Security words, explained once
The words you'll meet in questionnaires, audits and laws, each explained in two or three plain sentences. French acronyms included, for teams working with French customers.
Each term has its own link: copy it from the term’s name to share one definition. Missing a word? Tell us with the “Report an error” link at the bottom of the page.
#
- 17Cyber
- France's national help service for victims of cyberattacks, run with the police, the gendarmerie and Cybermalveillance.gouv.fr. An online diagnosis, then referral to help.
A
- ANSSIAgence nationale de la sécurité des systèmes d'information
- France's national cybersecurity agency. It publishes security guides, runs CERT-FR and the French NIS2 portal.
B
- Backup
- A copy of your data you can restore. It only counts once a restore has been tested, and when the copy is kept out of reach of an attacker who gets into your systems.
- BCP / DRPbusiness continuity plan / disaster recovery plan
- How the company keeps working during a major disruption (BCP), and how its IT is restored afterwards (DRP). In French: PCA and PRA.
C
- CISOchief information security officer
- The person who owns the security program: risks, policies, priorities, reporting to management. In French: RSSI. Many small companies have none; a part-time vCISO or QoBot can fill the role.
- CNILCommission nationale de l'informatique et des libertés
- France's data protection authority. A personal data breach that may put people at risk is notified to it within 72 hours.
- CSIRT / CERTcomputer security incident response team
- A team that handles security incidents. Under NIS2, in-scope organisations report significant incidents to their national CSIRT or competent authority. France's is CERT-FR.
D
- DKIMDomainKeys Identified Mail
- A signature added to your outgoing emails, so receivers can check they come from your domain and weren't altered.
- DMARCDomain-based Message Authentication, Reporting and Conformance
- A DNS record that tells receiving mail servers what to do with emails that claim to come from your domain but fail the SPF and DKIM checks: deliver, quarantine or reject. It protects your domain against spoofing.
- DORADigital Operational Resilience Act
- Regulation (EU) 2022/2554 on digital resilience for banks, insurers, investment firms and other financial entities. It applies since 17 January 2025.
E
- EDRendpoint detection and response
- Security software on computers and servers that detects suspicious behaviour, can block it, and records what happened. Cyber insurers often ask whether you have it.
- Essential entity
- Under NIS2, the class with the closest supervision: typically large organisations in Annex I sectors, plus some providers whatever their size. See NIS2 in plain words.
G
- GDPRGeneral Data Protection Regulation
- Regulation (EU) 2016/679 on personal data. Its security side: measures appropriate to the risk (article 32), breach notification to the authority within 72 hours (article 33), and a register of every breach. In French: RGPD.
I
- Important entity
- Under NIS2, an in-scope organisation that isn't essential, for example a medium-sized one. Same security duties as essential entities, with supervision after the fact.
- Incident
- An event that compromises the availability, integrity or confidentiality of your data or systems. Under NIS2, a significant incident is one that causes, or could cause, severe disruption, financial loss or considerable damage to others.
- ISMSinformation security management system
- Running security as a cycle: decide, do, check, improve, with records along the way. ISO 27001 sets the requirements for it.
- ISO 27001
- The international standard for an information security management system, certified by accredited bodies. See ISO 27001 in plain words.
- IT charter
- The rules everyone using the company's IT agrees to: accounts, devices, email, personal use, reporting incidents. In French: charte informatique. See the free template.
L
- Least privilege
- Each person and system gets only the access the job needs. Administrator rights stay with the few people who need them, on separate accounts.
M
- Management body
- Under NIS2, the people who run the organisation. They approve the security measures, oversee them, follow training, and can be held liable.
- MDMmobile device management
- A tool to set up, update, lock and wipe company laptops and phones remotely.
- MFAmulti-factor authentication
- Logging in with something you know, like a password, and something you have, like a phone or a security key. A stolen password alone is then no longer enough.
- MSPmanaged service provider
- The company that runs your IT. Under NIS2, managed service providers are themselves an Annex I sector.
N
- NIS2
- Directive (EU) 2022/2555 on cybersecurity for medium and large organisations in 18 sectors, applied through each country's law. See NIS2 in plain words.
P
- Patch
- A software update that fixes a flaw. Applying security patches quickly closes known holes before attackers use them.
- PCA / PRAplan de continuité / plan de reprise d'activité
- French for business continuity plan and disaster recovery plan. See BCP / DRP.
- Phishing
- A fake message, usually an email, that tries to make you click, type a password or pay. Calling back on a known number before any change of bank details stops a common fraud.
- PSSIpolitique de sécurité des systèmes d'information
- French for the information security policy: the top-level document, approved by management, that sets the security rules and who owns them.
R
- Ransomware
- Malware that encrypts your files or systems and demands payment. Tested backups kept out of the attacker's reach are how you recover without depending on the attacker.
- Risk assessment
- Listing what could go wrong, how likely it is and what it would cost, to decide what to fix first and what to accept.
- RSSIresponsable de la sécurité des systèmes d'information
- French for CISO. QoBot's French name for its role is « RSSI virtuel ».
S
- SPFSender Policy Framework
- A DNS record listing the servers allowed to send email for your domain.
- Statement of ApplicabilitySoA
- The ISO 27001 document that lists every Annex A control, says whether it applies to you, and why.
V
- vCISOvirtual CISO
- A CISO shared with other companies, part-time, usually from a consulting firm. See QoBot vs a part-time vCISO.
Sources
- Directive (EU) 2022/2555 (NIS2)EUR-Lex · entity classes, management body, significant incidentsOfficial text
- Regulation (EU) 2016/679 (GDPR)EUR-Lex · articles 32 to 34Official text
- Official text
- RFC 7489: DMARCIETF · with RFC 7208 (SPF) and RFC 6376 (DKIM)Official text
- Official text
Written from QoBot's CISO knowledge, with the sources above. · Last updated 19 October 2026
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error