The vocabulary, without the mystique.

How long until you are operating again after a failure. If a supplier quotes an RTO without saying when it was last measured, it is an aspiration rather than a commitment.

How much work you could lose, expressed as time. A 24-hour RPO means a failure at 4pm could cost you everything since the previous night's backup.

Write once, read many. Data that cannot be altered or deleted until a retention period expires — not by an administrator, not by the provider, not by ransomware. This single property is what separates a backup that survives an attack from one that does not.

A copy with no network path from production, so an attacker who owns your entire environment still cannot reach it. Slower to recover from, and occasionally the only thing left.

Three copies of data, on two media types, one held offsite, one immutable or air-gapped, and zero errors on a verified restore test. The last digit is the one most organisations skip.

Security information and event management. Collecting logs from every system into one place and joining them, so events that look harmless individually can be recognised as an attack collectively.

Endpoint, or extended, detection and response. Software that watches behaviour on a device rather than matching known-bad signatures — which is why it can stop an attack it has never seen before.

User and entity behaviour analytics. Learning what normal looks like for each account, so abnormal becomes visible without anyone writing a rule for it in advance.

A public catalogue of the techniques attackers actually use. Mapping detection coverage to it is how you find out which stages of an attack you would currently miss.

Designing on the assumption that being inside the network proves nothing. Every request is authenticated and authorised on its own merits.

An attacker with access to a mailbox, or a convincing imitation of one, redirecting a legitimate payment. Rarely technically sophisticated, frequently the most expensive incident a mid-sized firm suffers.

India's Digital Personal Data Protection Act. Governs how personal data is collected, retained and handled, with obligations around consent, purpose limitation, data principal rights and breach notification.

Where your data physically sits. A regulatory question more often than a technical one, and easier to answer with evidence than with assurance.

Determining how a system works without its source code or documentation — by observing behaviour, inspecting binaries and mapping data structures. Used both to secure software and to rescue businesses from software nobody can maintain.

The documented record of who handled evidence, when, and what they did with it. Without it, forensic findings may be technically correct and still fail to be useful in a dispute.

How far an incident reached — which systems, which accounts, which data. Establishing it accurately is usually harder, and more important, than identifying the initial entry point.