ezesecops/rmf-ato-core huggingface dataset:
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > specification

specification: [IEEE 610.12] A document that specifies, in a complete, precise, verifiable manner, the requirements, design, behavior, or other characteristics of a system or component and often the procedures for determining whether these provisions have been satisfied. See specification requirement.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > specification requirement

specification requirement: A type of requirement that provides a specification for a specific capability that implements all or part of a control and that may be assessed (i.e., as part of the verification, validation, testing, and evaluation processes).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > statement of work requirement

statement of work requirement: A type of requirement that represents an action that is performed operationally or during system development.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > subsystem

subsystem: A major subdivision or element of an information system consisting of information, information technology, and personnel that performs one or more specific functions.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > supply chain

supply chain: [OMB A-130] Linked set of resources and processes between multiple tiers of developers that begins with the sourcing of products and services and extends through the design, development, manufacturing, processing, handling, and delivery of products and services to the acquirer.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > supply chain risk

supply chain risk: [OMB A-130] Risks that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > supply chain risk management

supply chain risk management: [OMB A-130] The process of identifying, assessing, and mitigating the risks associated with the global and distributed nature of information and communications technology product and service supply chains.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system

system: [CNSSI 4009] [ISO 15288] Any organized assembly of resources and procedures united and regulated by interaction or interdependence to accomplish a set of specific functions. See information system. Note: Systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems. Combination of interacting elements organized to achieve one or more stated purposes. Note 1: There are many types of systems. Examples include: general and special-purpose information systems; command, control, and communication systems; crypto modules; central processing unit and graphics processor boards; industrial/process control systems; flight control systems; weapons, targeting, and fire control systems; medical devices and treatment systems; financial, banking, and merchandising transaction systems; and social networking systems. Note 2: The interacting elements in the definition of system include hardware, software, data, humans, processes, facilities, materials, and naturally occurring physical entities. Note 3: System of systems is included in the definition of system.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system component

system component: [SP 800-128] A discrete identifiable information technology asset that represents a building block of a system and may include hardware, software, and firmware.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system development life cycle

system development life cycle: The scope of activities associated with a system, encompassing the system's initiation, development and acquisition, implementation, operation and maintenance, and ultimately its disposal that instigates another system initiation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system element

system element: [ISO 15288] Member of a set of elements that constitute a system. Note 1: A system element can be a discrete component, product, service, subsystem, system, infrastructure, or enterprise. Note 2: Each element of the system is implemented to fulfill specified requirements. Note 3: The recursive nature of the term allows the term system to apply equally when referring to a discrete component or to a large, complex, geographically distributed system-of-systems. Note 4: System elements are implemented by: hardware, software, and firmware that perform operations on data/information; physical structures, devices, and components in the environment of operation; and the people, processes, and procedures for operating, sustaining, and supporting the system elements. Note 5: System elements and information resources (as defined at 44 U.S.C. Sec. 3502 and in this document) are interchangeable terms as used in this document.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system privacy officer

system privacy officer: Individual with assigned responsibility for maintaining the appropriate operational privacy posture for a system or program.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system-related privacy risk

system-related privacy risk: [OMB A-130] Risk to an individual or individuals associated with the agency's creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal of their PII. See risk.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system-related security risk

system-related security risk: [SP 800-30] Risk that arises through the loss of confidentiality, integrity, or availability of information or systems and that considers impacts to the organization (including assets, mission, functions, image, or reputation), individuals, other organizations, and the Nation. See risk.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system security officer

system security officer: Individual with assigned responsibility for maintaining the appropriate operational security posture for an information system or program.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system-specific control

system-specific control: [OMB A-130] A security or privacy control for an information system that is implemented at the system level and is not inherited by any other information system.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > system user

system user: Individual, or (system) process acting on behalf of an individual, authorized to access a system.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > systems privacy engineer

systems privacy engineer: Individual assigned responsibility for conducting systems privacy engineering activities.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > systems privacy engineering

systems privacy engineering: Process that captures and refines privacy requirements and ensures their integration into information technology component products and information systems through purposeful privacy design or configuration.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > systems security engineer

systems security engineer: Individual assigned responsibility for conducting systems security engineering activities.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > systems security engineering

systems security engineering: Process that captures and refines security requirements and ensures their integration into information technology component products and information systems through purposeful security design or configuration.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > tailored control baseline

tailored control baseline: A set of controls resulting from the application of tailoring guidance to a control baseline. See tailoring.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > tailoring

tailoring: [OMB A-130] The process by which security control baselines are modified by identifying and designating common controls; applying scoping considerations; selecting compensating controls; assigning specific values to agency-defined control parameters; supplementing baselines with additional controls or control enhancements; and providing additional specification information for control implementation. The tailoring process may also be applied to privacy controls.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > threat

threat: [SP 800-30] Any circumstance or event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through a system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > threat source

threat source: [FIPS 200] The intent and method targeted at the intentional exploitation of a vulnerability or a situation and method that may accidentally trigger a vulnerability. See threat agent.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > trustworthiness

trustworthiness: [CNSSI 4009] The attribute of a person or enterprise that provides confidence to others of the qualifications, capabilities, and reliability of that entity to perform specific tasks and fulfill assigned responsibilities.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > trustworthiness

trustworthiness: (system) The degree to which an information system (including the information technology components that are used to build the system) can be expected to preserve the confidentiality, integrity, and availability of the information being processed, stored, or transmitted by the system across the full range of threats and individuals' privacy.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > trustworthy information system

trustworthy information system: [OMB A-130] An information system that is believed to be capable of operating within defined levels of risk despite the environmental disruptions, human errors, structural failures, and purposeful attacks that are expected to occur in its environment of operation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > vulnerability

vulnerability: [CNSSI 4009] Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source. Note: The term weakness is synonymous for deficiency. Weakness may result in security and/or privacy risks.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
APPENDIX > GLOSSARY > vulnerability assessment

vulnerability assessment: [CNSSI 4009] Systematic examination of an information system or product to determine the adequacy of security measures, identify security deficiencies, provide data from which to predict the effectiveness of proposed security measures, and confirm the adequacy of such measures after implementation.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER ONE > 1.1 BACKGROUND

1.1 BACKGROUND

NIST in its partnership with the Department of Defense, the Office of the Director of National
Intelligence, and the Committee on National Security Systems, developed a Risk Management
Framework (RMF) to improve information security, strengthen risk management processes, and
encourage reciprocity9 among organizations. In July 2016, the Office of Management and
Budget (OMB) revised Circular A-130 to include responsibilities for privacy programs under the
RMF.
The RMF emphasizes risk management by promoting the development of security and privacy
capabilities into information systems throughout the system development life cycle (SDLC);10 by
maintaining situational awareness of the security and privacy posture of those systems on an
ongoing basis through continuous monitoring processes; and by providing information to senior
leaders and executives to facilitate decisions regarding the acceptance of risk to organizational
operations and assets, individuals, other organizations, and the Nation arising from the use and
operation of their systems. The RMF:
•
Provides a repeatable process designed to promote the protection of information and
information systems commensurate with risk;
•
Emphasizes organization-wide preparation necessary to manage security and privacy risks;
8 SCRM requirements are promulgated in [OMB A-130], [DODI 5200.44], and for national security systems in [CNSSD
505]. SCRM requirements have also been addressed by the Federal SCRM Policy Coordinating Committee.
9 Reciprocity is an agreement between organizations to accept one another's security assessment results in order to
reuse system resources or to accept each other's assessed security posture in order to share information.
10 [SP 800-64] and [SP 800-160 v1] provide guidance on security considerations in the SDLC.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER ONE > 1.2 PURPOSE AND APPLICABILITY

1.2 PURPOSE AND APPLICABILITY

This publication describes the RMF and provides guidelines for managing security and privacy
risks and applying the RMF to information systems and organizations. The guidelines have been
developed:
•
To ensure that managing system-related security and privacy risk is consistent with the
mission and business objectives of the organization and risk management strategy
established by the senior leadership through the risk executive (function);
•
To achieve privacy protections for individuals and security protections for information and
information systems through the implementation of appropriate risk response strategies;
•
To support consistent, informed, and ongoing authorization decisions,16 reciprocity, and the
transparency and traceability of security and privacy information;
11 Chapter 3 describes the seven steps and associated tasks in the RMF.
12 Section 2.6 describes the relationship between requirements and controls with respect to RMF execution.
13 [OMB FEA] provides guidance on the Federal Enterprise Architecture.
14 [OMB M-17-25] provides guidance on risk management roles and responsibilities.
15 IT resources refer to the information technology component of information resources defined in [OMB A-130].
16 [SP 800-137] provides guidance on information security continuous monitoring supporting ongoing authorization.
Future publications will address privacy continuous monitoring.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER ONE > 1.3 TARGET AUDIENCE

1.3 TARGET AUDIENCE

This publication serves individuals associated with the design, development, implementation,
assessment, operation, maintenance, and disposition of information systems including:
•
Individuals with mission or business ownership responsibilities or fiduciary responsibilities
(e.g., and heads of federal agencies);
•
Individuals with information system, information security, or privacy management,
oversight, or governance responsibilities (e.g., senior leaders, risk executives, authorizing
officials, chief information officers, senior agency information security officers, and senior
agency officials for privacy);
•
Individuals responsible for conducting security or privacy assessments and for monitoring
information systems, for example, control assessors, auditors, and system owners;
•
Individuals with security or privacy implementation and operational responsibilities, for
example, system owners, common control providers, information owners/stewards, mission
or business owners, security or privacy architects, and systems security or privacy engineers;
•
Individuals with information system development and acquisition responsibilities (e.g.,
program managers, procurement officials, component product and system developers,
systems integrators, and enterprise architects); and
17 [SP 800-160 v1] provides guidance on systems security engineering and building trustworthy, secure systems.
18 [EO 13800] directs federal agencies to use the [NIST CSF] to manage cybersecurity risk.
19 The term organization is used in this publication to describe an entity of any size, complexity, or positioning within
an organizational structure (e.g., a federal agency or, as appropriate, any of its operational elements).
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > 2.1 ORGANIZATION-WIDE RISK MANAGEMENT

2.1 ORGANIZATION-WIDE RISK MANAGEMENT

Managing information system-related security and privacy risk is a complex undertaking that
requires the involvement of the entire organization-from senior leaders providing the strategic
vision and top-level goals and objectives for the organization, to mid-level leaders planning,
executing, and managing projects, to individuals developing, implementing, operating, and
maintaining the systems supporting the organization's missions and business functions. Risk
management is a holistic activity that affects every aspect of the organization including the
mission and business planning activities, the enterprise architecture, the SDLC processes, and
the systems engineering activities that are integral to those system life cycle processes. Figure 1
illustrates a multi-level approach to risk management described in [SP 800-39] that addresses
security and privacy risk at the organization level, the mission/business process level, and the
information system level. Communication and reporting are bi-directional information flows
across the three levels to ensure that risk is addressed throughout the organization.
FIGURE 1: ORGANIZATION-WIDE RISK MANAGEMENT APPROACH
T
LEVEL ONE
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > 2.2 RISK MANAGEMENT FRAMEWORK STEPS AND STRUCTURE

2.2 RISK MANAGEMENT FRAMEWORK STEPS AND STRUCTURE

There are seven steps in the RMF; a preparatory step to ensure that organizations are ready to
execute the process and six main steps. All seven steps are essential for the successful execution
of the RMF. The steps are:
•
Prepare to execute the RMF from an organization- and a system-level perspective by
establishing a context and priorities for managing security and privacy risk.
•
Categorize the system and the information processed, stored, and transmitted by the
system based on an analysis of the impact of loss.26
24 Controls can be allocated at all three levels in the risk management hierarchy. For example, common controls may
be allocated at the organization, mission/business process, or information system level.
25 [SP 800-160 v1] provides guidance on requirements engineering and traceability.
26 Impact of loss is one of four risk factors considered during risk assessment activities-the other three factors being
threats, vulnerabilities, and likelihood of occurrence [SP 800-30]. Organizations leverage risk assessment results when
categorizing information and systems. For national security systems, it may be important to consider specific issues
affecting risk factors as part of categorization, such as, whether the system processes, stores, or transmits classified
or intelligence information; whether the system will be accessed directly or indirectly by non-U.S. personnel; and
whether the information processed, stored, or transmitted by the system will cross security domains. [CNSSI 1253]
provides additional information on categorizing national security systems.
Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
CHAPTER TWO > 2.3 INFORMATION SECURITY AND PRIVACY IN THE RMF

2.3 INFORMATION SECURITY AND PRIVACY IN THE RMF

Executing the RMF requires close collaboration between information security programs and
privacy programs. While information security programs and privacy programs have different
objectives, those objectives are overlapping and complementary. Information security programs
are responsible for protecting information and information systems from unauthorized access,
use, disclosure, disruption, modification, or destruction (i.e., unauthorized system activity or
behavior) in order to provide confidentiality, integrity, and availability. Privacy programs are
responsible for ensuring compliance with applicable privacy requirements and for managing the
risks to individuals associated with the creation, collection, use, processing, dissemination,
storage, maintenance, disclosure, or disposal (collectively referred to as "processing") of PII.30
When preparing to execute the steps of the RMF, organizations consider how to best promote
and institutionalize collaboration between the two programs to ensure that the objectives of
both disciplines are met at every step of the process.
30 Privacy programs may also choose to consider the risks to individuals that may arise from their interactions with
information systems, where the processing of PII may be less impactful than the effect the system has on individuals'
behavior or activities. Such effects would constitute risks to individual autonomy and organizations may need to take
steps to manage those risks in addition to information security and privacy risks.