IT jargon for nursery owners: the plain-English buster

Access control. A system that decides who is allowed through a door, and proves who went where. Proper access control gives each person their own fob, card or phone credential instead of a single shared code everyone knows, so you can remove one person’s access without disrupting everyone else. Covered in full in the Access Control guide.

Apple Business Manager (ABM). Apple’s free service that lets a business, rather than an individual, own its iPads and iPhones. It is the foundation for managing nursery devices properly, because it means the devices belong to the nursery in Apple’s eyes rather than to whoever first signed in.

Backup. A separate, recoverable copy of your data kept somewhere safe, so that if the original is lost, corrupted or held to ransom, you can restore it. The question that matters is not “do we have backups?” but “have we ever tested that we can actually restore from them?”

Breach. Any incident where data is accessed, taken or exposed without authorisation. For a nursery, a breach involving children’s or parents’ personal data can trigger legal reporting duties and an Ofsted or CIW conversation, which is why prevention matters so much.

Cloud. Someone else’s computers, accessed over the internet, doing a job you would once have needed your own server for. Microsoft 365 is “in the cloud”, meaning your email and files live in Microsoft’s data centres rather than on a machine in your office. Usually more reliable and better backed-up than anything a nursery could run itself.

Conditional Access. A Microsoft 365 feature that applies rules to logins, for example requiring a second factor, or blocking sign-ins from countries you never operate in. A more advanced version of the protection that two-factor authentication provides.

Credential. Anything used to prove who you are or gain access: a password, a door code, a fob, a passkey. The recurring theme of this whole toolkit is that credentials should belong to individuals and be removable, not shared secrets that leak with every leaver.

DEP / Automated Device Enrolment. The Apple feature that lets a new iPad arrive already knowing it belongs to your nursery, so it configures itself the moment it is switched on. The old name was DEP; the current one is Automated Device Enrolment. Covered in the iPad management guide.

Encryption. Scrambling data so that it is unreadable to anyone without the key. If a laptop or iPad is encrypted and it gets lost, the finder sees gibberish rather than children’s records. Modern phones and tablets are encrypted by default; older laptops often are not.

Endpoint. Jargon for any device that connects to your systems: a computer, a laptop, an iPad, a phone. When a supplier talks about “endpoint protection”, they mean the security software running on those devices.

Firewall. A barrier between your network and the internet that decides what traffic is allowed in and out. Think of it as the locked front door of your network. Most nurseries have one built into their internet router without realising it.

GDPR. The data protection law that governs how you handle personal information. For a nursery this is not abstract: children’s names, photos, addresses and medical details are exactly the kind of sensitive data GDPR is most concerned with, and mishandling it carries real consequences.

Hexnode. A mobile device management platform, the kind of system used to control and protect a nursery’s iPads centrally. It is the platform Octopus 365 uses, though the principle applies to any reputable MDM.

Keeper. A password manager: a secure vault that remembers and fills in a unique password for every account, so nobody has to. It also stores passkeys and lets you share credentials through vaults rather than by telling people the password, which is why it solves the shared-password and leaver problems.

Least privilege. The principle that everyone should have access to exactly what their job needs and nothing more. It limits the damage if any one account is compromised, because that account cannot reach things it never needed in the first place.

MDM (Mobile Device Management). The system that lets you control your nursery’s iPads and phones centrally: pushing out apps and settings, enforcing a passcode, and remotely locking or wiping a device that goes missing. The difference between a lost iPad being a breach and being an inconvenience.

MFA (Multi-Factor Authentication). The same thing as 2FA, two-factor authentication: a second proof of identity, usually a tap or code on your phone, on top of your password. The single highest-value security change most nurseries can make.

Microsoft 365. Microsoft’s bundle of email, file storage, Teams, and the Office apps, delivered through the cloud. For most nurseries it is the central system that everything else hangs off, which is exactly why protecting the login to it matters so much.

Passkey. A modern replacement for the password, stored securely on your device and unlocked by your face, fingerprint or PIN. It cannot be guessed, reused or phished, which is why it is where the whole industry is heading. Covered in full in the Passkeys guide.

Password manager. A secure app that generates, stores and fills in a unique strong password for every account, so you only have to remember one master passphrase. The only realistic way to have genuinely different passwords everywhere. Keeper is the one we recommend.

Patch. A small update that fixes a flaw or security hole in software. “Patching” means keeping everything up to date so known holes are closed. Unpatched software is one of the most common ways attackers get in, and it is the sort of thing a good IT supplier handles for you quietly.

Phishing. A message designed to trick a human into clicking, typing a password, or handing over money or data, usually by pretending to be someone trustworthy. It is the single most common way nurseries get attacked, and the Spotting Phishing guide pulls real examples apart.

Phishing-proof. A property of passkeys: because there is no password to type, there is nothing a fake site can trick a member of staff into handing over. Even clicking a convincing fake login link does not work, because the passkey is tied to the genuine site’s address.

Ransomware. Malicious software that locks up your files and demands payment to release them. For a nursery it can mean losing access to registers, records and photos overnight. Good, tested backups are the main defence, because they let you restore rather than pay.

Social engineering. Manipulating a person rather than hacking a machine: the fake supplier call, the urgent message that looks like it is from the boss. It works by exploiting helpfulness and urgency, and the defence is a habit of confirming money and data requests through a separate, trusted channel.

SSO (Single Sign-On). Signing in once to unlock several systems, rather than logging into each separately. Done well it is more secure, not less, because there are fewer passwords floating about. Microsoft 365 can act as a single sign-on into tools like Keeper, so one protected login opens everything.

Tenant. Your organisation’s own private space within Microsoft 365. When a supplier talks about “your tenant”, they mean your nursery’s instance of Microsoft 365, with its own users, settings and data, separate from every other organisation’s.

Two-factor authentication (2FA). A second proof of identity on top of your password, almost always a tap or code on your phone. It blocks the large majority of account attacks and is the first thing every nursery should turn on. Covered step by step in the 2FA guide.

VPN (Virtual Private Network). A secure, encrypted tunnel for your internet connection, often used so staff can reach nursery systems safely from elsewhere. Useful in the right context, though for most small nurseries running on Microsoft 365 it is less essential than it used to be.

Zero-day. A brand-new security flaw that attackers know about before the software maker has had a chance to fix it, so there is no patch yet. They are rare and largely out of your hands; the practical defence is the same as ever, keep everything updated so the moment a fix exists, you have it.