As several people have mentioned The Imitation Game is, though fun, historically, er, challenged.
The Enigma machine had a Daily Key, shared by a "cryptonet" - ie a group of users using the same Key - say an Army Group. So the basics - wheel order, ring setting and plug settings were common to lots of signals units. The Key was sent out on monthly paper sheets, containing the Keys for each day of that month. So, with the Daily Key, you've got the right plugs plugged in right, you've selected the right wheels and put them on the spindle in the right order, and you've put the ring clips in the right position on each wheel. (The ring clip has the effect of rotating the internal wiring of each wheel, so the clip mathematically converts each wheel into 26 different (though related) wheels. And so that makes the puzzle harder.
But none of that tells you, the German Signalman, where to start each wheel on the spindle. You the German Signalman get to pick the starting position yourself, for every message. So you spin each wheel to a starting position of your choice, say position L for the left wheel, F for the middle wheel and T for the right wheel; and then you encrypt your message.
Problem is, the German Signalman on the receiving end, while he's got the Daily Key, and so can set up wheels, ring clips and plugs right, doesn't know what starting position you chose. So you, the sender, have to tell him. And you do that by picking three letters at random, say AYB (the Grundstellung) and flipping the three wheels to those starting positions - ie so those letters show up in the little panel on the front, after you've closed the machine. Then you tap in the starting position that you just used for the message you just encrypted - ie LFT - and encrypt LFT on your machine. Suppose it comes out PPS.
Now when you send your message, you put AYB PPS into the heading right up where you're mentioning your call sign and the time of the message etc, and how many letters it has, BEFORE you get to the actual encrypted message. The mug at the far end twiddles his spindle to AYB, types in PPS and out pops LFT. Cos Enigma is reciprocal.
So he knows the real meat of your encrypted message was encrypted with a starting position of LFT. So the receiver can then decrypt the message by flipping his spindles to LFT and then tapping away at your enciphered message using the Daily Key, based on the correct starting position.
So the starting position, or as it was called - Message Setting - is the position you start the machine from (ie which letters are showing in the panel) when you start encrypting - or start decrypting - a particular message. And you send that to your chum ENCRYPTED so he can work it out but the enemy can't. Good scheme.
But it loses a lot of its power if the sender picks non random message settings. If he's lazy and just picks ABC, or XYZ, that makes the enemy's job much easier, as they have a fair shot at guessing the message setting, which gives them a leg up towards solving the Daily Key. Especially if the enemy notes which German Signals troops seem to be dopiest and have bad habits picking message settings.
And one thing the enemy (ie Bletchley Park) spotted was that some German Signals troops used abbreviated versions of girls names for Message Settings - presumably their wives or girlfriends. Like MAR for Marthe, or DOR for Doris, or .....CIL for Cilli. Cilli is one of several pet variants of the German version of Cecilia. Obviously one particularly lazy, or perhaps infatuated, German Signalman was in the habit of often using CIL as his message setting and Bletchley Park noticed, and presumably couldn't resist the pun of using "cilli" as the generic term for guessable message settings caused by German operator laziness.
The film is quite wrong to suggest that five letter CILLI was ever used by a lazy German or spotted by BP. It would only ever have been CIL. Three letters for the three letter Message Setting.
The film is probably confusing this with the five letter group that was used to send the 'discriminant" - which is the fancy name for the flag to the receiver as to which (of several possible) Daily Keys was being used. The discriminant was also three letters (printed on the Key Sheet) but it was (badly) hidden within a five letter group. eg if the discriminant was WVM, the first five letter group of the actual message might be, for example BNMVW. ie the sender would put two random letters up front and then put the discriminant in any order as the last three letters. This held up Bletchley Park by about a minute maximum, as you might imagine. And nothing whatever to do with cillies.
Contra what some people have said above each message (each day, in each cryptonet) was encrypted using the same Daily Key. The Message Setting was simply the three letter starting position selected by the sender for each message, it wasn't a whole separate Key. So once BP had cracked the Daily Key for that cryptonet, they could decrypt EVERY message sent (and intercepted) on that cryptonet - because like the German receivers, once BP had the Daily Key, it took a matter of seconds to work out the Message Setting, ie the starting position, for each message.