ezesecops/rmf-ato-core huggingface dataset:
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Information Owner
Official with statutory or operational authority for
[CNSSI 4009]
specified information and responsibility for establishing
the controls for its generation, classification, collection,
processing, dissemination, and disposal. See Information
Steward.
Information Resources
Information and related resources, such as personnel,
[44 U.S.C., Sec. 3502]
equipment, funds, and information technology.
Information Security
The protection of information and information systems
[44 U.S.C., Sec. 3542]
from unauthorized access, use, disclosure, disruption,
modification, or destruction in order to provide
confidentiality, integrity, and availability.
Information Security Architecture
An embedded, integral part of the enterprise architecture
that describes the structure and behavior for an
enterprise's security processes, information security
systems, personnel and organizational sub-units, showing
their alignment with the enterprise's mission and strategic
plans.
Information Security Program Plan
Formal document that provides an overview of the
[NIST SP 800-53]
security requirements for an organization-wide
information security program and describes the program
management controls and common controls in place or
planned for meeting those requirements.
Information Steward
An agency official with statutory or operational authority
[CNSSI 4009]
for specified information and responsibility for
establishing the controls for its generation, collection,
processing, dissemination, and disposal.
Information System
A discrete set of information resources organized for the
[44 U.S.C., Sec. 3502]
collection, processing, maintenance, use, sharing,
dissemination, or disposition of information.
Information System Boundary
See Authorization Boundary.
Information System Owner
Official responsible for the overall procurement,
(or Program Manager)
development, integration, modification, or operation and
maintenance of an information system.
Information System Resilience
The ability of an information system to continue to: (i)
operate under adverse conditions or stress, even if in a
degraded or debilitated state, while maintaining essential
operational capabilities; and (ii) recover to an effective
operational posture in a time frame consistent with
mission needs.
Information System
Individual assigned responsibility by the senior agency
Security Officer
information security officer, authorizing official,
management official, or information system owner for
maintaining the appropriate operational security posture
for an information system or program.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Information Security Risk
Information System-Related
Security Risks
Information Technology
[40 U.S.C., Sec. 1401]
Information Type
[FIPS 199]
Integrity
[44 U.S.C., Sec. 3542]
Management Controls
[FIPS 200]
The risk to organizational operations (including mission,
functions, image, reputation), organizational assets,
individuals, other organizations, and the Nation due to the
potential for unauthorized access, use, disclosure,
disruption, modification, or destruction of information
and/or information systems.
Risks that arise through the loss of confidentiality,
integrity, or availability of information or information
systems and consider impacts to the organization
(including assets, mission, functions, image, or
reputation), individuals, other organizations, and the
Nation. See Risk.
Any equipment or interconnected system or subsystem of
equipment that is used in the automatic acquisition,
storage, manipulation, management, movement, control,
display, switching, interchange, transmission, or
reception of data or information by the executive agency.
For purposes of the preceding sentence, equipment is
used by an executive agency if the equipment is used by
the executive agency directly or is used by a contractor
under a contract with the executive agency which: (i)
requires the use of such equipment; or (ii) requires the
use, to a significant extent, of such equipment in the
performance of a service or the furnishing of a product.
The term information technology includes computers,
ancillary equipment, software, firmware, and similar
procedures, services (including support services), and
related resources.
A specific category of information (e.g., privacy,
medical, proprietary, financial, investigative, contractor
sensitive, security management) defined by an
organization or in some instances, by a specific law,
Executive Order, directive, policy, or regulation.
Guarding against improper information modification or
destruction, and includes ensuring information non-
repudiation and authenticity.
The security controls (i.e., safeguards or
countermeasures) for an information system that focus on
the management of risk and the management of
information system security.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

National Security System
[44 U.S.C., Sec. 3542]
Operational Controls
[FIPS 200]
Organization
[FIPS 200, Adapted]
Plan of Action and
Milestones
[OMB Memorandum 02-01]
Reciprocity
Resilience
Risk
[CNSSI 4009]
Any information system (including any
telecommunications system) used or operated by an
agency or by a contractor of an agency, or other
organization on behalf of an agency (i) the function,
operation, or use of which involves intelligence activities;
involves cryptologic activities related to national security;
involves command and control of military forces;
involves equipment that is an integral part of a weapon or
weapons system; or is critical to the direct fulfillment of
military or intelligence missions (excluding a system that
is to be used for routine administrative and business
applications, for example, payroll, finance, logistics, and
personnel management applications); or (ii) is protected
at all times by procedures established for information that
have been specifically authorized under criteria
established by an Executive Order or an Act of Congress
to be kept classified in the interest of national defense or
foreign policy.
The security controls (i.e., safeguards or
countermeasures) for an information system that are
primarily implemented and executed by people (as
opposed to systems).
An entity of any size, complexity, or positioning within
an organizational structure (e.g., a federal agency or, as
appropriate, any of its operational elements). See
Enterprise.
A document that identifies tasks needing to be
accomplished. It details resources required to accomplish
the elements of the plan, any milestones in meeting the
tasks, and scheduled completion dates for the milestones.
Mutual agreement among participating organizations to
accept each other's security assessments in order to reuse
information system resources and/or to accept each
other's assessed security posture in order to share
information.
See Information System Resilience.
A measure of the extent to which an entity is threatened
by a potential circumstance or event, and typically a
function of: (i) the adverse impacts that would arise if the
circumstance or event occurs; and (ii) the likelihood of
occurrence.
[Note: Information system-related security risks are those risks that
arise from the loss of confidentiality, integrity, or availability of
information or information systems and reflect the potential adverse
impacts to organizational operations (including mission, functions,
image, or reputation), organizational assets, individuals, other
organizations, and the Nation.]
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Risk Assessment
The process of identifying risks to organizational
operations (including mission, functions, image,
reputation), organizational assets, individuals, other
organizations, and the Nation, resulting from the
operation of an information system.
Part of risk management, incorporates threat and
vulnerability analyses, and considers mitigations
provided by security controls planned or in place.
Synonymous with risk analysis.
Risk Executive (Function)
[CNSSI 4009]
An individual or group within an organization that helps
to ensure that: (i) security risk-related considerations for
individual information systems, to include the
authorization decisions for those systems, are viewed
from an organization-wide perspective with regard to the
overall strategic goals and objectives of the organization
in carrying out its missions and business functions; and
(ii) managing risk from individual information systems is
consistent across the organization, reflects organizational
risk tolerance, and is considered along with other
organizational risks affecting mission/business success.
Risk Management
[CNSSI 4009, adapted]
The program and supporting processes to manage
information security risk to organizational operations
(including mission, functions, image, reputation),
organizational assets, individuals, other organizations,
and the Nation, and includes: (i) establishing the context
for risk-related activities; (ii) assessing risk; (iii)
responding to risk once determined; and (iv) monitoring
risk over time.
Risk Mitigation
[CNSSI 4009]
Prioritizing, evaluating, and implementing the
appropriate risk-reducing controls/countermeasures
recommended from the risk management process.
Risk Monitoring
Maintaining ongoing awareness of an organization's risk
environment, risk management program, and associated
activities to support risk decisions.
Risk Response
Accepting, avoiding, mitigating, sharing, or transferring
risk to organizational operations (i.e., mission, functions,
image, or reputation), organizational assets, individuals,
other organizations, or the Nation.
Risk Response Measure
A specific action taken to respond to an identified risk.
Root Cause Analysis
A principle-based, systems approach for the identification
of underlying causes associated with a particular set of
risks.
Security Authorization
(to Operate)
See Authorization (to operate).
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Security Categorization
Security Control Assessment
[CNSSI 4009, Adapted]
Security Control Assessor
Security Control Baseline
[CNSSI 4009]
Security Control Enhancements
Security Control Inheritance
[CNSSI 4009]
Security Controls
[FIPS 199, CNSSI 4009]
Security Impact Analysis
[NIST SP 800-37]
Security Objective
[FIPS 199]
Security Plan
[NIST SP 800-18]
Security Policy
[CNSSI 4009]
The process of determining the security category for
information or an information system. Security
categorization methodologies are described in CNSS
Instruction 1253 for national security systems and in
FIPS 199 for other than national security systems.
The testing and/or evaluation of the management,
operational, and technical security controls to determine
the extent to which the controls are implemented
correctly, operating as intended, and producing the
desired outcome with respect to meeting the security
requirements for an information system or organization.
The individual, group, or organization responsible for
conducting a security control assessment.
The set of minimum security controls defined for a low-
impact, moderate-impact, or high-impact information
system.
Statements of security capability to: (i) build in
additional, but related, functionality to a basic control;
and/or (ii) increase the strength of a basic control.
A situation in which an information system or application
receives protection from security controls (or portions of
security controls) that are developed, implemented,
assessed, authorized, and monitored by entities other than
those responsible for the system or application; entities
either internal or external to the organization where the
system or application resides. See Common Control.
The management, operational, and technical controls
(i.e., safeguards or countermeasures) prescribed for an
information system to protect the confidentiality,
integrity, and availability of the system and its
information.
The analysis conducted by an organizational official to
determine the extent to which changes to the information
system have affected the security state of the system.
Confidentiality, integrity, or availability.
Formal document that provides an overview of the
security requirements for an information system or an
information security program and describes the security
controls in place or planned for meeting those
requirements.
See System Security Plan or Information Security
Program Plan.
A set of criteria for the provision of security services.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX B

Security Requirements
[FIPS 200]
Senior Agency
Information Security
Officer
[44 U.S.C., Sec. 3544]
Senior Information Security
Officer
Subsystem
Supplementation (Security
Controls)
System
System Security Plan
[NIST SP 800-18]
System-Specific Security Control
[NIST SP 800-37]
Tailoring
[NIST SP 800-53, CNSSI 4009]
Tailored Security Control Baseline
Requirements levied on an information system that are
derived from applicable laws, Executive Orders,
directives, policies, standards, instructions, regulations,
procedures, or organizational mission/business case needs
to ensure the confidentiality, integrity, and availability of
the information being processed, stored, or transmitted.
Official responsible for carrying out the Chief
Information Officer responsibilities under FISMA and
serving as the Chief Information Officer's primary liaison
to the agency's authorizing officials, information system
owners, and information system security officers.
[Note: Organizations subordinate to federal agencies may use the term
Senior Information Security Officer or Chief Information Security
Officer to denote individuals filling positions with similar
responsibilities to Senior Agency Information Security Officers.]
See Senior Agency Information Security Officer.
A major subdivision or component of an information
system consisting of information, information
technology, and personnel that performs one or more
specific functions.
The process of adding security controls or control
enhancements to a security control baseline from NIST
Special Publication 800-53 or CNSS Instruction 1253 in
order to adequately meet the organization's risk
management needs.
See Information System.
Formal document that provides an overview of the
security requirements for an information system and
describes the security controls in place or planned for
meeting those requirements.
A security control for an information system that has not
been designated as a common control or the portion of a
hybrid control that is to be implemented within an
information system.
The process by which a security control baseline is
modified based on: (i) the application of scoping
guidance; (ii) the specification of compensating security
controls, if needed; and (iii) the specification of
organization-defined parameters in the security controls
via explicit assignment and selection statements.
A set of security controls resulting from the application
of tailoring guidance to the security control baseline. See
Tailoring.
Managing Information Security Risk: Organization, Mission, and Information System View
Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition

Appendix H); and (vii) the general organizational directions and guidance on appropriate responses to risk. In addition

to the risk assessment and risk framing steps, the risk response step can receive inputs from the risk monitoring step
(e.g., when organizations experience a breach or compromise to their information systems or environments of operation
that require an immediate response to address the incident and reduce additional risk that results from the event). The
risk response step can also receive inputs from the risk framing step (e.g., when organizations are required to deploy
new safeguards and countermeasures in their information systems based on security requirements in new legislation or
OMB policies). The risk framing step also directly shapes the resource constraints associated with selecting an
appropriate course of action. Additional preconditions established at the risk framing step may include: (i) constraints
based on architecture and previous investments; (ii) organizational preferences and tolerances; (iii) the expected
effectiveness at mitigating risk (including how effectiveness is measured and monitored); and (iv) the time horizon for
the risk (e.g., current risk, projected risk-that is, a risk expected to arise in the future based on the results of threat
assessments or a planned changes in missions/business functions, enterprise architecture (including information
security architecture), or aspects of legal or regulatory compliance).
Activities
RISK RESPONSE IDENTIFICATION
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX F > GOVERNANCE MODELS > Centralized Governance

Centralized Governance

In centralized governance structures, the authority, responsibility, and decision-making power are
vested solely within central bodies. These centralized bodies establish the appropriate policies,
procedures, and processes for ensuring organization-wide involvement in the development and
implementation of risk management and information security strategies, risk, and information
security decisions, and the creation inter-organizational and intra-organizational communication
mechanisms. A centralized approach to governance requires strong, well-informed central
leadership and provides consistency throughout the organization. Centralized governance
structures also provide less autonomy for subordinate organizations that are part of the parent
organization.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.1 HEAD OF AGENCY (CHIEF EXECUTIVE OFFICER)

D.1 HEAD OF AGENCY (CHIEF EXECUTIVE OFFICER)

The head of agency (or chief executive officer) is the highest-level senior official or executive
within an organization with the overall responsibility to provide information security protections
commensurate with the risk and magnitude of harm (i.e., impact) to organizational operations and
assets, individuals, other organizations, and the Nation resulting from unauthorized access, use,
disclosure, disruption, modification, or destruction of: (i) information collected or maintained by
or on behalf of the agency; and (ii) information systems used or operated by an agency or by a
contractor of an agency or other organization on behalf of an agency. Agency heads are also
responsible for ensuring that: (i) information security management processes are integrated with
strategic and operational planning processes; (ii) senior officials within the organization provide
information security for the information and information systems that support the operations and
assets under their control; and (iii) the organization has trained personnel sufficient to assist in
complying with the information security requirements in related legislation, policies, directives,
instructions, standards, and guidelines. Through the development and implementation of strong
policies, the head of agency establishes the organizational commitment to information security
and the actions required to effectively manage risk and protect the missions/business functions
being carried out by the organization. The head of agency establishes appropriate accountability
for information security and provides active support and oversight of monitoring and
improvement for the information security program. Senior leadership commitment to information
security establishes a level of due diligence within the organization that promotes a climate for
mission and business success.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.10 INFORMATION SYSTEM SECURITY OFFICER

D.10 INFORMATION SYSTEM SECURITY OFFICER

The information system security officer76 is an individual responsible for ensuring that the
appropriate operational security posture is maintained for an information system and as such,
works in close collaboration with the information system owner. The information system security
officer also serves as a principal advisor on all matters, technical and otherwise, involving the
security of an information system. The information system security officer has the detailed
knowledge and expertise required to manage the security aspects of an information system and, in
many organizations, is assigned responsibility for the day-to-day security operations of a system.
This responsibility may also include, but is not limited to, physical and environmental protection,
personnel security, incident handling, and security training and awareness. The information
system security officer may be called upon to assist in the development of the security policies
and procedures and to ensure compliance with those policies and procedures. In close
coordination with the information system owner, the information system security officer often
plays an active role in the monitoring of a system and its environment of operation to include
developing and updating the security plan, managing and controlling changes to the system, and
assessing the security impact of those changes.
Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX D > D.11 INFORMATION SECURITY ARCHITECT

D.11 INFORMATION SECURITY ARCHITECT

The information security architect is an individual, group, or organization responsible for
ensuring that the information security requirements necessary to protect the organizational
missions/business functions are adequately addressed in all aspects of enterprise architecture
including reference models, segment and solution architectures, and the resulting information
systems supporting those missions and business processes. The information security architect
serves as the liaison between the enterprise architect and the information system security engineer
and also coordinates with information system owners, common control providers, and
information system security officers on the allocation of security controls as system-specific,
hybrid, or common controls. In addition, information security architects, in close coordination
with information system security officers, advise authorizing officials, chief information officers,
74 The responsibility for deciding who has access to specific information within an information system (and with what
types of privileges or access rights) may reside with the information owner/steward.
75 Depending on how the organization has organized its security authorization activities, the authorizing official may
choose to designate an individual other than the information system owner to compile and assemble the information for
the security authorization package. In this situation, the designated individual must coordinate the compilation and
assembly activities with the information system owner.
76 Organizations may also define an information system security manager or information security manager role with
similar responsibilities as an information system security officer or with oversight responsibilities for an information
security program. In these situations, information system security officers may, at the discretion of the organization,
report directly to information system security managers or information security managers.