ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > organization-defined control parameter

organization-defined control parameter: The variable part of a control or control enhancement that can be instantiated by an organization during the tailoring process by either assigning an organization-defined value or selecting a value from a pre-defined list provided as part of the control or control enhancement.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > organizationally-tailored control baseline

organizationally-tailored control baseline: A control baseline tailored for a defined notional (type of) information system using overlays and/or system-specific control tailoring, and intended for use in selecting controls for multiple systems within one or more organizations.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > overlay

overlay: [OMB A-130] A specification of security or privacy controls, control enhancements, supplemental guidance, and other supporting information employed during the tailoring process, that is intended to complement (and further refine) security control baselines. The overlay specification may be more stringent or less stringent than the original security control baseline specification and can be applied to multiple information systems.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > personally identifiable information

personally identifiable information: [OMB A-130] Information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > plan of action and milestones

plan of action and milestones: A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > potential impact

potential impact: [FIPS 199] The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect (FIPS Publication 199 low); a serious adverse effect (FIPS Publication 199 moderate); or a severe or catastrophic adverse effect (FIPS Publication 199 high) on organizational operations, organizational assets, or individuals.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy architect

privacy architect: Individual, group, or organization responsible for ensuring that the system privacy requirements necessary to protect individuals' privacy are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and information systems processing PII.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy architecture

privacy architecture: An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise's privacy protection processes, technical measures, personnel and organizational sub-units, showing their alignment with the enterprise's mission and strategic plans.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy control

privacy control: [OMB A-130] The administrative, technical, and physical safeguards employed within an agency to ensure compliance with applicable privacy requirements and manage privacy risks. Note: Controls can be selected to achieve multiple objectives; those controls that are selected to achieve both security and privacy objectives require a degree of collaboration between the organization's information security program and privacy program.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy control assessment

privacy control assessment: [OMB A-130] The assessment of privacy controls to determine whether the controls are implemented correctly, operating as intended, and sufficient to ensure compliance with applicable privacy requirements and manage privacy risks. A privacy control assessment is both an assessment and a formal document detailing the process and the outcome of the assessment.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy control baseline

privacy control baseline: A collection of controls specifically assembled or brought together by a group, organization, or community of interest to address the privacy protection needs of individuals.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy impact assessment

privacy impact assessment: [OMB A-130] An analysis of how information is handled to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; to determine the risks and effects of creating, collecting, using, processing, storing, maintaining, disseminating, disclosing, and disposing of information in identifiable form in an electronic information system; and to examine and evaluate protections and alternate processes for handling information to mitigate potential privacy concerns. A privacy impact assessment is both an analysis and a formal document detailing the process and the outcome of the analysis.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy information

privacy information: Information that describes the privacy posture of an information system or organization.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy plan

privacy plan: [OMB A-130] A formal document that details the privacy controls selected for an information system or environment of operation that are in place or planned for meeting applicable privacy requirements and managing privacy risks, details how the controls have been implemented, and describes the methodologies and metrics that will be used to assess the controls.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy posture

privacy posture: The privacy posture represents the status of the information systems and information resources (e.g., personnel, equipment, funds, and information technology) within an organization based on information assurance resources (e.g., people, hardware, software, policies, procedures) and the capabilities in place to comply with applicable privacy requirements and manage privacy risks and to react as the situation changes.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy program plan

privacy program plan: [OMB A-130] A formal document that provides an overview of an agency's privacy program, including a description of the structure of the privacy program, the resources dedicated to the privacy program, the role of the Senior Agency Official for Privacy and other privacy officials and staff, the strategic goals and objectives of the privacy program, and the program management controls and common controls in place or planned for meeting applicable privacy requirements and managing privacy risks.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > privacy requirement

privacy requirement: A requirement that applies to an information system or an organization that is derived from applicable laws, executive orders, directives, policies, standards, regulations, procedures, and/or mission/business needs with respect to privacy. Note: The term privacy requirement can be used in a variety of contexts from high-level policy activities to low-level implementation activities in system development and engineering disciplines.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > protect (CSF function)

protect (CSF function): [NIST CSF] Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > provenance

provenance: The chronology of the origin, development, ownership, location, and changes to a system or system component and associated data. It may also include personnel and processes used to interact with or make modifications to the system, component, or associated data.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > reciprocity

reciprocity: Agreement among participating organizations to accept each other's security assessments to reuse system resources and/or to accept each other's assessed security posture to share information.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > records

records: [44 USC 3301] All recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > recover (CSF function)

recover (CSF function): [NIST CSF] Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > resilience

resilience: [CNSSI 4009] The ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruptions. Resilience includes the ability to withstand and recover from deliberate attacks, accidents, or naturally occurring threats or incidents.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > respond (CSF function)

respond (CSF function): [NIST CSF] Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > risk

risk: [OMB A-130] A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically is a function of: (i) the adverse impact, or magnitude of harm, that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > risk assessment

risk assessment: [SP 800-30] The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of a system.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > risk executive (function)

risk executive (function): [SP 800-39] An individual or group within an organization, led by the senior accountable official for risk management, that helps to ensure that security risk considerations for individual systems, to include the authorization decisions for those systems, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization in carrying out its missions and business functions; and managing risk from individual systems is consistent across the organization, reflects organizational risk tolerance, and is considered along with other organizational risks affecting mission/business success.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > risk management

risk management: [OMB A-130] The program and supporting processes to manage risk to agency operations (including mission, functions, image, reputation), agency assets, individuals, other organizations, and the Nation, and includes: establishing the context for risk-related activities; assessing risk; responding to risk once determined; and monitoring risk over time.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > risk mitigation

risk mitigation: [CNSSI 4009] Prioritizing, evaluating, and implementing the appropriate risk- reducing controls/countermeasures recommended from the risk management process.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > risk response

risk response: [OMB A-130] Accepting, avoiding, mitigating, sharing, or transferring risk to agency operations, agency assets, individuals, other organizations, or the Nation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > sanitization

sanitization: [SP 800-88] A process to render access to target data on the media infeasible for a given level of effort. Clear, purge, and destroy are actions that can be taken to sanitize media.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > scoping considerations

scoping considerations: A part of tailoring guidance providing organizations with specific considerations on the applicability and implementation of controls in the control baselines. Considerations include policy/regulatory, technology, physical infrastructure, system element allocation, operational/environmental, public access, scalability, common control, and security objective.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security

security: [CNSSI 4009] A condition that results from the establishment and maintenance of protective measures that enable an organization to perform its mission or critical functions despite risks posed by threats to its use of systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the organization's risk management approach.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security architect

security architect: Individual, group, or organization responsible for ensuring that the information security requirements necessary to protect the organization's core missions and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting information systems supporting those missions and business processes.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security architecture

security architecture: [SP 800-39] [SP 800-160 v1] An embedded, integral part of the enterprise architecture that describes the structure and behavior for an enterprise's security processes, information security systems, personnel and organizational sub-units, showing their alignment with the enterprise's mission and strategic plans. See information security architecture. A set of physical and logical security-relevant representations (i.e., views) of system architecture that conveys information about how the system is partitioned into security domains and makes use of security-relevant elements to enforce security policies within and between security domains based on how data and information must be protected. Note: The security architecture reflects security domains, the placement of security-relevant elements within the security domains, the interconnections and trust relationships between the security-relevant elements, and the behavior and interactions between the security-relevant elements. The security architecture, similar to the system architecture, may be expressed at different levels of abstraction and with different scopes.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security categorization

security categorization: The process of determining the security category for information or a system. Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS Publication 199 for other than national security systems. See security category.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security category

security category: [OMB A-130] The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on agency operations, agency assets, individuals, other organizations, and the Nation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security control

security control: [OMB A-130] The safeguards or countermeasures prescribed for an information system or an organization to protect the confidentiality, integrity, and availability of the system and its information.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security control assessment

security control assessment: [OMB A-130] The testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security control baseline

security control baseline: [OMB A-130] The set of minimum security controls defined for a low-impact, moderate-impact, or high-impact information system. See also control baseline.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security information

security information: Information within the system that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security posture

security posture: [CNSSI 4009] The security status of an enterprise's networks, information, and systems based on information assurance resources (e.g., people, hardware, software, policies) and capabilities in place to manage the defense of the enterprise and to react as the situation changes. Synonymous with security status.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > security requirement

security requirement: [FIPS 200, Adapted] A requirement levied on an information system or an organization that is derived from applicable laws, executive orders, directives, policies, standards, instructions, regulations, procedures, and/or mission/business needs to ensure the confidentiality, integrity, and availability of information that is being processed, stored, or transmitted. Note: Security requirements can be used in a variety of contexts from high- level policy activities to low-level implementation activities in system development and engineering disciplines.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > selection statement

selection statement: A control parameter that allows an organization to select a value from a list of pre-defined values provided as part of the control or control enhancement (e.g., selecting to either restrict an action or prohibit an action). See assignment statement and organization-defined control parameter.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > senior accountable official for risk management

senior accountable official for risk management: [OMB M-17-25] The senior official, designated by the head of each agency, who has vision into all areas of the organization and is responsible for alignment of information security management processes with strategic, operational, and budgetary planning processes.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > senior agency information security officer

senior agency information security officer: [44 USC 3544] Official responsible for carrying out the Chief Information Officer responsibilities under FISMA and serving as the Chief Information Officer's primary liaison to the agency's authorizing officials, information system owners, and information system security officers.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > senior agency official for privacy

senior agency official for privacy: [OMB A-130] The senior official, designated by the head of each agency, who has agency-wide responsibility for privacy, including implementation of privacy protections; compliance with Federal laws, regulations, and policies relating to privacy; management of privacy risks at the agency; and a central policy-making role in the agency's development and evaluation of legislative, regulatory, and other policy proposals.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > software

software: [CNSSI 4009] Computer programs and associated data that may be dynamically written or modified during execution.