ezesecops/rmf-ato-core huggingface dataset:
Guide for Conducting Risk Assessments
APPENDIX B

Tailoring
[NIST SP 800-53, CNSSI No. 4009]
The process by which a security control baseline is
modified based on: (i) the application of scoping
guidance; (ii) the specification of compensating security
controls, if needed; and (iii) the specification of
organization-defined parameters in the security controls
via explicit assignment and selection statements.
Tailored Security Control Baseline
[NIST SP 800-39]
A set of security controls resulting from the application
of tailoring guidance to the security control baseline. See
Tailoring.
Technical Controls
[FIPS 200]
Security controls (i.e., safeguards or countermeasures) for
an information system that are primarily implemented
and executed by the information system through
mechanisms contained in the hardware, software, or
firmware components of the system.
Threat
[CNSSI No.4009]
Any circumstance or event with the potential to adversely
impact organizational operations (including mission,
functions, image, or reputation), organizational assets,
individuals, other organizations, or the Nation through an
information system via unauthorized access, destruction,
disclosure, or modification of information, and/or denial
of service.
Threat Assessment
[CNSSI No. 4009]
Process of formally evaluating the degree of threat to an
information system or enterprise and describing the
nature of the threat.
Threat Event
An event or situation that has the potential for causing
undesirable consequences or impact.
Threat Scenario
A set of discrete threat events, associated with a specific
threat source or multiple threat sources, partially ordered
in time. Synonym for Threat Campaign.
Threat Shifting
Response from adversaries to perceived safeguards
and/or countermeasures (i.e., security controls), in which
the adversaries change some characteristic of their intent
to do harm in order to avoid and/or overcome those
safeguards/countermeasures.
Threat Source
[CNSSI No. 4009]
The intent and method targeted at the intentional
exploitation of a vulnerability or a situation and method
that may accidentally exploit a vulnerability.
Vulnerability
[CNSSI No. 4009]
Weakness in an information system, system security
procedures, internal controls, or implementation that
could be exploited by a threat source.
Vulnerability Assessment
[CNSSI No. 4009]
Systematic examination of an information system or
product to determine the adequacy of security measures,
identify security deficiencies, provide data from which to
predict the effectiveness of proposed security measures,
and confirm the adequacy of such measures after
implementation.
Guide for Conducting Risk Assessments
APPENDIX B

Common Control Provider
[CNSSI No. 4009]
An organizational official responsible for the
development, implementation, assessment, and
monitoring of common controls (i.e., security controls
inherited by information systems).
Compensating Security Control
[CNSSI No. 4009]
A management, operational, and/or technical control (i.e.,
safeguard or countermeasure) employed by an
organization in lieu of a recommended security control in
the low, moderate, or high baselines that provides
equivalent or comparable protection for an information
system.
Confidentiality
[44 U.S.C., Sec. 3542]
Preserving authorized restrictions on information access
and disclosure, including means for protecting personal
privacy and proprietary information.
Course of Action
[NIST SP 800-39]
A time-phased or situation-dependent combination of risk
response measures. See Risk Response.
Critical Infrastructure
System and assets, whether physical or virtual, so vital to
the United States that the incapacity or destruction of
such systems and assets would have a debilitating impact
on security, national economic security, national public
health or safety, or any combination of those matters.
Critical Infrastructure Sectors
[HSPD-7]
Information technology; telecommunications; chemical;
transportation systems, including mass transit, aviation,
maritime, ground/surface, and rail and pipeline systems;
emergency services; and postal and shipping.
Criticality
[NIST SP 800-60]
A measure of the degree to which an organization
depends on the information or information system for the
success of a mission or of a business function.
Cyber Attack
[CNSSI No. 4009]
An attack, via cyberspace, targeting an enterprise's use of
cyberspace for the purpose of disrupting, disabling,
destroying, or maliciously controlling a computing
environment/infrastructure; or destroying the integrity of
the data or stealing controlled information.
Cyber Security
[CNSSI No. 4009]
The ability to protect or defend the use of cyberspace
from cyber attacks.
Cyberspace
[CNSSI No. 4009]
A global domain within the information environment
consisting of the interdependent network of information
systems infrastructures including the Internet,
telecommunications networks, computer systems, and
embedded processors and controllers.
Guide for Conducting Risk Assessments
APPENDIX B

Defense-in-Breadth
[CNSSI No. 4009]
A planned, systematic set of multidisciplinary activities
that seek to identify, manage, and reduce risk of
exploitable vulnerabilities at every stage of the system,
network, or subcomponent life cycle (system, network, or
product design and development; manufacturing;
packaging; assembly; system integration; distribution;
operations; maintenance; and retirement).
Defense-in-Depth
[CNSSI No. 4009]
Information security strategy integrating people,
technology, and operations capabilities to establish
variable barriers across multiple layers and missions of
the organization.
Enterprise
[CNSSI No. 4009]
An organization with a defined mission/goal and a
defined boundary, using information systems to execute
that mission, and with responsibility for managing its
own risks and performance. An enterprise may consist of
all or some of the following business aspects: acquisition,
program management, financial management (e.g.,
budgets), human resources, security, and information
systems, information and mission management. See
Organization.
Enterprise Architecture
[CNSSI No. 4009]
The description of an enterprise's entire set of
information systems: how they are configured, how they
are integrated, how they interface to the external
environment at the enterprise's boundary, how they are
operated to support the enterprise mission, and how they
contribute to the enterprise's overall security posture.
Environment of Operation
The physical, technical, and organizational setting in
which an information system operates, including but not
limited to: missions/business functions; mission/business
processes; threat space; vulnerabilities; enterprise and
information security architectures; personnel; facilities;
supply chain relationships; information technologies;
organizational governance and culture; acquisition and
procurement processes; organizational policies and
procedures; organizational assumptions, constraints, risk
tolerance, and priorities/trade-offs).
Executive Agency
[41 U.S.C., Sec. 403]
An executive department specified in 5 U.S.C., Sec. 101;
a military department specified in 5 U.S.C., Sec. 102; an
independent establishment as defined in 5 U.S.C., Sec.
104(1); and a wholly owned Government corporation
fully subject to the provisions of 31 U.S.C., Chapter 91.
Guide for Conducting Risk Assessments
APPENDIX B

Fault Tree Analysis
A top-down, deductive failure analysis in which an
undesired state of a system (top event) is analyzed using
Boolean logic to combine a series of lower-level events.
An analytical approach whereby an undesired state of a
system is specified and the system is then analyzed in the
context of its environment of operation to find all realistic
ways in which the undesired event (top event) can occur.
Federal Agency
See Executive Agency.
Federal Information
System
[40 U.S.C., Sec. 11331]
An information system used or operated by an executive
agency, by a contractor of an executive agency, or by
another organization on behalf of an executive agency.
Hybrid Security Control
[NIST SP 800-53]
A security control that is implemented in an information
system in part as a common control and in part as a
system-specific control. See Common Control and
System-Specific Security Control.
Impact Level
[CNSSI No. 4009]
The magnitude of harm that can be expected to result
from the consequences of unauthorized disclosure of
information, unauthorized modification of information,
unauthorized destruction of information, or loss of
information or information system availability.
Impact Value
[CNSSI No. 1253]
The assessed potential impact resulting from a
compromise of the confidentiality, integrity, or
availability of an information type, expressed as a value
of low, moderate, or high.
Industrial Control System
[NIST SP 800-39]
An information system used to control industrial
processes such as manufacturing, product handling,
production, and distribution. Industrial control systems
include supervisory control and data acquisition systems
used to control geographically dispersed assets, as well as
distributed control systems and smaller control systems
using programmable logic controllers to control localized
processes.
Information
[CNSSI No. 4009]
[FIPS 199]
Any communication or representation of knowledge such
as facts, data, or opinions in any medium or form,
including textual, numerical, graphic, cartographic,
narrative, or audiovisual.
An instance of an information type.
Information Owner
[CNSSI No. 4009]
Official with statutory or operational authority for
specified information and responsibility for establishing
the controls for its generation, classification, collection,
processing, dissemination, and disposal. See Information
Steward.
Information Resources
[44 U.S.C., Sec. 3502]
Information and related resources, such as personnel,
equipment, funds, and information technology.
Guide for Conducting Risk Assessments
APPENDIX B

Information Security
[44 U.S.C., Sec. 3542]
The protection of information and information systems
from unauthorized access, use, disclosure, disruption,
modification, or destruction in order to provide
confidentiality, integrity, and availability.
Information Security Architecture
[NIST SP 800-39]
A description of the structure and behavior for an
enterprise's security processes, information security
systems, personnel and organizational sub-units, showing
their alignment with the enterprise's mission and strategic
plans.
Information Security Program Plan
[NIST SP 800-53]
Formal document that provides an overview of the
security requirements for an organization-wide
information security program and describes the program
management controls and common controls in place or
planned for meeting those requirements.
Information Security Risk
The risk to organizational operations (including mission,
functions, image, reputation), organizational assets,
individuals, other organizations, and the Nation due to the
potential for unauthorized access, use, disclosure,
disruption, modification, or destruction of information
and/or information systems. See Risk.
Information Steward
[CNSSI No. 4009]
An agency official with statutory or operational authority
for specified information and responsibility for
establishing the controls for its generation, collection,
processing, dissemination, and disposal.
Information System
[44 U.S.C., Sec. 3502]
A discrete set of information resources organized for the
collection, processing, maintenance, use, sharing,
dissemination, or disposition of information.
Information System Boundary
See Authorization Boundary.
Information System Owner
(or Program Manager)
Official responsible for the overall procurement,
development, integration, modification, or operation and
maintenance of an information system.
Information System Resilience
The ability of an information system to continue to
operate while under attack, even if in a degraded or
debilitated state, and to rapidly recover operational
capabilities for essential functions after a successful
attack.
Information System
Security Officer
Individual assigned responsibility by the senior agency
information security officer, authorizing official,
management official, or information system owner for
maintaining the appropriate operational security posture
for an information system or program.
Guide for Conducting Risk Assessments
APPENDIX B

Information System-Related
Security Risk
Risk that arises through the loss of confidentiality,
integrity, or availability of information or information
systems considering impacts to organizational operations
and assets, individuals, other organizations, and the
Nation. A subset of Information Security Risk. See Risk.
Information Technology
[40 U.S.C., Sec. 1401]
Any equipment or interconnected system or subsystem of
equipment that is used in the automatic acquisition,
storage, manipulation, management, movement, control,
display, switching, interchange, transmission, or
reception of data or information by the executive agency.
For purposes of the preceding sentence, equipment is
used by an executive agency if the equipment is used by
the executive agency directly or is used by a contractor
under a contract with the executive agency which: (i)
requires the use of such equipment; or (ii) requires the
use, to a significant extent, of such equipment in the
performance of a service or the furnishing of a product.
The term information technology includes computers,
ancillary equipment, software, firmware, and similar
procedures, services (including support services), and
related resources.
Information Type
[FIPS 199]
A specific category of information (e.g., privacy,
medical, proprietary, financial, investigative, contractor
sensitive, security management) defined by an
organization or in some instances, by a specific law,
Executive Order, directive, policy, or regulation.
Integrity
[44 U.S.C., Sec. 3542]
Guarding against improper information modification or
destruction, and includes ensuring information non-
repudiation and authenticity.
Likelihood of Occurrence
[CNSSI No. 4009, adapted]
A weighted factor based on a subjective analysis of the
probability that a given threat is capable of exploiting a
given vulnerability or a set of vulnerabilities.
Management Controls
[FIPS 200]
The security controls (i.e., safeguards or
countermeasures) for an information system that focus on
the management of risk and the management of
information system security.
Mission/Business Segment
Elements of organizations describing mission areas,
common/shared business services, and organization-wide
services. Mission/business segments can be identified
with one or more information systems which collectively
support a mission/business process.
Guide for Conducting Risk Assessments
APPENDIX B

National Security System
[44 U.S.C., Sec. 3542]
Any information system (including any
telecommunications system) used or operated by an
agency or by a contractor of an agency, or other
organization on behalf of an agency (i) the function,
operation, or use of which involves intelligence activities;
involves cryptologic activities related to national security;
involves command and control of military forces;
involves equipment that is an integral part of a weapon or
weapons system; or is critical to the direct fulfillment of
military or intelligence missions (excluding a system that
is to be used for routine administrative and business
applications, for example, payroll, finance, logistics, and
personnel management applications); or (ii) is protected
at all times by procedures established for information that
have been specifically authorized under criteria
established by an Executive Order or an Act of Congress
to be kept classified in the interest of national defense or
foreign policy.
Operational Controls
[FIPS 200]
The security controls (i.e., safeguards or
countermeasures) for an information system that are
primarily implemented and executed by people (as
opposed to systems).
Organization
[FIPS 200, Adapted]
An entity of any size, complexity, or positioning within
an organizational structure (e.g., a federal agency or, as
appropriate, any of its operational elements). See
Enterprise.
Plan of Action and
Milestones
[OMB Memorandum 02-01]
A document that identifies tasks needing to be
accomplished. It details resources required to accomplish
the elements of the plan, any milestones in meeting the
tasks, and scheduled completion dates for the milestones.
Predisposing Condition
A condition that exists within an organization, a
mission/business process, enterprise architecture, or
information system including its environment of
operation, which contributes to (i.e., increases or
decreases) the likelihood that one or more threat events,
once initiated, will result in undesirable consequences or
adverse impact to organizational operations and assets,
individuals, other organizations, or the Nation.
Qualitative Assessment
[DHS Risk Lexicon]
Use of a set of methods, principles, or rules for assessing
risk based on nonnumerical categories or levels.
Quantitative Assessment
[DHS Risk Lexicon]
Use of a set of methods, principles, or rules for assessing
risks based on the use of numbers where the meanings
and proportionality of values are maintained inside and
outside the context of the assessment.
Repeatability
The ability to repeat an assessment in the future, in a
manner that is consistent with, and hence comparable to,
prior assessments.
Guide for Conducting Risk Assessments
APPENDIX B

Reproducibility
The ability of different experts to produce the same
results from the same data.
Residual Risk
[CNSSI No. 4009]
Portion of risk remaining after security measures have
been applied.
Risk
[CNSSI No. 4009]
A measure of the extent to which an entity is threatened
by a potential circumstance or event, and typically a
function of: (i) the adverse impacts that would arise if the
circumstance or event occurs; and (ii) the likelihood of
occurrence. See Information System-Related Security
Risk.
Risk Assessment
[NIST SP 800-39]
The process of identifying, estimating, and prioritizing
risks to organizational operations (including mission,
functions, image, reputation), organizational assets,
individuals, other organizations, and the Nation, resulting
from the operation of an information system.
Part of risk management, incorporates threat and
vulnerability analyses, and considers mitigations
provided by security controls planned or in place.
Synonymous with risk analysis.
Risk Assessment Methodology
A risk assessment process, together with a risk model,
assessment approach, and analysis approach.
Risk Assessment Report
The report which contains the results of performing a risk
assessment or the formal output from the process of
assessing risk.
Risk Assessor
The individual, group, or organization responsible for
conducting a risk assessment.
Risk Executive (Function)
[CNSSI No. 4009]
An individual or group within an organization that helps
to ensure that: (i) security risk-related considerations for
individual information systems, to include the
authorization decisions for those systems, are viewed
from an organization-wide perspective with regard to the
overall strategic goals and objectives of the organization
in carrying out its missions and business functions; and
(ii) managing risk from individual information systems is
consistent across the organization, reflects organizational
risk tolerance, and is considered along with other
organizational risks affecting mission/business success.
Risk Factor
A characteristic used in a risk model as an input to
determining the level of risk in a risk assessment.
Guide for Conducting Risk Assessments
APPENDIX B

Risk Management
[NIST SP 800-39]
[CNSSI No. 4009, adapted]
The program and supporting processes to manage
information security risk to organizational operations
(including mission, functions, image, reputation),
organizational assets, individuals, other organizations,
and the Nation, and includes: (i) establishing the context
for risk-related activities; (ii) assessing risk; (iii)
responding to risk once determined; and (iv) monitoring
risk over time.
Risk Mitigation
[CNSSI No. 4009]
Prioritizing, evaluating, and implementing the
appropriate risk-reducing controls/countermeasures
recommended from the risk management process. A
subset of Risk Response.
Risk Model
A key component of a risk assessment methodology (in
addition to assessment approach and analysis approach)
that defines key terms and assessable risk factors.
Risk Monitoring
[NIST SP 800-39]
Maintaining ongoing awareness of an organization's risk
environment, risk management program, and associated
activities to support risk decisions.
Risk Response
[NIST SP 800-39]
Accepting, avoiding, mitigating, sharing, or transferring
risk to organizational operations (i.e., mission, functions,
image, or reputation), organizational assets, individuals,
other organizations, or the Nation. See Course of Action.
Risk Response Measure
[NIST SP 800-39]
A specific action taken to respond to an identified risk.
Root Cause Analysis
A principle-based, systems approach for the identification
of underlying causes associated with a particular set of
risks.
Security Authorization
(to Operate)
See Authorization (to operate).
Security Categorization
The process of determining the security category for
information or an information system. Security
categorization methodologies are described in CNSSI
No.1253 for national security systems and in FIPS 199
for other than national security systems.
Security Control Assessment
[NIST SP 800-39]
[CNSSI No. 4009, Adapted]
The testing and/or evaluation of the management,
operational, and technical security controls to determine
the extent to which the controls are implemented
correctly, operating as intended, and producing the
desired outcome with respect to meeting the security
requirements for an information system or organization.
Security Control Assessor
The individual, group, or organization responsible for
conducting a security control assessment.
Guide for Conducting Risk Assessments
APPENDIX D

TABLE D-2: TAXONOMY OF THREAT SOURCES
Type of Threat Source
Description
Characteristics
ADVERSARIAL
- Individual
- Outsider
- Insider
- Trusted Insider
- Privileged Insider
- Group
- Ad hoc
- Established
- Organization
- Competitor
- Supplier
- Partner
- Customer
- Nation-State
Individuals, groups, organizations, or states that seek to
exploit the organization's dependence on cyber
resources (i.e., information in electronic form, information
and communications technologies, and the
communications and information-handling capabilities
provided by those technologies).
Capability, Intent, Targeting
ACCIDENTAL
- User
- Privileged User/Administrator
Erroneous actions taken by individuals in the course of
executing their everyday responsibilities.
Range of effects
STRUCTURAL
- Information Technology (IT) Equipment
- Storage
- Processing
- Communications
- Display
- Sensor
- Controller
- Environmental Controls
- Temperature/Humidity Controls
- Power Supply
- Software
- Operating System
- Networking
- General-Purpose Application
- Mission-Specific Application
Failures of equipment, environmental controls, or
software due to aging, resource depletion, or other
circumstances which exceed expected operating
parameters.
Range of effects
ENVIRONMENTAL
- Natural or man-made disaster
- Fire
- Flood/Tsunami
- Windstorm/Tornado
- Hurricane
- Earthquake
- Bombing
- Overrun
- Unusual Natural Event (e.g., sunspots)
- Infrastructure Failure/Outage
- Telecommunications
- Electrical Power
Natural disasters and failures of critical infrastructures on
which the organization depends, but which are outside
the control of the organization.
Note: Natural and man-made disasters can also be
characterized in terms of their severity and/or duration.
However, because the threat source and the threat event
are strongly identified, severity and duration can be
included in the description of the threat event (e.g.,
Category 5 hurricane causes extensive damage to the
facilities housing mission-critical systems, making those
systems unavailable for three weeks).
Range of effects