IT and cybersecurity terms explained in plain language.
Backup is a point-in-time copy of data and systems so you can restore files or entire servers after deletion, hardware failure, or ransomware. The 3-2-1 rule means three copies, two media types, one offsite. Cloud backup to Canadian or approved regions helps meet data residency expectations while protecting against office fires or theft. Immutable snapshots prevent attackers from encrypting your last good copy. Backups fail when nobody tests restores. Schedule quarterly restore drills for critical apps and document Recovery Time Objectives (RTO) so staff know how long operations may be down.
Disaster Recovery (DR) is the planned process to restore IT services after a major incident — datacenter loss, cyberattack, or extended outage — not just a single deleted file. A DR plan defines roles, communication trees, failover order (email first vs. ERP), and how to invoke cloud replicas or warm standby environments. Canadian businesses should align DR with insurance, legal hold, and privacy breach notification under PIPEDA. DR differs from backup: backup provides data; DR provides continuity. Test the full runbook annually; tabletop exercises reveal gaps in contact lists and vendor dependencies.
Endpoint Detection and Response (EDR) monitors laptops and servers for malicious behavior — not just known virus signatures — and can isolate a compromised device before ransomware spreads. Traditional antivirus misses fileless attacks and living-off-the-land techniques. EDR records process trees and network connections so analysts can roll back or contain threats. Microsoft Defender for Endpoint and other platforms integrate with Entra ID and SIEM. Deploy EDR on every managed endpoint, including remote Macs and PCs. Pair with MFA and patch management; EDR is most effective when the baseline hygiene is already solid.
Microsoft Entra ID (formerly Azure Active Directory) is the cloud directory for user accounts, groups, and sign-in policies used by Microsoft 365 and thousands of integrated SaaS apps. Entra ID enables conditional access (require MFA, compliant device), self-service password reset, and hybrid identity when on-premises Active Directory syncs to the cloud. It is the control plane for who may access what. Harden Entra ID by protecting Global Administrator accounts with phishing-resistant MFA, limiting standing admin roles, and reviewing sign-in logs for impossible travel or legacy authentication protocols.
Infrastructure as a Service (IaaS) delivers virtual machines, storage, and networking in a cloud provider’s datacenter — you manage the OS and applications; the vendor manages physical hardware and facilities. Canadian teams use IaaS to replace aging servers, spin up dev/test environments, or host line-of-business apps with pay-as-you-go pricing. Data residency choices (Canada Central, Canada East) matter for PIPEDA and provincial rules. IaaS still requires patching, backup, and security hardening. Many SMBs pair IaaS with an MSP for monitoring and governance rather than running VMs as "set and forget."
Quebec’s Law 25 (modernization of private-sector privacy law) imposes stricter rules on organizations that collect personal information about Quebec residents — even if the company is based elsewhere in Canada. Key IT-related themes include appointing a privacy officer, conducting privacy impact assessments for certain projects, tightening consent for sensitive uses, and reporting breaches to the Commission d’accès à l’information. Bilingual privacy notices and data minimization in apps and CRM systems are common compliance tasks. If you serve Quebec customers or employees, align backup retention, access logs, and vendor subprocessors with Law 25 alongside PIPEDA.
Multi-Factor Authentication (MFA) requires users to prove identity with two or more factors — something they know (password), something they have (phone or security key), or something they are (biometric). Passwords alone are the top entry point for ransomware and business email compromise. Enabling MFA on Microsoft 365, VPN, and admin consoles blocks most credential-stuffing attacks even when passwords leak. Roll out MFA with a phased plan: protect global admins first, then all staff. Prefer authenticator apps or passkeys over SMS where possible, and document recovery procedures so lockouts do not halt operations.
A Managed Service Provider (MSP) is an IT partner that runs day-to-day technology for your organization under a recurring agreement — monitoring, patching, backups, and support — instead of unpredictable break-fix invoices. Canadian small and mid-sized businesses typically rely on an MSP for Microsoft 365 administration, endpoint security, network health, and after-hours coverage. A strong MSP documents service levels, reports on ticket trends, and helps you plan upgrades before hardware or software reaches end of life. Compared with hiring an in-house team, an MSP spreads specialist skills (security, cloud, networking) across many clients, which often lowers total cost while improving response times and compliance readiness for PIPEDA and sector rules.
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal private-sector privacy law. It governs how organizations collect, use, and disclose personal information in commercial activity. IT decisions affect PIPEDA: where data is stored, who can access backups, how long logs are kept, and how quickly you notify the Privacy Commissioner after a breach that poses real risk of significant harm. MSPs handling personal data are often considered service providers with contractual obligations. Practical steps include data inventories, least-privilege access, encryption in transit and at rest, and written agreements with vendors that describe security safeguards and breach reporting timelines.
Platform as a Service (PaaS) provides a managed runtime for applications — web apps, containers, or databases — so developers deploy code without patching underlying Windows or Linux servers. Examples include Azure App Service, Azure SQL, and managed Kubernetes. PaaS reduces operational toil but requires secure CI/CD, secret management, and network integration with on-prem systems. Choose PaaS when your team wants faster releases and elastic scale; choose IaaS when you need full OS control or legacy software that cannot run on managed platforms.
Phishing is social engineering that tricks people into revealing passwords, approving fake payments, or installing malware — usually through urgent email, SMS, or voice calls pretending to be banks, CRA, Microsoft, or executives. Business email compromise costs Canadian organizations millions annually. Defenses combine user training, simulated phishing tests, email authentication (SPF, DKIM, DMARC), attachment sandboxing, and MFA so stolen passwords alone are useless. Report suspicious messages to your MSP or IT team; never click "verify account" links from unsolicited mail. Verify wire transfers and gift-card requests through a second channel.
Recovery Point Objective (RPO) is the maximum age of data you can afford to lose, measured in time — for example, four hours of email or 15 minutes of orders. If your RPO is one hour, backups or replication must run at least that often. Tighter RPOs cost more storage and bandwidth but reduce loss during ransomware or accidental bulk deletes. Work with finance and operations to set RPO per system: accounting may need 15 minutes; internal wiki may tolerate 24 hours. Document choices in your DR plan.
Recovery Time Objective (RTO) is the maximum acceptable downtime for a system — how quickly it must be running again after an outage starts. A four-hour RTO for email might allow manual restore from backup; a 30-minute RTO for line-of-business apps may require high availability clusters or warm standby in Azure. RTO drives staffing for nights and weekends during incidents. Publish RTOs internally so support teams prioritize correctly during a crisis. MSP contracts often map severity levels to RTO targets; verify they match your business reality.
Security Information and Event Management (SIEM) collects logs from firewalls, servers, cloud apps, and endpoints, then correlates events to detect suspicious patterns — failed logins, privilege changes, or data exfiltration. For regulated Canadian organizations, SIEM supports audit trails required by PIPEDA breach investigations and industry frameworks. Managed SIEM (SOC) services filter noise so your team sees actionable alerts instead of thousands of daily emails. SIEM success depends on log coverage: if a system does not forward events, blind spots remain. Start with identity, email, and perimeter logs, then expand as maturity grows.
A Service Level Agreement (SLA) is a contract that defines measurable IT support commitments — for example, how quickly the helpdesk acknowledges a critical outage versus a low-priority request. Typical MSP SLAs include priority tiers (P1 server down vs. P3 password reset), business-hours coverage, escalation paths, and sometimes credits if targets are missed. SLAs should be realistic for your size: a 15-minute response on total outages is common; instant fixes for every ticket are not. Review SLAs before signing: confirm what counts as "response" (auto-reply vs. human engineer), which systems are in scope, and how maintenance windows are communicated to your team.
Single Sign-On (SSO) lets users access multiple applications with one set of corporate credentials, usually backed by Microsoft Entra ID or another identity provider. SSO reduces password fatigue (and sticky notes), centralizes offboarding when someone leaves, and enables conditional access policies — such as blocking logins from unknown countries or requiring MFA for cloud apps. Implement SSO gradually: start with Microsoft 365 and your highest-risk SaaS tools. Pair SSO with automated user provisioning so new hires receive the right app access on day one.
Software as a Service (SaaS) delivers applications over the internet on a subscription — Microsoft 365, Salesforce, accounting platforms — with the vendor operating the infrastructure. SaaS shifts upgrade burden to the vendor but not security responsibility: you still control identities, sharing links, and data classification. Canadian privacy law applies to personal information stored in SaaS regardless of where the vendor hosts. Inventory SaaS apps, enforce SSO and MFA, review third-party integrations quarterly, and ensure contracts address data location and breach notification.
A Virtual LAN (VLAN) segments one physical network into isolated logical networks on managed switches — for example, separating guest Wi‑Fi from accounting servers. Segmentation limits lateral movement if malware infects a laptop: an attacker on the guest VLAN should not reach point-of-sale or backup systems. VLANs are paired with firewall rules that control which segments may talk to each other. Plan VLANs around roles (corporate, VoIP, IoT/cameras, management) and document IP schemes. For multi-site Canadian businesses, consistent VLAN design simplifies troubleshooting and MSP remote support.
A Virtual Private Network (VPN) creates an encrypted tunnel between a remote device and your office network or cloud resources, so traffic is protected on public Wi‑Fi and home internet. Site-to-site VPNs link branch offices; client VPNs let laptops reach file shares and internal apps. Modern alternatives include always-on VPN with Entra ID MFA or Zero Trust network access that checks device health per session. For Canadian teams, document who may use VPN, enforce MFA on VPN accounts, and split tunneling policies so video calls do not slow through the datacenter unless required by compliance.
Zero Trust is a security model that assumes no user or device is trustworthy by default — every access request is verified based on identity, device health, location, and least privilege, regardless of whether the user is "inside" the office network. It replaces the old perimeter-only mindset (castle-and-moat VPN) with continuous validation. Microsoft’s implementation combines Entra ID conditional access, Intune compliance, segmented networks, and logging to SIEM. Adopting Zero Trust is a journey: start with MFA everywhere, retire legacy VPN-only access to SaaS, micro-segment critical servers, and monitor sign-ins for anomalies.
