vCIO and MSP Glossary: QBR, TBR, EBR, TAM, RYG and More

The vCIO world runs on acronyms. QBR, TBR, EBR, TAM, RYG, MRR, NRR, RTO - and several of them mean different things depending on who is using them. This glossary defines the terms that come up most in MSP client reviews, in plain English, and notes where the vCIO Framework uses a term in a specific way.

Terms are grouped by topic. Each links to a deeper guide where one exists.

Roles

vCIO (Virtual Chief Information Officer)

A strategic technology advisor, usually provided by an MSP, who aligns a client's technology decisions with its business goals. The vCIO owns the roadmap, the budget conversation, and the client reviews. See our guide to the vCIO framework.

vCISO (Virtual Chief Information Security Officer)

The security-focused counterpart to the vCIO: a fractional advisor who owns a client's security program, policies, and compliance posture.

TAM (Technology Alignment Manager)

In the vCIO Framework, a hybrid role between account management and full vCIO delivery. The TAM runs structured alignment reviews and owns the operational relationship, typically for Tier B and Tier C clients. Elsewhere in the industry, TAM often means Technical Account Manager, a more technical, service-focused role.

Account Manager

The commercial owner of the client relationship: renewals, expansion, satisfaction, and escalations. Not the same role as a vCIO - see account manager vs. vCIO.

MSP (Managed Service Provider)

A company that manages a client's IT environment under a recurring agreement, typically covering support, monitoring, security, and strategic advisory.

MSSP (Managed Security Service Provider)

A provider focused specifically on managed security services such as monitoring, detection, and response.

Meetings

QBR (Quarterly Business Review)

The industry's most common name for a periodic client review. In the vCIO Framework, a QBR is the operational review with an IT or operations contact: tickets, SLAs, and project status. The strategic meeting with the budget holder is the TBR.

TBR (Technology Business Review)

The quarterly strategic review with the client's business owner or budget holder, led by the vCIO: health score, discovery, recommendations, and roadmap decisions. It is the meeting most MSPs mean when they say "QBR." See how to run a QBR (TBR) and our free template.

EBR (Executive Business Review)

An annual meeting with the client's executive team focused on business outcomes and a multi-year technology strategy. See the EBR template.

Discovery

The part of a review where the vCIO asks about the client's business - growth, changes, risks, and budget timing - before making any recommendation.

Scoring and Risk

RYG (Red, Yellow, Green)

The vCIO Framework's scoring scale. Red means immediate action or liability, Yellow means needs attention or inconsistent, Green means solid and systemized. Every item in the Standards Library gets one of the three.

Standards Library

The MSP's written definition of what a properly configured, secured, and lifecycle-managed client environment looks like. Every client is scored against it, and every gap is a documented deviation.

Client Health Score

A combined view of an account's technical, relationship, and commercial health, used to spot churn risk early. See the MSP client health score guide.

Digital Maturity Index (DMI)

ScalePad's proprietary 300-850 score for a client's technology environment, calculated from asset and lifecycle data. See DMI vs. RYG scoring.

Client Tiering

Segmenting clients by how much strategic attention they get. The vCIO Framework uses four tiers: Tier A - Always Engaged, Tier B - Betterment Focused, Tier C - Core Consistent, and Tier D - Sustain. Tier sets review depth and cadence.

Risk Register

The running list of a client's documented risks, each with a status, an owner, and a decision.

Risk Acceptance

A signed record that a client understands a documented risk and has chosen not to address it for now. In the vCIO Framework, every Red or Yellow gap ends in either a funded remediation project or a signed risk acceptance.

Planning and Recommendations

Technology Roadmap

A dated, budgeted plan of the technology changes a client will make over the next one to three years, built from scored findings and lifecycle data.

Lifecycle Management

Tracking the age, warranty, and support status of hardware and software so replacements are planned and budgeted instead of forced by failure.

EOL / EOS (End of Life / End of Support)

The date a vendor stops selling, patching, or supporting a product. EOS items are a common source of Red findings.

Good, Better, Best

Presenting each recommendation as three priced options. In the vCIO Framework, all three must resolve the finding. See Good, Better, Best QBR recommendations.

Account Plan

A written plan for each client covering where they are, where they are going, and the MSP's role in getting them there. Reviewed before every EBR.

Revenue Metrics

MRR (Monthly Recurring Revenue)

The predictable monthly revenue from managed services agreements.

ARR (Annual Recurring Revenue)

Recurring revenue expressed on an annual basis - typically MRR multiplied by twelve.

ARPU (Average Revenue Per User)

Average recurring revenue per end user or seat under management. A common measure of how well agreements are priced.

NRR (Non-Recurring Revenue)

In MSP benchmarking, revenue from projects, hardware, and one-time work. Note that SaaS companies use NRR for Net Revenue Retention, a different metric. Our posts use the MSP meaning.

Project Attach Rate

Project revenue generated per dollar of MRR - a measure of how well client reviews convert findings into funded work. See the project attach rate benchmark.

Churn

Clients or recurring revenue lost over a period. See how better QBRs reduce churn.

White Space

Services a client could buy from the MSP but currently does not - the gap between what they have and what they need.

Continuity and Recovery

BCDR (Business Continuity and Disaster Recovery)

The plans and systems that keep a business running and restore it after an outage, disaster, or cyberattack.

RTO (Recovery Time Objective)

How quickly systems must be back online after an outage. See why RTO is the wrong first question and the free RTO/RPO calculator.

RPO (Recovery Point Objective)

How much data, measured in time, the business can afford to lose - the maximum gap between the last good backup and an outage.

Tools

PSA (Professional Services Automation)

The MSP's system for tickets, agreements, billing, and projects - for example ConnectWise, Autotask, or HaloPSA.

RMM (Remote Monitoring and Management)

Software that monitors, patches, and manages client devices remotely.

vCIO Software / QBR Software

Platforms that automate assessments, roadmaps, budgets, and review reports. See our vCIO and QBR software comparison.

Client Portal

A branded site where clients see their roadmap, assets, tickets, and reports between reviews.

Frequently Asked Questions

What is the difference between a QBR, a TBR, and an EBR?

A QBR is an operational review with an IT contact. A TBR is a quarterly strategic review with the budget holder. An EBR is an annual executive review of business outcomes and multi-year strategy. Many MSPs use "QBR" for all three.

What does RYG mean for MSPs?

Red, Yellow, Green - a three-level status used to score each item in a client environment. Red is immediate action or liability, Yellow needs attention, and Green is solid and systemized.

What does TAM stand for at an MSP?

It depends on the MSP. In the vCIO Framework it means Technology Alignment Manager, a role between account manager and vCIO. Many MSPs use it for Technical Account Manager instead.

Want every one of these terms turned into a working process? Download the vCIO Framework v1.15, or take the free vCIO assessment.