CASp flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FIPS 199

Federal Information Processing Standard that defines security categorization of information and information systems using confidentiality, integrity, and availability impact levels of low, moderate, or high.

High-water mark

The overall security category of an information system is the highest impact level among confidentiality, integrity, and availability; for example, moderate confidentiality and high availability yields an overall high category.

NIST SP 800-60

Guidance volumes that map information types to provisional confidentiality, integrity, and availability impact levels to support FIPS 199 categorization of federal information systems.

Security category

A label such as low, moderate, or high assigned to an information system based on the potential adverse impact of a security breach, used to select an appropriate control baseline.

Control baseline

A pre-defined set of security controls from NIST SP 800-53B corresponding to a system's low, moderate, or high security category, serving as the starting point for control selection.

Tailoring

The process of adjusting a security control baseline by applying scoping guidance, selecting compensating controls, and assigning organization-defined parameter values to fit a specific system.

Overlay

A set of additional or modified security controls applied on top of a baseline to address specific community, technology, or risk needs, such as privacy or cloud overlays.

Common controls

Security controls implemented by an organization and inherited by multiple information systems, documented by a common control provider and referenced in each system security plan.

Compensating control

An alternative security measure implemented when a baseline control cannot be applied, providing equivalent or comparable protection and documented with justification in the system security plan.

System security plan

The document that describes the system boundary, categorization, selected controls, implementation details, and responsible parties for an information system.

Implementation status

A designation in the system security plan indicating whether a control is implemented, partially implemented, planned, alternatively implemented, or not applicable.

Plan of action and milestones

A management document that records identified security weaknesses, planned remediation actions, responsible parties, and scheduled completion dates for each finding.

Security assessment report

The document that records the results of a security control assessment, including findings, evidence, severity, and recommendations for remediation.

Examine, interview, test

The three assessment methods defined in NIST SP 800-53A: reviewing artifacts, discussing with personnel, and exercising controls to determine effectiveness.

Assessment procedure

A detailed set of steps in NIST SP 800-53A that specifies the examine, interview, and test activities used to determine whether a security control is effective.

Independent assessor

An individual or organization not responsible for implementing the controls who conducts an objective security assessment to support authorization decisions.

Authorization to operate

A formal, time-bound decision by an authorizing official to accept the risk of operating an information system based on the authorization package.

Authorizing official

A senior official with the authority to formally accept the risk of operating an information system and to grant, condition, or deny authorization.

Interim authorization to test

A time-limited authorization that permits testing of a system in a specified environment before a full authorization to operate is granted.

Authorization package

The set of documents, typically including the system security plan, security assessment report, and plan of action and milestones, used by the authorizing official to make a risk decision.

Continuous monitoring

An ongoing process that maintains awareness of an information system's security posture through automated and manual assessments, reporting, and response to findings.

NIST SP 800-137

Guidance that defines the continuous monitoring process, including strategy development, program establishment, implementation, analysis, response, and review.

Continuous diagnostics and mitigation

A set of automated tools and processes that continuously monitor endpoint configurations, vulnerabilities, and events to support risk-based decision making.

Significant change

A modification to an information system or its environment that may affect its security posture and therefore triggers reassessment and possible reauthorization.

Risk tolerance

The level of risk an organization is willing to accept in pursuit of its objectives, used to guide risk response decisions and authorization.

Risk response

The decision to accept, avoid, mitigate, transfer, or share risk, selected based on the organization's risk tolerance and cost-benefit analysis.

Risk assessment

The process of identifying threats and vulnerabilities, determining likelihood and impact, and estimating risk to inform risk response decisions.

Risk framing

The part of risk management that establishes the organization's assumptions, constraints, priorities, and risk tolerance before assessments are conducted.

NIST SP 800-39

Guidance on managing information security risk at the organization, mission, and system tiers through framing, assessing, responding, and monitoring activities.

NIST RMF

The Risk Management Framework from NIST SP 800-37 that integrates security and privacy activities into a six-step lifecycle from categorization through continuous monitoring.

Security control

A safeguard or countermeasure prescribed to protect the confidentiality, integrity, and availability of an information system and its information.

Control family

A grouping of related security controls in NIST SP 800-53, such as access control, audit and accountability, or incident response.