The managed IT glossary

A company that runs and supports your IT for a flat recurring fee, monitoring, securing, patching, and fixing your systems proactively instead of waiting for them to break.

Outsourced day-to-day IT, help desk, monitoring, security, patching, and strategy, delivered for a predictable monthly fee rather than hourly.

A partnership where an MSP works alongside your in-house IT staff, adding security tooling, emergency coverage, and project capacity without replacing anyone.

The software an MSP uses to watch your devices and servers around the clock, push updates, and catch problems before users notice them.

The support team users contact for IT issues. A good help desk resolves most problems remotely in minutes and escalates to on-site help when needed.

A written promise of how fast a provider will respond and resolve issues. It defines response times by priority so support is measurable, not vague.

The disciplined process of testing and applying software and security updates across every device, closing the known vulnerabilities attackers rely on.

An outsourced IT strategist who aligns your technology with business goals, plans budgets and roadmaps, and gives you executive-level IT guidance without a full-time hire.

The old reactive model of paying for IT only when something breaks. It is unpredictable and leaves systems unmonitored between failures, unlike managed services.

Any device that connects to your network, laptops, desktops, phones, servers, each one a place that has to be secured and managed.

A security model that trusts nothing by default and verifies every user, device, and request, instead of assuming anything inside the network is safe.

Software that continuously watches each device for malicious behavior, then isolates and remediates threats automatically, going far beyond traditional antivirus.

A service that pairs detection software with a human security team monitoring around the clock, so threats are investigated and stopped, not just flagged.

A team and toolset that monitors an organization for security threats 24/7, investigating alerts and responding to incidents in real time.

A login requiring two or more proofs of identity, such as a password plus a phone prompt. It blocks the vast majority of account-takeover attacks.

Fraudulent emails or messages designed to trick people into revealing credentials, sending money, or installing malware. It is the most common way breaches start.

Malware that encrypts your files and demands payment to unlock them. Tested backups and layered security are the difference between a scare and a shutdown.

A security approach that blocks every program by default and only permits approved software to run, stopping ransomware and unknown threats before they execute.

Filtering and controls that stop phishing, spoofing, and malicious attachments before they reach the inbox, where most attacks begin.

Ongoing education and simulated phishing that teach staff to recognize and report attacks, turning your people from the weakest link into a line of defense.

An authorized simulated attack on your systems by security professionals to find and fix weaknesses before a real attacker exploits them.

A device or software that controls traffic in and out of your network based on security rules, the first gate between your systems and the internet.

The federal law governing how healthcare organizations protect patient health information, requiring access controls, encryption, logging, and tested backups.

The security standard for any business that accepts card payments, requiring network segmentation and controls that keep cardholder data safe.

The FBI security policy governing systems that touch criminal-justice data, requiring strong authentication, encryption, and audit controls. Critical for housing authorities.

The Center for Internet Security's prioritized set of 18 security controls (v8) that give any organization a practical baseline for reducing cyber risk.

Any health data that can identify a patient. Under HIPAA it must be encrypted, access-controlled, logged, and recoverable.

A structured review of where your data and systems are exposed, ranking risks so you fix the most dangerous gaps first. It is the starting point of most compliance frameworks.

A tamper-resistant record of who accessed what and when. Auditors and frameworks require it to prove controls are actually working.

The policies and controls that define how data is classified, accessed, retained, and protected across an organization.

The plan and technology that keep a business running, and get it back online fast, after an outage, attack, or disaster.

A separate, recoverable copy of your data. Backups are only real if they are tested, off-site, and protected from being encrypted or deleted by an attacker.

The maximum time your business can tolerate being down before recovery must be complete. It drives how your backup and continuity plan is designed.

The maximum amount of data, measured in time, you can afford to lose. An RPO of one hour means backups must run at least hourly.

A backup that cannot be altered or deleted for a set period, even by an administrator or attacker, so ransomware cannot destroy your last clean copy.

Moving applications, data, and infrastructure from on-premise servers to cloud platforms for flexibility, resilience, and remote access.

Microsoft's cloud suite, Outlook, Teams, SharePoint, and Office, that most small businesses run on. Securing and managing it well is core to modern IT.

Microsoft's cloud platform for hosting servers, applications, and infrastructure, an alternative to maintaining hardware on-site.

A full desktop hosted in the cloud and streamed to any device, so staff work securely from anywhere without data living on the endpoint.

The three cloud service models: Software as a Service (ready-to-use apps), Platform as a Service (a place to build apps), and Infrastructure as a Service (rented servers and storage).

How prepared a business is to adopt AI safely, the right data, security, governance, and processes in place before turning AI loose on the work.

Structuring content so AI answer engines like ChatGPT and Perplexity can quote it directly, with answer-first writing, clear questions, and schema.

Optimizing a site to be read, understood, and cited by generative AI search, the new front of search beyond traditional Google rankings.

Using software to handle repetitive, rules-based tasks, approvals, data entry, notifications, so staff spend time on work that needs a human.

AI that can take multi-step actions toward a goal with minimal oversight, working inside guardrails its operators set, rather than just answering a single prompt.