Preserving authorized restrictions on information access and disclosure,

including means for protecting personal privacy and proprietary information. [44 U.S.C., SEC. 3542]

An executive department specified in 5 U.S.C., SEC. 101; a military department
specified in 5 U.S.C., SEC. 102; an independent establishment as defined in 5 U.S.C., SEC. 104(1); and a  wholly owned Government corporation fully subject to the provisions of 31 U.S.C., CHAPTER 91. [41
U.S.C., SEC. 403]

A discrete set of information resources organized for the collection,

processing, maintenance, use, sharing, dissemination, or disposition of information. [44 U.S.C., SEC.
3502]

Any equipment or interconnected system or subsystem of equipment
that is used in the automatic acquisition, storage, manipulation, management, movement, control,  display, switching, interchange, transmission, or reception of data or information by the executive  agency. For purposes of the preceding sentence, equipment is used by an executive agency if the  equipment is used by the executive agency directly or is used by a contractor under a contract with the
executive agency

A specific category of information (e.g., privacy, medical, proprietary,

financial, investigative, contractor sensitive, security management), defined by an organization, or in some instances, by a specific law, Executive Order, directive, policy, or regulation.

The characterization of information or an information system based on an
assessment of the potential impact that a loss of confidentiality, integrity, or availability of such  information or information system would have on organizational operations, organizational assets, or  individuals.

The process of managing risks to organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system, and includes:

(i) the conduct of a risk assessment;

(ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures for the continuous monitoring of the security state of the information system

Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service. Also, the potential for a threat-source to successfully exploit a particular information system vulnerability. [CNSS Instruction 4009 Adapted]

The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. Synonymous with threat agent

The process an organization employs to determine whether security controls are defined as system-specific, hybrid, or common.

The process an organization employs to assign security controls to specific information system components responsible for

providing a particular security capability (e.g., router, server, remote sensor).

The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation),
organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls

All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which the information system is connected.

A security control that is inherited by one or more organizational

information systems.  See Security Control Inheritance.

Configuration Control [CNSSI 4009]

A boundary with a set of mechanisms that enforces the security policies and controls the flow of information between interconnected information systems.

An environment or context that includes a set of system resources and a set of system entities that have the right to access the resources as defined by a common security policy, security model, or security architecture.  See Security Domain.

An information system or component of an information system that is outside of the authorization boundary established by the organization and for which the organization typically has no direct control over the application of required security controls or the assessment of security control effectiveness.

A security control that is implemented in an information system in part as a common control and in part as a system-specific control.

See Common Control and System-Specific Security Control.

Formal document that provides an overview of the security requirements for an organization-wide information security program and describes the program management controls and common controls in place or planned for meeting those requirements.

Process that captures and refines information security
requirements and ensures their integration into information technology component products and information systems through purposeful security design or configuration.

Information system-related security risks are those risks that arise through the loss of confidentiality, integrity, or availability of

information or information systems and consider impacts to the
organization (including assets, mission, functions, image, or
reputation), individuals, other organizations, and the Nation.

A complex system of systems composed of subsystems and services that are part of a continuously evolving, complex community of people, devices, information and services interconnected by a network that enhances information sharing and collaboration.  Subsystems and services may or may not be developed or owned by the same entity, and, in general, will not be continually present during the full life cycle of the system of systems.  Examples of this architecture include service-oriented architectures and cloud computing architectures.

Organization

[FIPS 200, Adapted]

Plan of Action and Milestones [OMB Memorandum 02-01]

A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones.

The process of identifying risks to organizational operations(including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management, incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place.  Synonymous with risk analysis.

The process of determining the security category for information or an information system.  Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS 199 for other than national security systems.

Security Control Assessment

The testing and/or evaluation of the management, operational, and technical security controls in an information system todetermine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.

A situation in which an information system or application
receives protection from security controls (or portions of security
controls) that are developed, implemented, assessed, authorized,
and monitored by entities other than those responsible for the
system or application; entities either internal or external to the
organization where the system or application resides.  See
Common Control.

The analysis conducted by an organizational official to determine the extent to which changes to the information system have affected the security state of the system.

Security Requirements

[FIPS 200]

Requirements levied on an information system that are derived from applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, procedures, or organizational mission/business case needs to ensure the confidentiality,integrity, and availability of the information being processed, stored, or transmitted.

The process by which a security control baseline is modified based on: (i) the application of scoping guidance;

(ii) the specification of compensating security controls, if needed; and

 
(iii) the specification of organization-defined parameters in the
security controls via explicit assignment and selection statements.

Monitoring and control of communications at the external boundary of an information system to prevent and detect malicious and other unauthorized communications, through the use of boundary protection devices (e.g., proxies, gateways, routers, firewalls, guards, encrypted tunnels).

A device with appropriate mechanisms that:

(i) facilitates the adjudication of different interconnected system security policies (e.g., controlling the flow of information into or out of an interconnected system); and/or

(ii) provides information system boundary protection.

Information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and missions of the organization.

Access control based on the identity of the user (typically relayed as a characteristic of the process acting on behalf of that user) where access authorizations to specific objects are assigned based on user identity

An information system used to control industrial processes such
as manufacturing, product handling, production, and distribution.
Industrial control systems include supervisory control and data
acquisition (SCADA) systems used to control geographically

dispersed assets, as well as distributed control systems (DCSs) and smaller control systems using programmable logic controllers to control localized processes.

Software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system.  A virus,worm, Trojan horse, or other code-based entity that infects a host. Spyware and some forms of adware are also examples of malicious code.