ezesecops/rmf-ato-core huggingface dataset:
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Advanced Persistent Threats

Advanced Persistent Threats: [NIST SP 800-39] An adversary with sophisticated levels of expertise and significant resources, allowing it through the use of multiple different attack vectors (e.g., cyber, physical, and deception) to generate opportunities to achieve its objectives, which are typically to establish and extend footholds within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender's efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives. Agency See Executive Agency.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Allocation

Allocation: [NISTIR 7298] The process an organization employs to determine whether security controls are defined as system-specific, hybrid, or common. The process an organization employs to assign security controls to specific information system components responsible for providing a particular security capability (e.g., router, server, remote sensor).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Application

Application: [NISTIR 7298] A software program hosted by an information system. Assessment See Security Control Assessment.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Assessment Findings

Assessment Findings: [NISTIR 7298] Assessment results produced by the application of an assessment procedure to a security control or control enhancement to achieve an assessment objective; the execution of a determination statement within an assessment procedure by an assessor that results in either a satisfied or other than satisfied condition.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Assessment Method

Assessment Method: [NISTIR 7298] One of three types of actions (examine, interview, test) taken by assessors in obtaining evidence during an assessment.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Assessment Object

Assessment Object: [NISTIR 7298] The item (specifications, mechanisms, activities, individuals) upon which an assessment method is applied during an assessment.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Assessment Objective

Assessment Objective: [NISTIR 7298] A set of determination statements that expresses the desired outcome for the assessment of a security control or control enhancement.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Assessment Procedure

Assessment Procedure: [NISTIR 7298] A set of assessment objectives and an associated set of assessment methods and assessment objects. Assessor See Security Control Assessor.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Assurance

Assurance: [NISTIR 7298] The grounds for confidence that the set of intended security controls in an information system are effective in their application.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Assurance Case

Assurance Case: [NISTIR 7298] A structured set of arguments and a body of evidence showing that an information system satisfies specific claims with respect to a given quality attribute.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Authentication

Authentication: [FIPS 200] Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Authenticity

Authenticity: [CNSSI 4009] The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator. See Authentication.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Authorization Boundary

Authorization Boundary: [NIST SP 800-37] All components of an information system to be authorized for operation by an authorizing official and excludes separately authorized systems, to which the information system is connected.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Authorization (to operate)

Authorization (to operate): [CNSSI 4009] The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation based on the implementation of an agreed-upon set of security controls.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Authorizing Official (AO)

Authorizing Official (AO): [CNSSI 4009] A senior (federal) official or executive with the authority to formally assume responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Availability

Availability: [44 U.S.C., Sec. 3542] Ensuring timely and reliable access to and use of information. Categorization See Security Categorization.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Chief Information Officer (CIO)

Chief Information Officer (CIO): [PL 104-106, Sec. 5125(b)] Agency official responsible for: 1) Providing advice and other assistance to the head of the executive agency and other senior management personnel of the agency to ensure that information technology is acquired and information resources are managed in a manner that is consistent with laws, Executive Orders, directives, policies, regulations, and priorities established by the head of the agency; 2) Developing, maintaining, and facilitating the implementation of a sound and integrated information technology architecture for the agency; and 3) Promoting the effective and efficient design and operation of all major information resources management processes for the agency, including improvements to work processes of the agency. Chief Information Security Officer See Senior Agency Information Security Officer.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Common Control

Common Control: [CNSSI 4009] A security control that is inherited by one or more organizational information systems. See Security Control Inheritance.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Common Control Provider

Common Control Provider: [NISTIR 7298] An organizational official responsible for the development, implementation, assessment, and monitoring of common controls (i.e., security controls inherited by information systems).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Compensating Security Controls

Compensating Security Controls: [NISTIR 7298] The management, operational, and technical controls (i.e., safeguards or countermeasures) employed by an organization in lieu of the recommended controls in the low, moderate, or high baselines described in NIST Special Publication 800-53, that provide equivalent or comparable protection for an information system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Comprehensive Testing

Comprehensive Testing: [NISTIR 7298] A test methodology that assumes explicit and substantial knowledge of the internal structure and implementation detail of the assessment object. Also known as white box testing. Computer Incident Response Team (CIRT) [CNSSI 4009] Group of individuals usually consisting of Security Analysts organized to develop, recommend, and coordinate immediate mitigation actions for containment, eradication, and recovery resulting from computer security incidents. Also called a Computer Security Incident Response Team (CSIRT) or a CIRC (Computer Incident Response Center, Computer Incident Response Capability, or Cyber Incident Response Team).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Confidentiality

Confidentiality: [44 U.S.C., Sec. 3542] Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Configuration Control (or Configuration Management)

Configuration Control (or Configuration Management): [CNSSI 4009] Process for controlling modifications to hardware, firmware, software, and documentation to protect the information system against improper modifications before, during, and after system implementation. Continuous Monitoring Maintaining ongoing awareness to support organizational risk decisions. See Information Security Continuous Monitoring, Risk Monitoring, and Status Monitoring.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Controlled Interface

Controlled Interface: [CNSSI 4009] A boundary with a set of mechanisms that enforces the security policies and controls the flow of information between interconnected information systems.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Countermeasures

Countermeasures: [CNSSI 4009] Actions, devices, procedures, techniques, or other measures that reduce the vulnerability of an information system. Synonymous with security controls and safeguards. Coverage [NISTIR 7298] An attribute associated with an assessment method that addresses the scope or breadth of the assessment objects included in the assessment (e.g., types of objects to be assessed and the number of objects to be assessed by type). The values for the coverage attribute, hierarchically from less coverage to more coverage, are basic, focused, and comprehensive. Data Loss The exposure of proprietary, sensitive, or classified information through either data theft or data leakage.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Depth

Depth: [NISTIR 7298] An attribute associated with an assessment method that addresses the rigor and level of detail associated with the application of the method. The values for the depth attribute, hierarchically from less depth to more depth, are basic, focused, and comprehensive.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Domain

Domain: [CNSSI 4009] An environment or context that includes a set of system resources and a set of system entities that have the right to access the resources as defined by a common security policy, security model, or security architecture. See Security Domain.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Environment of Operation

Environment of Operation: [NISTIR 7298] The physical surroundings in which an information system processes, stores, and transmits information.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Examine

Examine: [NISTIR 7298] A type of assessment method that is characterized by the process of checking, inspecting, reviewing, observing, studying, or analyzing one or more assessment objects to facilitate understanding, achieve clarification, or obtain evidence, the results of which are used to support the determination of security control effectiveness over time.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Executive Agency

Executive Agency: [41 U.S.C., Sec. 403] An executive department specified in 5 U.S.C., Sec. 101; a military department specified in 5 U.S.C., Sec. 102; an independent establishment as defined in 5 U.S.C., Sec. 104(1); and a wholly owned Government corporation fully subject to the provisions of 31 U.S.C., Chapter 91. Expected Output Any data collected from monitoring and assessments as part of the ISCM strategy. Federal Agency See Executive Agency.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Federal Information System

Federal Information System: [40 U.S.C., Sec. 11331] An information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > High-Impact System

High-Impact System: [FIPS 200] An information system in which at least one security objective (confidentiality, integrity, or availability) is assigned a FIPS 199 potential impact value of high.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Hybrid Security Control

Hybrid Security Control: [CNSSI 4009] A security control that is implemented in an information system in part as a common control and in part as a system-specific control. See Common Control and System-Specific Security Control.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Incident

Incident: [FIPS 200] An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Individuals

Individuals: [NISTIR 7298] An assessment object that includes people applying specifications, mechanisms, or activities.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Owner

Information Owner: [CNSSI 4009] Official with statutory or operational authority for specified information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Resources

Information Resources: [44 U.S.C., Sec. 3502] Information and related resources, such as personnel, equipment, funds, and information technology.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Security

Information Security: [44 U.S.C., Sec. 3542] The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Security Architect

Information Security Architect: [NISTIR 7298] Individual, group, or organization responsible for ensuring that the information security requirements necessary to protect the organization's core missions and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting information systems supporting those missions and business processes. Information Security Continuous Monitoring (ISCM) Maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. [Note: The terms "continuous" and "ongoing" in this context mean that security controls and organizational risks are assessed and analyzed at a frequency sufficient to support risk-based security decisions to adequately protect organization information.] Information Security Continuous Monitoring (ISCM) Program A program established to collect information in accordance with preestablished metrics, utilizing information readily available in part through implemented security controls. Information Security Continuous Monitoring (ISCM) Process A process to: • Define an ISCM strategy; • Establish an ISCM program; • Implement an ISCM program; • Analyze data and Report findings; • Respond to findings; and • Review and Update the ISCM strategy and program.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Security Program Plan

Information Security Program Plan: [NISTIR 7298] Formal document that provides an overview of the security requirements for an organization-wide information security program and describes the program management controls and common controls in place or planned for meeting those requirements.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Security Risk

Information Security Risk: [NIST SP 800-39] The risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of information and /or information systems. See Risk.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information System

Information System: [44 U.S.C., Sec. 3502] A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information System Boundary See Authorization Boundary.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information System Owner (or Program Manager)

Information System Owner (or Program Manager): [NISTIR 7298] Official responsible for the overall procurement, development, integration, modification, or operation and maintenance of an information system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information System Security Engineer

Information System Security Engineer: [CNSSI 4009] Individual assigned responsibility for conducting information system security engineering activities.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information System Security Engineering

Information System Security Engineering: [CNSSI 4009] Process that captures and refines information security requirements and ensures that their integration into information technology component products and information systems through purposeful security design or configuration. Information System- related Security Risks Risks that arise through the loss of confidentiality, integrity, or availability of information or information systems and consider impacts to the organization (including assets, mission, functions, image, or reputation), individuals, other organizations, and the Nation. See Risk.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information System Security Officer (ISSO)

Information System Security Officer (ISSO): [CNSSI 4009] Individual with assigned responsibility for maintaining the appropriate operational security posture for an information system or program.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Technology

Information Technology: [40 U.S.C., Sec. 1401] Any equipment or interconnected system or subsystem of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information by the executive agency. For purposes of the preceding sentence, equipment is used by an executive agency if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency which: (i) requires the use of such equipment; or (ii) requires the use, to a significant extent, of such equipment in the performance of a service or the furnishing of a product. The term information technology includes computers, ancillary equipment, software, firmware, and similar procedures, services (including support services), and related resources.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Information Type

Information Type: [FIPS 199] A specific category of information (e.g., privacy, medical, proprietary, financial, investigative, contractor sensitive, security management) defined by an organization or in some instances, by a specific law, Executive Order, directive, policy, or regulation.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Integrity

Integrity: [44 U.S.C., Sec. 3542] Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Interview

Interview: [NISTIR 7298] A type of assessment method that is characterized by the process of conducting discussions with individuals or groups within an organization to facilitate understanding, achieve clarification, or lead to the location of evidence, the results of which are used to support the determination of security control effectiveness over time.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Intrusion Detection and Prevention System (IDPS)

Intrusion Detection and Prevention System (IDPS): [NISTIR 7298] Software that automates the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents and attempting to stop detected possible incidents.