Resources
Resilience glossary
The terms you meet in continuity, disaster recovery, cybersecurity and AI, explained simply.
3
- 3-2-1 rule
- Keep three copies of data, on two types of media, one of them off-site. It is often completed with an immutable or isolated copy.
A
- AI agent
- An AI system that pursues a goal by chaining actions (calling tools, writing, deploying) with little or no human approval at each step.
- AI governance
- The policies, roles, inventories and controls that frame how AI is built and used in the organization.
B
- BCP / business continuity
- The measures and plans that keep essential activities running during and after a disruption.
- BIA (Business Impact Analysis)
- A process that identifies essential activities, their dependencies and the impact of disruption over time, to set recovery priorities.
- Blast radius
- The extent of damage a failure can cause before it is stopped: number of cases touched, severity, reversibility and time to detection.
C
- Concentration risk
- Excessive dependence on a single supplier, region or technology.
D
- DORA
- EU regulation on digital operational resilience for the financial sector, applicable since January 2025.
- Double extortion
- A tactic where the attacker encrypts data and also threatens to publish it if the ransom is not paid.
- DRP / disaster recovery
- The technical side that restores IT systems and data after an outage or disaster.
E
- Execution traces
- A detailed record of what an agent did: requests received, tools called, data accessed and actions taken.
F
- Failover
- Switching the service to a standby site or system when the primary one fails.
- Failure injection
- An exercise that deliberately causes a failure, in a test or simulated environment, to check that controls and detection work.
H
- Hallucination
- An AI model output that sounds plausible but is false or made up.
I
- Immutable backup
- A copy that cannot be altered or deleted for a defined period, even by an administrator, which protects it from ransomware.
- Impact tolerance
- The maximum level of disruption to an important service the organization is willing to accept, central to UK operational resilience rules.
- Important business service
- A service whose disruption would cause intolerable harm to customers or to market integrity.
K
- Kill switch
- A tested way to stop an agent or automated system quickly, without depending on it to stop itself.
L
- Least privilege
- Granting each person or system only the access needed for its task.
M
- Microsoft Foundry Citadel
- A reference architecture published by Microsoft for governing an enterprise AI platform: see our dedicated page.
- MTPD (Maximum Tolerable Period of Disruption)
- The duration beyond which an activity's interruption threatens the organization's viability. The RTO must be lower.
- Multi-factor authentication (MFA)
- Verifying identity with at least two different kinds of proof, such as a password plus a hardware key or code.
N
- NIS2
- EU directive raising cybersecurity requirements for essential and important entities.
O
- Operational resilience
- The ability to deliver important services despite disruption, and to recover within the tolerances set.
P
- Passkey
- A passwordless sign-in method based on public-key cryptography that resists phishing.
- Post-market monitoring
- A duty under the EU AI Act to monitor how a high-risk AI system performs once in service. Like the other high-risk obligations, it is now due from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).
- Prompt injection
- An attack that slips instructions into content read by an AI to hijack its behavior.
R
- Ransomware
- Malware that encrypts data or blocks access to systems to demand a ransom, often combined with data theft.
- Recovery site
- A backup location (hot, warm or cold depending on readiness) where systems are restarted after a disaster.
- Recovery test
- A real trial of restoring systems and data to measure the RTO and RPO achieved.
- RPO (Recovery Point Objective)
- The maximum age of data you accept to lose, measured in time: a 15-minute RPO means you can lose at most the last 15 minutes.
- RTO (Recovery Time Objective)
- The target maximum time between the start of an interruption and the service returning to an acceptable level.
S
- Scope drift
- The growing gap between what an agent was authorized to do and what it actually does in production.
- Shadow AI
- Staff use of AI tools without the organization's approval or knowledge.
- Software supply chain
- All the components, libraries and vendors a piece of software depends on; one compromised link can affect all its users.
T
- Tabletop exercise
- A discussion-based simulation where the team walks through an incident scenario and talks through its decisions without touching systems.
- Third-party risk
- The risk that an outage, flaw or failure at a supplier disrupts your own services.
Z
- Zero Trust
- A principle where no user or device is trusted by default: every access is verified, with rights limited to the minimum.