The terms you meet on this site
Short, quotable definitions of the terms from NIS2, visibility in AI assistants and CRM automation. Two or three sentences each, no jargon stacked on jargon.
- NIS2
- Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It sets security and reporting duties for essential and important entities in eighteen sectors and requires them to manage the security of their supply chain, which is why their suppliers receive questionnaires.
- Cyberbeveiligingswet
- The Dutch law that implements NIS2 in the Netherlands, in force since 15 August 2026. It names the regulators per sector and gives the duty of care, the incident reporting duty and the fines a legal basis in Dutch law.
- Supplier readiness
- The state in which a supplier can answer a regulated customer's security questionnaire with evidence rather than promises: a dated policy, test results, configuration screenshots and a named incident contact. It is not a certification.
- Security questionnaire
- A list of questions a regulated organisation sends to its suppliers to meet its own supply-chain duty under Article 21(2)(d) of NIS2. Most ask for the same evidence: ownership, access control, backups, patching, incident handling, email authentication and sub-processors.
- Evidence dossier
- A folder of documents and screenshots that proves each control a questionnaire asks about, kept current and ready to send. One dossier answers every customer, so the questionnaire stops being a project each time.
- Attack surface
- Everything about an organisation that is reachable from the internet: domains, mail servers, exposed services, cloud consoles, leaked credentials. An external attack-surface check looks at it the way an attacker would, without logging in.
- SPF, DKIM and DMARC
- Three DNS records that let receiving mail servers verify that a message really came from your domain. Without them, anyone can send mail in your name, and many questionnaires check all three.
- Multi-factor authentication (MFA)
- A login that needs a second proof beyond the password, such as an app code or a hardware key. Questionnaires ask for it on email, admin consoles and anything holding customer data.
- Incident reporting
- Under NIS2, an essential or important entity must send an early warning of a significant incident within 24 hours and a notification within 72 hours. Suppliers are expected to be able to notify their customers fast enough for that to be possible.
- Phishing baseline
- A measured starting point: a controlled test message sent to staff to see how many click, before any training. It turns awareness from an opinion into a number that can be improved.
- Generative engine optimisation (GEO)
- The work of making a business understood, trusted and cited by answer engines such as ChatGPT, Gemini, Perplexity and Google AI Overviews. It builds on technical SEO and adds entity consistency, source-worthy content and measurement of the share of answer.
- Answer engine optimisation (AEO)
- Structuring pages so a question is answered directly, early and in a quotable form, with the proof underneath. It is what makes a page usable by featured snippets and AI answers.
- Entity consistency
- The same facts about a business everywhere an engine can read them: name, location, services, contact, founding year. Contradictions between a website, a review profile and a social page lower trust and produce wrong AI answers.
- llms.txt
- A plain-text file at the root of a website that summarises what the site is about and where its key pages are, written for large language models that read it directly.
- Structured data
- Machine-readable facts added to a page in JSON-LD, such as Organization, Service, FAQPage or Article. Engines use it to understand who published what, about which subject.
- GoHighLevel
- A customer relationship management platform with pipelines, calendars, email, SMS and WhatsApp conversations, automation workflows and a funnel builder in one account. Often used by agencies, it can be set up on the client's own name.
- Lead response time
- The time between an enquiry arriving and a person or an automated message answering it. It is the single biggest controllable factor in whether a lead turns into a conversation.
- Scoped engagement
- Work agreed in writing before it starts: deliverables, timeline, exclusions and one price. The scope decides the number, which is why a scoping call comes before any quote.
- Digital department
- One accountable team that builds and runs the online side of a business, from website and search visibility to CRM, automation and security, instead of a separate supplier for each.
Missing a term?
Tell us and we add it. Or read the answers to the questions clients ask us.
