The vocabulary, without the mystique.

How long until you are operating again after a failure. If a supplier quotes an RTO without saying when it was last measured, it is an aspiration rather than a commitment.

How much work you could lose, expressed as time. A 24-hour RPO means a failure at 4pm could cost you everything since the previous night's backup.

Write once, read many. Data that cannot be altered or deleted until a retention period expires — not by an administrator, not by the provider, not by ransomware. This single property is what separates a backup that survives an attack from one that does not.

A copy with no network path from production, so an attacker who owns your entire environment still cannot reach it. Slower to recover from, and occasionally the only thing left.

Three copies of data, on two media types, one held offsite, one immutable or air-gapped, and zero errors on a verified restore test. The last digit is the one most organisations skip.

Security information and event management. Collecting logs from every system into one place and joining them, so events that look harmless individually can be recognised as an attack collectively.

Endpoint, or extended, detection and response. Software that watches behaviour on a device rather than matching known-bad signatures — which is why it can stop an attack it has never seen before.

User and entity behaviour analytics. Learning what normal looks like for each account, so abnormal becomes visible without anyone writing a rule for it in advance.

A public catalogue of the techniques attackers actually use. Mapping detection coverage to it is how you find out which stages of an attack you would currently miss.

Designing on the assumption that being inside the network proves nothing. Every request is authenticated and authorised on its own merits.

An attacker with access to a mailbox, or a convincing imitation of one, redirecting a legitimate payment. Rarely technically sophisticated, frequently the most expensive incident a mid-sized firm suffers.

India's Digital Personal Data Protection Act. Governs how personal data is collected, retained and handled, with obligations around consent, purpose limitation, data principal rights and breach notification.

Where your data physically sits. A regulatory question more often than a technical one, and easier to answer with evidence than with assurance.

Determining how a system works without its source code or documentation — by observing behaviour, inspecting binaries and mapping data structures. Used both to secure software and to rescue businesses from software nobody can maintain.

The documented record of who handled evidence, when, and what they did with it. Without it, forensic findings may be technically correct and still fail to be useful in a dispute.

How far an incident reached — which systems, which accounts, which data. Establishing it accurately is usually harder, and more important, than identifying the initial entry point.

The routing protocol that decides how traffic finds its way between networks on the internet. Redundant BGP paths and documented AS-path policy are what make an upstream failure a predictable failover rather than an outage.

Broadband Network Gateway (or Broadband Remote Access Server) — the edge device that authenticates and terminates subscriber sessions on an ISP network, sitting between access infrastructure and the core.

Carrier-Grade NAT. Lets an ISP share a smaller pool of public IPv4 addresses across many subscribers, at the cost of some complexity in abuse tracing and certain application compatibility.

Checking a device's identity and posture before granting it network access, and placing it in the right segment automatically rather than trusting anything that plugs in.

The IEEE standard most NAC and enterprise Wi-Fi deployments use for port-based authentication — a device or user must authenticate before the port opens onto the real network.

Security Orchestration, Automation and Response. Scripting the repetitive, well-understood parts of an incident response (isolate a host, disable an account) so a human's time goes to judgment calls, not clicking through the same steps every time.

Controls that detect or block sensitive data leaving where it's supposed to stay — a file upload, an email attachment, a USB copy — based on content or classification rather than just who's asking.

A traffic metadata standard (who talked to whom, how much, over what) used for capacity planning and abuse-pattern detection without needing to inspect full packet contents.

Simple Network Management Protocol — the long-standing standard most network monitoring uses to poll device health (CPU, memory, interface counters) from switches, routers and firewalls.

A virtual LAN — logically separating traffic on shared physical network hardware, so staff, guest and lab traffic can share a switch without sharing a broadcast domain.

A tunnelling technology that extends Layer 2 segments across a Layer 3 network — relevant mainly in larger data centre or multi-site designs where VLAN's 4,096-segment limit or physical topology becomes a real constraint.

Software-defined WAN — managing multiple wide-area links (MPLS, broadband, LTE) as a single logical connection with policy-based routing, instead of manually engineering failover between them.

Designing a system so a single component failure doesn't become an outage — redundant pairs, clustering, or automatic failover, sized to how much the downtime would actually cost.

The plan and infrastructure for restoring operations after a major failure — distinct from backup, which is the raw material DR depends on but isn't the plan itself.

The function (a room, a team, or a shared service) responsible for watching security telemetry and responding to incidents. We describe what we actually staff and monitor rather than implying a trading-floor-style operations center that doesn't exist.

The equivalent function for network and infrastructure health rather than security — watching uptime, capacity and performance telemetry and responding to degradation before it becomes an outage.