ezesecops/rmf-ato-core huggingface dataset:
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Malware

Malware: [NISTIR 7298] A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system or of otherwise annoying or disrupting the victim.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Management Controls

Management Controls: [FIPS 200] The security controls (i.e., safeguards or countermeasures) for an information system that focus on the management of risk and the management of information system security.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Mechanisms

Mechanisms: [NISTIR 7298] An assessment object that includes specific protection-related items (e.g., hardware, software, or firmware) employed within or at the boundary of an information system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Metrics

Metrics: [NISTIR 7298] Tools designed to facilitate decision making and improve performance and accountability through collection, analysis, and reporting of relevant performance-related data.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > National Security System

National Security System: [44 U.S.C., Sec. 3542] Any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency-(i) the function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions (excluding a system that is to be used for routine administrative and business applications, for example, payroll, finance, logistics, and personnel management applications); or (ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Operational Controls

Operational Controls: [FIPS 200] The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by people (as opposed to systems).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Organization

Organization: [FIPS 200, Adapted] An entity of any size, complexity, or positioning within an organizational structure (e.g., a federal agency, or, as appropriate, any of its operational elements). Organizational Information Security Continuous Monitoring Ongoing monitoring sufficient to ensure and assure effectiveness of security controls related to systems, networks, and cyberspace, by assessing security control implementation and organizational security status in accordance with organizational risk tolerance - and within a reporting structure designed to make real-time, data- driven risk management decisions.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Patch Management

Patch Management: [CNSSI 4009] The systematic notification, identification, deployment, installation, and verification of operating system and application software code revisions. These revisions are known as patches, hot fixes, and service packs.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Penetration Testing

Penetration Testing: [NISTIR 7298] A test methodology in which assessors, using all available documentation (e.g., system design, source code, manuals) and working under specific constraints, attempt to circumvent the security features of an information system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Plan of Action & Milestones (POA&M)

Plan of Action & Milestones (POA&M): [OMB Memorandum 02-01] A document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Potential Impact

Potential Impact: [FIPS 199] The loss of confidentiality, integrity, or availability could be expected to have: (i) a limited adverse effect (FIPS 199 low); (ii) a serious adverse effect (FIPS 199 moderate); or (iii) a severe or catastrophic adverse effect (FIPS 199 high) on organizational operations, organizational assets, or individuals.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Records

Records: [CNSSI 4009] The recordings (automated and/or manual) of evidence of activities performed or results achieved (e.g., forms, reports, test results), which serve as a basis for verifying that the organization and the information system are performing as intended. Also used to refer to units of related data fields (i.e., groups of data fields that can be accessed by a program and that contain the complete set of information on particular items).
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Resilience

Resilience: [NIST SP 800-39, Adapted] The ability to continue to: (i) operate under adverse conditions or stress, even if in a degraded or debilitated state, while maintaining essential operational capabilities; and (ii) recover to an effective operational posture in a time frame consistent with mission needs.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Risk

Risk: [FIPS 200, Adapted] A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. [Note: Information system-related security risks are those risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. Adverse impacts to the Nation include, for example, compromises to information systems that support critical infrastructure applications or are paramount to government continuity of operations as defined by
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Risk Executive (Function)

Risk Executive (Function): [CNSSI 4009] An individual or group within an organization that helps to ensure that: (i) security risk-related considerations for individual information systems, to include the authorization decisions, are viewed from an organization-wide perspective with regard to the overall strategic goals and objectives of the organization in carrying out its missions and business functions; and (ii) managing information system-related security risks is consistent across the organization, reflects organizational risk tolerance, and is considered along with organizational risks affecting mission/business success.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Risk Management

Risk Management: [FIPS 200, Adapted] The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, and includes: (i) establishing the context for risk-related activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time. Risk Monitoring Maintaining ongoing awareness of an organization's risk environment, risk management program, and associated activities to support risk decisions.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Risk Response

Risk Response: [NIST SP 800-39] Accepting, avoiding, mitigating, sharing, or transferring risk to organizational operations (mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Risk Tolerance

Risk Tolerance: [NISTIR 7298] The level of risk an entity is willing to assume in order to achieve a potential desired result.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Safeguards

Safeguards: [CNSSI 4009] Protective measures prescribed to meet the security requirements (i.e., confidentiality, integrity, and availability) specified for an information system. Safeguards may include security features, management constraints, personnel security, and security of physical structures, areas, and devices. Synonymous with security controls and countermeasures. Security Authorization See Authorization. Security Automation Domain An information security area that includes a grouping of tools, technologies, and data.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Categorization

Security Categorization: [CNSSI 1253, FIPS 199] The process of determining the security category for information or an information system. Security categorization methodologies are described in CNSS Instruction 1253 for national security systems and in FIPS 199 for other than national security systems.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Control Assessment

Security Control Assessment: [CNSSI 4009, Adapted] The testing and/or evaluation of the management, operational, and technical security controls in an information system to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Control Assessor

Security Control Assessor: [NISTIR 7298] The individual, group, or organization responsible for conducting a security control assessment.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Control Baseline

Security Control Baseline: [FIPS 200, Adapted] One of the sets of minimum security controls defined for federal information systems in NIST Special Publication 800-53 and CNSS Instruction 1253. Security Control Effectiveness The measure of correctness of implementation (i.e., how consistently the control implementation complies with the security plan) and how well the security plan meets organizational needs in accordance with current risk tolerance.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Control Inheritance

Security Control Inheritance: [CNSSI 4009] A situation in which an information system or application receives protection from security controls (or portions of security controls) that are developed, implemented, assessed, authorized, and monitored by entities other than those responsible for the system or application; entities either internal or external to the organization where the system or application resides. See Common Control.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Controls

Security Controls: [FIPS 199] The management, operational, and technical controls (i.e., safeguards or countermeasures) prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Domain

Security Domain: [CNSSI 4009] A domain that implements a security policy and is administered by a single authority.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Impact Analysis

Security Impact Analysis: [NIST SP 800-53] The analysis conducted by an organizational official to determine the extent to which changes to the information system have affected the security state of the system. Security Incident See Incident.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Management Dashboard

Security Management Dashboard: [NIST SP 800-128] A tool that consolidates and communicates information relevant to the organizational security posture in near real-time to security management stakeholders.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Plan

Security Plan: [NISTIR 7298] Formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements. See System Security Plan or Information Security Program Plan.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Policy

Security Policy: [CNSSI 4009] A set of criteria for the provision of security services.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Posture

Security Posture: [CNSSI 4009] The security status of an organization's networks, information, and systems based on IA resources (e.g., people, hardware, software, policies) and capabilities in place to manage the defense of the organization and to react as the situation changes.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Security Requirements

Security Requirements: [FIPS 200] Requirements levied on an information system that are derived from applicable laws, Executive Orders, directives, policies, standards, instructions, regulations, procedures, or organizational mission/business case needs to ensure the confidentiality, integrity, and availability of the information being processed, stored, or transmitted. Security Status See Security Posture.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Senior (Agency) Information Security Officer (SISO)

Senior (Agency) Information Security Officer (SISO): [44 U.S.C., Sec. 3544] Official responsible for carrying out the Chief Information Officer responsibilities under the Federal Information Security Management Act (FISMA) and serving as the Chief Information Officer's primary liaison to the agency's authorizing officials, information system owners, and information system security officers. [Note: Organizations subordinate to federal agencies may use the term Senior Information Security Officer or Chief Information Security Officer to denote individuals filling positions with similar responsibilities to Senior Agency Information Security Officers.] Senior Information Security Officer See Senior Agency Information Security Officer.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Specification

Specification: [NISTIR 7298] An assessment object that includes document-based artifacts (e.g., policies, procedures, plans, system security requirements, functional specifications, and architectural designs) associated with an information system. Status Monitoring Monitoring the information security metrics defined by the organization in the information security ISCM strategy.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Subsystem

Subsystem: [NISTIR 7298] A major subdivision of an information system consisting of information, information technology, and personnel that performs one or more specific functions. System See Information System.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > System Development Life Cycle (SDLC)

System Development Life Cycle (SDLC): [CNSSI 4009] The scope of activities associated with a system, encompassing the system's initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > System Development Life Cycle (SDLC)

System Development Life Cycle (SDLC): [CNSSI 4009, Adapted] The scope of activities associated with a system, encompassing the system's initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > System Security Plan

System Security Plan: [FIPS 200] Formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > System-Specific Security Control

System-Specific Security Control: [CNSSI 4009] A security control for an information system that has not been designated as a common security control or the portion of a hybrid control that is to be implemented within an information system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Tailoring

Tailoring: [CNSSI 4009] The process by which a security control baseline is modified based on: (i) the application of scoping guidance; (ii) the specification of compensating security controls, if needed; and (iii) the specification of organization-defined parameters in the security controls via explicit assignment and selection statements.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Technical Controls

Technical Controls: [FIPS 200] The security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Test

Test: [NISTIR 7298] A type of assessment method that is characterized by the process of exercising one or more assessment objects under specified conditions to compare actual with expected behavior, the results of which are used to support the determination of security control effectiveness over time.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > the Department of Homeland Security.] Risk Assessment

the Department of Homeland Security.] Risk Assessment: [CNSSI 4009] The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management, incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Threat

Threat: [CNSSI 4009, Adapted] Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Threat Information

Threat Information: [CNSSI 4009, Adapted] Analytical insights into trends, technologies, or tactics of an adversarial nature affecting information systems security.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Threat Source

Threat Source: [FIPS 200] The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. Synonymous with threat agent.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Vulnerability

Vulnerability: [CNSSI 4009] Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source.
Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations
APPENDIX > GLOSSARY > Vulnerability Assessment

Vulnerability Assessment: [CNSSI 4009] Formal description and evaluation of the vulnerabilities in an information system. White Box Testing See Comprehensive Testing.