Minimum Security Requirements for Federal Information and Information Systems
Appendix III] (part 1)

Appendix III]

AGENCY: Any executive department, military department, government corporation, government
controlled corporation, or other establishment in the executive branch of the government (including
the Executive Office of the President), or any independent regulatory agency, but does not include: (i)
the Government Accountability Office; (ii) the Federal Election Commission; (iii) the governments of
the District of Columbia and of the territories and possessions of the United States, and their various
subdivisions; or (iv) government-owned contractor-operated facilities, including laboratories engaged
in national defense research and production activities. [44 U.S.C., SEC. 3502]
AUTHENTICATION: Verifying the identity of a user, process, or device, often as a prerequisite to
allowing access to resources in an information system. AUTHORIZING OFFICIAL: Official with the authority to formally assume responsibility for operating an
information system at an acceptable level of risk to agency operations (including mission, functions,
image, or reputation), agency assets, or individuals. Synonymous with Accreditation Authority. AVAILABILITY: Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]
CERTIFICATION: A comprehensive assessment of the management, operational, and technical security
controls in an information system, made in support of security accreditation, to determine the extent to
which the controls are implemented correctly, operating as intended, and producing the desired
outcome with respect to meeting the security requirements for the system. CHIEF INFORMATION OFFICER: Agency official responsible for: (i) providing advice and other
assistance to the head of the executive agency and other senior management personnel of the agency
to ensure that information technology is acquired and information resources are managed in a manner
that is consistent with laws, Executive Orders, directives, policies, regulations, and priorities
established by the head of the agency; (ii) developing, maintaining, and facilitating the
implementation of a sound and integrated information technology architecture for the agency; and (iii)
promoting the effective and efficient design and operation of all major information resources
management processes for the agency, including improvements to work processes of the agency. [44
U.S.C., Sec. 5125(b)]
CHIEF INFORMATION SECURITY OFFICER: See Senior Agency Information Security Officer. CONFIDENTIALITY: Preserving authorized restrictions on information access and disclosure, including
means for protecting personal privacy and proprietary information. [44 U.S.C., SEC. 3542]
COUNTERMEASURES: Actions, devices, procedures, techniques, or other measures that reduce the
vulnerability of an information system. [CNSS Instruction 4009] Synonymous with security controls
and safeguards. ENVIRONMENT: Aggregate of external procedures, conditions, and objects affecting the development,
operation, and maintenance of an information system. [CNSS Instruction 4009]
EXECUTIVE AGENCY: An executive department specified in 5 U.S.C., SEC. 101; a military department
specified in 5 U.S.C., SEC. 102; an independent establishment as defined in 5 U.S.C., SEC. 104(1); and a
wholly-owned Government corporation fully subject to the provisions of 31 U.S.C., CHAPTER 91. [41
U.S.C., SEC. 403]
FEDERAL AGENCY: See Agency. FEDERAL INFORMATION SYSTEM: An information system used or operated by an executive agency, by
a contractor of an executive agency, or by another organization on behalf of an executive agency. [40
U.S.C., SEC. 11331]
HIGH-IMPACT SYSTEM: An information system in which at least one security objective (i.e.,
confidentiality, integrity, or availability) is assigned a FIPS 199 potential impact value of high. INCIDENT: An occurrence that actually or potentially jeopardizes the confidentiality, integrity, or
availability of an information system or the information the system processes, stores, or transmits or
that constitutes a violation or imminent threat of violation of security policies, security procedures, or
acceptable use policies. INFORMATION: An instance of an information type. [FIPS Publication 199]
INFORMATION OWNER: Official with statutory or operational authority for specified information and
responsibility for establishing the controls for its generation, collection, processing, dissemination, and
disposal. [CNSS Instruction 4009]
INFORMATION RESOURCES: Information and related resources, such as personnel, equipment, funds,
and information technology. [44 U.S.C., SEC. 3502]
INFORMATION SECURITY: The protection of information and information systems from unauthorized
access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality,
integrity, and availability. [44 U.S.C., SEC. 3542]
INFORMATION SYSTEM: A discrete set of information resources organized for the collection,
processing, maintenance, use, sharing, dissemination, or disposition of information. [44 U.S.C., SEC. 3502]
INFORMATION SYSTEM OWNER: Official responsible for the overall procurement, development,
integration, modification, or operation and maintenance of an information system. [CNSS Instruction
4009 Adapted]
INFORMATION TECHNOLOGY: Any equipment or interconnected system or subsystem of equipment
that is used in the automatic acquisition, storage, manipulation, management, movement, control,
display, switching, interchange, transmission, or reception of data or information by the executive
agency. For purposes of the preceding sentence, equipment is used by an executive agency if the
equipment is used by the executive agency directly or is used by a contractor under a contract with the
executive agency which: (i) requires the use of such equipment; or (ii) requires the use, to a significant
extent, of such equipment in the performance of a service or the furnishing of a product.