NISTIR 7298 Revision 1, Glossary of Key Information Security Terms
NISTIR 7298 Revision 1, Glossary of Key Information Security Terms NISTIR 7298 Revision 1, Glossary of Key Information Security Terms
NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Contingency Plan – Management policy and procedures used to guide an enterprise response to a perceived loss of mission capability. The Contingency Plan is the first plan used by the enterprise risk managers to determine what happened, why, and what to do. It may point to the Continuity of Operations Plan (COOP) or Disaster Recovery Plan for major disruptions. SOURCE: CNSSI-4009 Continuity of Government (COG) – Continuity of Operations Plan – (COOP) See also Information System Contingency Plan. A coordinated effort within the federal government's executive branch to ensure that national essential functions continue to be performed during a catastrophic emergency. SOURCE: CNSSI-4009 A predetermined set of instructions or procedures that describe how an organization’s mission-essential functions will be sustained within 12 hours and for up to 30 days as a result of a disaster event before returning to normal operations. SOURCE: SP 800-34 Management policy and procedures used to guide an enterprise response to a major loss of enterprise capability or damage to its facilities. The COOP is the third plan needed by the enterprise risk managers and is used when the enterprise must recover (often at an alternate site) for a specified period of time. Defines the activities of individual departments and agencies and their sub-components to ensure that their essential functions are performed. This includes plans and procedures that delineate essential functions; specifies succession to office and the emergency delegation of authority; provide for the safekeeping of vital records and databases; identify alternate operating facilities; provide for interoperable communications, and validate the capability through tests, training, and exercises. See also Disaster Recovery Plan and Contingency Plan. SOURCE: CNSSI-4009 Continuous Monitoring – The process implemented to maintain a current security status for one or more information systems or for the entire suite of information systems on which the operational mission of the enterprise depends. The process includes: 1) he development of a strategy to regularly evaluate selected IA controls/metrics, 2) Recording and evaluating IA relevant events and the effectiveness of the enterprise in dealing with those events, 3) Recording changes to IA controls, or changes that affect IA risks, and 4) Publishing the current security status to enable information-sharing decisions involving the enterprise. SOURCE: CNSSI-4009 Pg 46
NIST IR 7298 Revision 1, Glossary of Key Information Security Terms Control Information – Information that is entered into a cryptographic module for the purposes of directing the operation of the module. SOURCE: FIPS 140-2 Controlled Access Area – Physical area (e.g., building, room, etc.) to which only authorized personnel are granted unrestricted access. All other personnel are either escorted by authorized personnel or are under continuous surveillance. SOURCE: CNSSI-4009 Controlled Access Protection – Minimum set of security functionality that enforces access control on individual users and makes them accountable for their actions through login procedures, auditing of security-relevant events, and resource isolation. SOURCE: CNSSI-4009 Controlled Area – Any area or space for which the organization has confidence that the physical and procedural protections provided are sufficient to meet the requirements established for protecting the information and/or information system. SOURCE: SP 800-53 Controlled Cryptographic Item – (CCI) Controlled Cryptographic Item (CCI) Assembly – Controlled Cryptographic Item (CCI) Component – Controlled Cryptographic Item (CCI) Equipment – Secure telecommunications or information system, or associated cryptographic component, that is unclassified and handled through the COMSEC Material Control System (CMCS), an equivalent material control system, or a combination of the two that provides accountability and visibility. Such items are marked “Controlled Cryptographic Item,” or, where space is limited, “CCI”. SOURCE: CNSSI-4009 Device embodying a cryptographic logic or other COMSEC design that NSA has approved as a Controlled Cryptographic Item (CCI). It performs the entire COMSEC function, but depends upon the host equipment to operate. SOURCE: CNSSI-4009 Part of a Controlled Cryptographic Item (CCI) that does not perform the entire COMSEC function but depends upon the host equipment, or assembly, to complete and operate the COMSEC function. SOURCE: CNSSI-4009 Telecommunications or information handling equipment that embodies a Controlled Cryptographic Item (CCI) component or CCI assembly and performs the entire COMSEC function without dependence on host equipment to operate. SOURCE: CNSSI-4009 Pg 47
- Page 2 and 3: NIST IR 7298 Revision 1 Glossary of
- Page 4 and 5: NIST IR 7298 Revision 1, Glossary o
- Page 6 and 7: NIST IR 7298 Revision 1, Glossary o
- Page 8 and 9: NIST IR 7298 Revision 1, Glossary o
- Page 10 and 11: NIST IR 7298 Revision 1, Glossary o
- Page 12 and 13: NIST IR 7298 Revision 1, Glossary o
- Page 14 and 15: NIST IR 7298 Revision 1, Glossary o
- Page 16 and 17: NIST IR 7298 Revision 1, Glossary o
- Page 18 and 19: NIST IR 7298 Revision 1, Glossary o
- Page 20 and 21: NIST IR 7298 Revision 1, Glossary o
- Page 22 and 23: NIST IR 7298 Revision 1, Glossary o
- Page 24 and 25: NIST IR 7298 Revision 1, Glossary o
- Page 26 and 27: NIST IR 7298 Revision 1, Glossary o
- Page 28 and 29: NIST IR 7298 Revision 1, Glossary o
- Page 30 and 31: NIST IR 7298 Revision 1, Glossary o
- Page 32 and 33: NIST IR 7298 Revision 1, Glossary o
- Page 34 and 35: NIST IR 7298 Revision 1, Glossary o
- Page 36 and 37: NIST IR 7298 Revision 1, Glossary o
- Page 38 and 39: NIST IR 7298 Revision 1, Glossary o
- Page 40 and 41: NIST IR 7298 Revision 1, Glossary o
- Page 42 and 43: NIST IR 7298 Revision 1, Glossary o
- Page 44 and 45: NIST IR 7298 Revision 1, Glossary o
- Page 48 and 49: NIST IR 7298 Revision 1, Glossary o
- Page 50 and 51: NIST IR 7298 Revision 1, Glossary o
- Page 52 and 53: NIST IR 7298 Revision 1, Glossary o
- Page 54 and 55: NIST IR 7298 Revision 1, Glossary o
- Page 56 and 57: NIST IR 7298 Revision 1, Glossary o
- Page 58 and 59: NIST IR 7298 Revision 1, Glossary o
- Page 60 and 61: NIST IR 7298 Revision 1, Glossary o
- Page 62 and 63: NIST IR 7298 Revision 1, Glossary o
- Page 64 and 65: NIST IR 7298 Revision 1, Glossary o
- Page 66 and 67: NIST IR 7298 Revision 1, Glossary o
- Page 68 and 69: NIST IR 7298 Revision 1, Glossary o
- Page 70 and 71: NIST IR 7298 Revision 1, Glossary o
- Page 72 and 73: NIST IR 7298 Revision 1, Glossary o
- Page 74 and 75: NIST IR 7298 Revision 1, Glossary o
- Page 76 and 77: NIST IR 7298 Revision 1, Glossary o
- Page 78 and 79: NIST IR 7298 Revision 1, Glossary o
- Page 80 and 81: NIST IR 7298 Revision 1, Glossary o
- Page 82 and 83: NIST IR 7298 Revision 1, Glossary o
- Page 84 and 85: NIST IR 7298 Revision 1, Glossary o
- Page 86 and 87: NIST IR 7298 Revision 1, Glossary o
- Page 88 and 89: NIST IR 7298 Revision 1, Glossary o
- Page 90 and 91: NIST IR 7298 Revision 1, Glossary o
- Page 92 and 93: NIST IR 7298 Revision 1, Glossary o
- Page 94 and 95: NIST IR 7298 Revision 1, Glossary o
NIST IR <strong>7298</strong> <strong>Revision</strong> 1, <strong>Glossary</strong> <strong>of</strong> <strong>Key</strong> <strong>Information</strong> <strong>Security</strong> <strong>Terms</strong><br />
Contingency Plan – Management policy and procedures used to guide an enterprise<br />
response to a perceived loss <strong>of</strong> mission capability. The Contingency<br />
Plan is the first plan used by the enterprise risk managers to<br />
determine what happened, why, and what to do. It may point to the<br />
Continuity <strong>of</strong> Operations Plan (COOP) or Disaster Recovery Plan for<br />
major disruptions.<br />
SOURCE: CNSSI-4009<br />
Continuity <strong>of</strong> Government (COG) –<br />
Continuity <strong>of</strong> Operations Plan –<br />
(COOP)<br />
See also <strong>Information</strong> System Contingency Plan.<br />
A coordinated effort within the federal government's executive<br />
branch to ensure that national essential functions continue to be<br />
performed during a catastrophic emergency.<br />
SOURCE: CNSSI-4009<br />
A predetermined set <strong>of</strong> instructions or procedures that describe how<br />
an organization’s mission-essential functions will be sustained within<br />
12 hours and for up to 30 days as a result <strong>of</strong> a disaster event before<br />
returning to normal operations.<br />
SOURCE: SP 800-34<br />
Management policy and procedures used to guide an enterprise<br />
response to a major loss <strong>of</strong> enterprise capability or damage to its<br />
facilities. The COOP is the third plan needed by the enterprise risk<br />
managers and is used when the enterprise must recover (<strong>of</strong>ten at an<br />
alternate site) for a specified period <strong>of</strong> time. Defines the activities <strong>of</strong><br />
individual departments and agencies and their sub-components to<br />
ensure that their essential functions are performed. This includes<br />
plans and procedures that delineate essential functions; specifies<br />
succession to <strong>of</strong>fice and the emergency delegation <strong>of</strong> authority;<br />
provide for the safekeeping <strong>of</strong> vital records and databases; identify<br />
alternate operating facilities; provide for interoperable<br />
communications, and validate the capability through tests, training,<br />
and exercises. See also Disaster Recovery Plan and Contingency<br />
Plan.<br />
SOURCE: CNSSI-4009<br />
Continuous Monitoring – The process implemented to maintain a current security status for one<br />
or more information systems or for the entire suite <strong>of</strong> information<br />
systems on which the operational mission <strong>of</strong> the enterprise depends.<br />
The process includes: 1) he development <strong>of</strong> a strategy to regularly<br />
evaluate selected IA controls/metrics, 2) Recording and evaluating IA<br />
relevant events and the effectiveness <strong>of</strong> the enterprise in dealing with<br />
those events, 3) Recording changes to IA controls, or changes that<br />
affect IA risks, and 4) Publishing the current security status to enable<br />
information-sharing decisions involving the enterprise.<br />
SOURCE: CNSSI-4009<br />
Pg 46