Small Business Risk Terms
Not every security decision is technical. Owners and managers decide what to insure, who to call when something goes wrong, and whether the plan has ever been rehearsed. These terms cover the business side of cyber risk, from cyber insurance and incident response retainers to tabletop exercises, with real cases and government guidance written for small businesses.
Start here
- Cyber insurance: Insurance that pays some costs of a cyberattack or data breach, such as response, restoration, lost income, and claims, subject to its limits and exclusions.
- Security policy: A written set of rules for how a business protects its information, systems, and data.
- Tabletop exercise: A facilitated, discussion-based walk-through of a realistic incident scenario in which staff talk through their roles to find gaps in a plan.
- Risk register: A living list of security risks with likelihood, impact, owner, planned response, and status.
- Security awareness training: Training that teaches employees to recognize and report phishing, social engineering, and other security risks.
- Incident response retainer: A contract signed in advance that gives a business guaranteed access to an outside incident response team with agreed response times, scope, and rates.
Last updated October 14, 2026.