Cyber insurance glossary: the words on your form, in plain English

Multi-factor authentication. Signing in takes a second step after your password, such as a code from an app or a tap to approve on your phone, so a stolen password isn't enough on its own. The Canadian Centre for Cyber Security has a short guide to how MFA works. See what insurers mean by MFA on email.

Another name for MFA: a password plus one more thing, usually a code or a phone prompt. Some forms use this name in their list of security controls. See what insurers mean by MFA on email.

Google's name for MFA in Google Workspace and Gmail. If your form asks about MFA and your email runs on Google, this is the setting it means. Here's how to turn on MFA in Google Workspace.

A Microsoft 365 setting that asks everyone in your account to set up two-step sign-in with the Microsoft Authenticator app. With it on, every admin has to use two-step sign-in each time they sign in. The steps are in how to turn on MFA in Microsoft 365.

An account that can change settings for other people or for the whole system, like your email admin login. Many forms ask whether these accounts need MFA. See what insurers mean by MFA on admin accounts and remote access.

Any way of reaching your office computers or network from somewhere else: a VPN, Remote Desktop, or a remote-control tool like TeamViewer or AnyDesk. See what insurers mean by MFA on admin accounts and remote access.

Virtual private network. A private, scrambled connection from a laptop or phone back to the office network, over the internet. See what insurers mean by MFA on admin accounts and remote access.

Remote Desktop Protocol, the Windows feature that lets someone control a computer from somewhere else. If nobody at the business uses it, it's worth checking that it's switched off. See what insurers mean by MFA on admin accounts and remote access.

A copy of your files kept where an attack on your computers can't reach it, such as a drive you unplug after each backup and store away from the computer. See what insurers mean by offline backups.

A backup that can't be changed or deleted for a set period once it's saved, not even by an admin. Backup services sell it under names like immutability, object lock or retention lock. See does your backup count as offline or immutable?

Pulling files back out of a backup and checking that they open. Many forms ask whether you do it and how often, which is the question how often to test your backups answers.

An individual computer or device on your network, such as a laptop or desktop. See what insurers mean by endpoint protection and EDR.

Software on each computer that finds and stops malware, the job most people know as antivirus. Some forms ask specifically about a paid-for product, so a free built-in tool may not match the wording. See what insurers mean by endpoint protection and EDR.

A name some forms use for endpoint protection: software on each computer that looks for both known malware and suspicious behaviour, and stops it. See what insurers mean by endpoint protection and EDR.

Endpoint detection and response. It goes a step past antivirus: it records what happens on each computer and sends it to one place where someone can look into it. Some forms ask about EDR by name, which product you use and how many of your computers have it. See what insurers mean by endpoint protection and EDR.

An update that fixes a security hole in an operating system or an app. Some forms ask whether critical patches go on within a month. See what insurers mean by software updates.

Software its maker has stopped fixing, so new security holes stay open. Windows 10 stopped getting regular security updates in October 2025, so it now counts. More in what Windows 10 end of support means for your form.

Scanning mail before it reaches anyone's inbox, to catch spam, harmful links and infected attachments. Some forms ask for the name of the product that does it. See what insurers mean by email security.

A record on your email domain that lists the services allowed to send email as you. It's one of the two settings DMARC relies on. Set it up with DMARC for Google Workspace or DMARC for Microsoft 365.

A digital signature your email service adds to each message, so the receiving server can tell it really came from your domain and wasn't changed on the way. DMARC relies on it. See DMARC for Google Workspace or DMARC for Microsoft 365.

A record you add to your email domain's settings that helps stop other people sending email that looks like it came from you. Many forms list it as a tick-box. See what insurers mean by email security, or set it up for Google Workspace or Microsoft 365.

An email, text or call that pretends to come from someone you trust, so you'll click a link, open a file, type a password or send money. A simulated phishing test sends staff a harmless fake one to see who clicks, and some forms ask whether you run one at least once a year. See what insurers mean by security training.

Tricking a person, instead of a computer, into handing over access, information or money. Some forms ask whether everyone who sends money for the business gets training on these scams. See what insurers mean by payment verification.

A scam where someone takes over a business email account, or pretends to be one, then uses it to ask for a payment or to change the bank details on an invoice. Phoning a number you already have before any money moves is what the payment questions on these forms are getting at. See what insurers mean by payment verification.

Two people on one payment: one sets it up and a different person approves it. Some forms ask about it for larger transfers. See what insurers mean by payment verification.

Scrambling data so only someone with the key can read it. On a laptop or phone, the key is your password or passcode, and the drive stays scrambled while the device is locked. Windows calls it BitLocker or Device encryption, and on a Mac it's FileVault. See what insurers mean by encryption.

A written plan for a bad day: who to call, how to stop the damage, where the backups are. For a small business it can fit on one page. See what insurers mean by an incident response plan.

A plan for keeping the business running, or getting it back up, after an outage of any kind. Some forms ask about this instead of an incident response plan, and how often you test it. See what insurers mean by an incident response plan.

Managed service provider: the outside company that looks after your IT. Many forms ask for its name. See what insurers mean by outside companies' access.

A company whose software you use online instead of installing it, like a booking, charting or accounting system. Some forms count these as outside technology providers you should list. See what insurers mean by outside companies' access.

Information about a person's health or the care they receive, such as intake forms, session notes, charts and treatment records. Many forms ask whether you collect it and roughly how many people's records you hold. See what cyber insurers ask therapists and counsellors.

A score Microsoft gives the security settings in a Microsoft 365 account. Some forms ask Microsoft 365 users to report it, and admins can find it at security.microsoft.com/securescore. See what insurers mean by email security.

A term some forms use for the senior people allowed to sign the application: owners, partners, officers, directors and people in similar roles. See who should fill out and sign the application.

Asking the people who would know before you answer. When you sign, you're usually confirming that you checked with your partners, staff or IT provider, not just answered from memory. See what to do when you don't know an answer.

An insurer treating a policy as if it never existed, for example because something on the application wasn't true. Some applications say this directly in the section you sign. See what happens if you answer the application wrong.