security Services

Patch Management

Getting security updates onto devices and servers within a defined window, and being able to show that it happened. Cyber Essentials requires critical and high-severity updates inside fourteen days, and the part most estates struggle with is the evidence rather than the patching.See: Endpoint Management · Cyber Essentials Certification

PAYG (Pay-as-you-go)

Paying for cloud resources by the hour or by use, with no commitment. It is the most flexible Azure pricing and the most expensive for anything that runs all the time, which is where reservations and savings plans come in. Microsoft also bills some Copilot agents this way.See: Cost Management & Azure Optimisation · Cutting Azure waste

Penetration Testing

A controlled attempt to break into your systems, carried out by people whose job is to find what an attacker would find. Distinct from a vulnerability scan, which lists known weaknesses without establishing whether they can actually be chained into anything.See: Security Services

Phishing

Fraudulent messages designed to trick people into revealing credentials or approving access. Still the number one route in for attackers, countered with email security, MFA and user awareness.See: Email Security & Archive · Security Services

Phishing-Resistant MFA

Multi-factor methods that cannot be relayed by an attacker sitting in the middle, such as passkeys, FIDO2 security keys or certificate-based authentication. Codes and push approvals are multi-factor but not phishing-resistant, which is the gap adversary-in-the-middle attacks exploit.See: Security Services

PIM (Privileged Identity Management)

A Microsoft Entra feature that grants administrative access just-in-time and for a limited time, minimising standing privileged access and reducing the impact of a compromised admin account.See: Microsoft 365 security gaps

Power Platform

Microsoft's low-code tools, Power Apps, Power Automate, Power BI and Copilot Studio, for building apps, workflows and reports on top of Microsoft 365 and Dataverse. Well suited to the workflow around a process, and worth governing like any other code once business-critical work depends on it.See: Development & Application Modernisation

Priority 1 (P1) Incident

The highest severity in a support contract, usually reserved for an outage that stops a whole organisation, site or critical system from working. Definitions vary between providers, so it is worth checking exactly what qualifies and what response a P1 is promised.See: How to choose an IT support company · Case study: P1 incidents to zero

Prompt Injection

Text hidden in content an AI system reads, written to make it ignore its instructions or reveal what it should not. It matters most where a system reads material other people can write, because the attack arrives as data rather than as a user request.See: AI Engineering

R

RAG (Retrieval-Augmented Generation)

An AI technique that grounds a language model's answers in your own documents and data, retrieved at query time, so responses are accurate, current and traceable to a source rather than invented.See: AI Engineering & Custom AI Solutions

Ransomware

Malicious software that encrypts or steals an organisation's data and demands payment to restore it or not publish it. Attackers now commonly go after backups and admin accounts first, which is why immutable backups, phishing-resistant MFA for admins and tested recovery matter more than any single product.See: Backup & Disaster Recovery · Security Services

RD Gateway (Remote Desktop Gateway)

The Remote Desktop Services role that lets users connect from outside the network over HTTPS, without exposing session hosts or opening RDP to the internet. As the internet-facing part of the estate it needs MFA, current certificates and prompt patching.See: Remote Desktop Services · RDS health checklist

RDS (Remote Desktop Services)

The Windows Server roles for delivering desktops and published applications to many users from shared session hosts: Connection Broker, Session Host, Gateway, Web Access and Licensing. Still widely run on premises, and the usual baseline that Azure Virtual Desktop and Parallels RAS are compared against.See: Remote Desktop Services · RDS health checklist

RDS CAL (Client Access Licence)

The licence each user or device needs to connect to a Windows Server session host, on top of the server licence itself. CALs are tied to a version: a 2016 CAL only covers 2016 session hosts, so moving hosts to Windows Server 2019, 2022 or 2025 needs CALs of that version or later.See: Remote Desktop Services

Reserved Instances & Savings Plans

Azure commitment-based discounts that cut the cost of predictable workloads in exchange for a one- or three-year term. A core lever in Azure cost optimisation.See: Cost Management & Azure Optimisation · Cutting Azure waste

Retention Policy

A rule that keeps content for a set period, deletes it after one, or both, across Microsoft 365 mailboxes, sites and Teams. It stops important records being deleted too early and old data being kept forever, and it underpins eDiscovery and email archiving.See: Email Security & Archive · Compliance Packs & Audit Readiness

Right-sizing

Matching cloud resources (VM sizes, storage tiers, licences) to real utilisation, cutting waste without starving workloads of the capacity they genuinely need.See: Cost Management & Azure Optimisation · Microsoft 365 cost checklist

Risk Register

A list of the risks an organisation has identified, each with an owner, a rating, the controls in place and a decision to accept, reduce or avoid it. For AI it is where you record each tool, what data it touches and who signed it off, so the answer to a client or auditor already exists when they ask.See: AI assessment & shadow AI audit · Compliance Packs & Audit Readiness

RMM (Remote Monitoring and Management)

The tooling an MSP uses to see and act on a customer estate remotely: an agent on each managed device reporting health, patch status and alerts, with the ability to deploy software and run remediation without attending site. It is the mechanism that makes proactive management possible at all, and it is provider-owned, which is one reason exit terms and documentation ownership are worth settling before signing a managed contract.See: Managed IT Services · Endpoint Management

RTO and RPO

The recovery time objective is the longest a system can be down before the business is seriously affected; the recovery point objective is how much recent data you can afford to lose, measured in time. Set them per system with the business, then prove them with restore tests rather than assuming the backup product meets them.See: Backup & Disaster Recovery · Backup and restore readiness checklist

S

Secure Score

A Microsoft measurement of an organisation's security posture across identity, data, devices and apps, with recommended actions. A number to act on, not just to report.See: Microsoft 365 Security Posture Assessment · Microsoft 365 security posture

Security Baseline

A pre-configured set of recommended security settings for a product, such as Microsoft's security baselines for Windows and Edge deployed through Intune. A baseline is a starting point to test against your applications, not a finished configuration.See: Endpoint Management · Intune device management checklist

Sensitivity Labels

Microsoft Purview tags applied to documents and emails, such as Confidential or Internal, that can encrypt content, add markings and control who can open it wherever the file travels. Copilot respects the permissions they apply, which makes labelling one of the main controls on what AI can surface.See: Copilot readiness · Microsoft 365

Service Desk

The single point of contact where users report problems and request changes, and where those requests are logged, prioritised and tracked to resolution. In a managed service, its response targets are the ones set out in the SLA.See: Managed IT Services · How to choose an IT support company

Session Host

A virtual or physical machine that runs user sessions in Remote Desktop Services, Azure Virtual Desktop or Parallels RAS. Its size, its image and the profile storage behind it decide most of what users experience as performance.See: Azure Virtual Desktop consultancy · Remote Desktop Services

Shadow AI

Staff using AI tools the business has not approved, usually because the approved route is slower or does not exist. The risk is not the tools themselves, it is company information being pasted into services nobody has assessed.See: Finding shadow AI in your business · An AI use policy people will follow

SharePoint Advanced Management (SAM)

SharePoint tooling for finding and fixing oversharing, inactive sites and broad access, including content management assessments and restricted content discovery. Microsoft includes it with the Microsoft 365 Copilot licence, and it is one of the main tools in Copilot readiness work.See: SharePoint checks before Copilot · AI & Copilot Adoption

SharePoint, Teams & OneDrive

The three core Microsoft 365 collaboration apps. Getting the file structure and permissions right early avoids years of untangling, and is foundational to security and Copilot readiness.See: SharePoint vs Teams vs OneDrive · Microsoft 365

Shelfware

Licences a business pays for but doesn't use, such as unassigned or over-specified Microsoft 365 seats. Auditing and right-sizing them is one of the fastest cost wins in IT.See: Microsoft 365 licensing shelfware · Cost Management & Azure Optimisation

SIEM (Security Information and Event Management)

A system that collects logs from across an estate and correlates them, so an attack visible only as a pattern across several systems can be spotted. Valuable in proportion to whether anyone is actually reading what it produces.See: Security Services

SLA (Service Level Agreement)

The part of a support contract that states what the provider is actually committed to: coverage hours, how quickly different severities of issue will be responded to, and what happens if those commitments are missed. Worth reading closely for the difference between a response target and a resolution target, and for what 24/7 means in practice, since it can describe a UK engineer starting work or an answering service raising a ticket for the morning.See: How to choose an IT support company

SLM (Small Language Model)

A smaller, more focused AI model that can be cheaper, faster, more private and hostable on infrastructure you control. For many specific business tasks an SLM outperforms a general-purpose API on cost and latency.See: AI Engineering & Custom AI Solutions

SoA (Statement of Applicability)

The ISO 27001 document listing which controls apply to you, which do not, and why. It comes early and shapes everything after it, so it is worth scoping properly rather than treating as paperwork to be completed later.See: Compliance Packs & Audit Readiness · ISO 27001 audit partnership

SOC (Security Operations Centre)

The team that monitors and responds to security alerts, in-house or bought as a service. The question worth asking of any provider is what happens at 3am and what they are authorised to do without waking you.See: Security Services · Out-of-hours & on-call cover

SOC 2

An attestation report under the American Institute of Certified Public Accountants framework, in which an independent auditor reports on a service organisation's controls against the Trust Services Criteria. Type 1 covers design at a point in time; Type 2 tests operation over a period. It is a report rather than a certification, and is mostly asked of suppliers selling into the US.See: Compliance Packs & Audit Readiness

SSO (Single Sign-On)

Signing in once with one identity, usually your Microsoft 365 account, and reaching other applications without separate passwords. Beyond convenience, its main security value is that disabling one account removes a leaver's access everywhere at once.See: Microsoft 365 · Security Services

Start VM on Connect

An Azure Virtual Desktop feature that powers on a deallocated session host when a user tries to connect, so machines can be switched off when idle without stranding anyone. It is a cloud AVD feature and is not available in AVD Hybrid.See: AVD cost optimisation · Azure Virtual Desktop consultancy

Supply Chain Attack

An attack that reaches you through a supplier you trust, such as a compromised software update, a provider's remote management tools or a shared integration. Asking suppliers how they control their own access, and limiting what each one can reach, is the practical defence.See: Security Services · How to choose an IT support company

Surveillance Audit (ISO)

The audit a certification body carries out in the years between full certification and recertification, usually years two and three of a three-year ISO 27001 or ISO 9001 cycle. It samples whether the management system is still being run, so evidence needs to build up through the year rather than be assembled the week before.See: ISO 27001 audit partnership · Compliance Packs & Audit Readiness

T

TCO (Total Cost of Ownership)

The full cost of running something over its life, rather than the price of buying it. In IT the gap between the two is usually licensing, the people who administer it, and the work needed when the platform underneath changes.See: Licensing & Cost Management

Thin Client

A small, low-power endpoint that does little locally and connects to a virtual desktop such as Windows 365, Azure Virtual Desktop, RDS or Parallels RAS. Existing PCs can often be converted to work the same way with a dedicated operating system, which extends their life once the desktop has moved to a server or the cloud.See: 10ZiG thin clients

Token Theft

Stealing an authenticated session token (often via an AiTM phishing kit) to access an account without needing the password or MFA. Mitigated with token protection and device-bound Conditional Access.See: Microsoft 365 security gaps

U

UK GDPR

The UK's version of the General Data Protection Regulation, kept after Brexit and read alongside the Data Protection Act 2018, and amended by the Data (Use and Access) Act 2025. It governs how organisations collect, use, store and share personal data, and the ICO enforces it.See: Compliance Packs & Audit Readiness · Automated decisions after the DUAA

Update Rings

Groups of devices that receive Windows updates on a staggered schedule, so a problematic update is found on a small pilot group before it reaches everybody. Only works if the pilot group is genuinely representative rather than whoever volunteered.See: Endpoint Management

UPS (Uninterruptible Power Supply)

A battery unit that keeps servers and network equipment running through a power cut, long enough to ride it out or shut down cleanly. The DfE servers and storage standard expects one with 30 minutes of run-time for the servers a school keeps on site.See: Networking

V

VDI (Virtual Desktop Infrastructure)

Technology that hosts desktops centrally (in a datacentre or the cloud) and delivers them to users on any device, keeping data off the endpoint. Windows 365 and Azure Virtual Desktop are Microsoft's VDI options.See: End-User Computing

VLAN (Virtual LAN)

A way of dividing one physical network into separate logical networks, so guest Wi-Fi, staff devices, cameras and servers cannot reach each other except through rules you set. One of the simplest ways to limit how far an attacker or a misbehaving device can spread.See: Networking · The DfE wireless network standard

VPN (Virtual Private Network)

An encrypted tunnel between a device or site and your network, traditionally how remote staff reached internal systems. Internet-facing VPN appliances are a frequent target, so they need prompt patching and MFA, and many organisations now give access to specific applications by identity instead.See: Managed Firewall · Security Services

W

White-Label IT Delivery

Enterprise-grade technical delivery and advisory provided under another company's brand, letting vendors and MSPs take on contracts that need skills they don't have in-house.See: White-Label Delivery & Advisory

Wi-Fi 7

The current generation of Wi-Fi, IEEE 802.11be, which adds wider channels in the 6 GHz band and lets a device use several bands at once (multi-link operation) for higher throughput and lower latency. The DfE expects it as the minimum specification when a school next replaces its wireless network.See: The DfE wireless network standard · Networking

Windows 10 End of Life

Free support for Windows 10 ended in October 2025. Devices still on it are unpatched unless covered by Extended Security Updates, making migration to Windows 11 a priority.See: Windows 10 end of life · Legacy Modernisation & OS Migration

Windows 365

Microsoft's Cloud PC service, giving each user a dedicated Windows desktop in the cloud at a fixed per-user price, reachable from any device, with IT keeping control of the data.See: Windows 365 remote access · Windows 365 consultancy

Windows App

Microsoft's client app for connecting to Windows 365 Cloud PCs and Azure Virtual Desktop, including AVD Hybrid, which replaces the older Remote Desktop clients. Users get the same sign-in and experience whichever service sits behind it.See: Windows 365 consultancy · Azure Virtual Desktop Hybrid

Windows Server 2016 End of Support

Extended support for Windows Server 2016 ends on 12 January 2027, after which it receives no security updates unless covered by Extended Security Updates. It affects file servers, domain controllers and RDS farms alike, and RDS estates also need new-version CALs when the session hosts move.See: Windows Server 2016 end of support · Legacy Modernisation & OS Migration

Windows Update for Business

The Microsoft service, managed through Intune, for controlling how and when Windows quality and feature updates are deployed to devices, using deployment rings and schedules.See: Intune management & reporting

X

XDR (Extended Detection and Response)

Security technology that correlates signals across endpoints, identity, email and cloud so an attack touching several of them is seen as one incident rather than separate, unrelated alerts.See: Security Services · Microsoft 365 security gaps

Z

Zero Trust

A security model that stops treating the corporate network as a trusted place and verifies every request on its own merits: who is asking, from what device, in what state. Sold as a product by many vendors and actually an architectural principle, delivered mostly through identity and device controls you already own.See: Security Services