NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

NIST IR 7298 Revision 1, Glossary of Key Information Security Terms
Software program that performs a specific function directly for a user
and can be executed without access to system control, monitoring, or
administrative privileges.
SOURCE: CNSSI-4009
Approval to Operate (ATO) – The official management decision issued by a DAA or PAA to
authorize operation of an information system and to explicitly accept
the residual risk to agency operations (including mission, functions,
image, or reputation), agency assets, or individuals.
SOURCE: CNSSI-4009
Approved – Federal Information Processing Standard (FIPS)-approved or
National Institute of Standards and Technology (NIST)recommended.
An algorithm or technique that is either
1) specified in a FIPS or NIST Recommendation, or
2) adopted in a FIPS or NIST Recommendation.
SOURCE: FIPS 201
Approved – FIPS-approved and/or NIST-recommended.
SOURCE: FIPS 140-2
FIPS-approved and/or NIST-recommended. An algorithm or
technique that is either 1) specified in a FIPS or NIST
Recommendation, 2) adopted in a FIPS or NIST
Recommendation, or 3) specified in a list of NIST-approved
security functions.
SOURCE: FIPS 186
Approved Mode of Operation – A mode of the cryptographic module that employs only Approved
security functions (not to be confused with a specific mode of an
Approved security function, e.g., Data Encryption Standard Cipher-
Block Chaining (DES CBC) mode).
SOURCE: FIPS 140-2
Approved Security Function – A security function (e.g., cryptographic algorithm, cryptographic key
management technique, or authentication technique) that is either
a) specified in an Approved Standard;
b) adopted in an Approved Standard and specified either in an
appendix of the Approved Standard or in a document
referenced by the Approved Standard; or
c) specified in the list of Approved security functions.
SOURCE: FIPS 140-2
Assessment – See Security Control Assessment.
Pg 10