CAP (The American College Credentials) key terms

A structured six-step process for selecting, implementing, assessing, authorizing, and continuously monitoring security and privacy controls so organizations manage information system risk.

The set of components, users, processes, and data that make up an information system and are subject to the same authorization and risk management decisions.

The logical and physical perimeter for which an authorizing official accepts risk; it may include interconnected systems and shared services beyond the system boundary.

A senior official or group that establishes organization-wide risk management strategy, risk tolerance, and priorities to guide authorizing officials and system owners.

A NIST guide describing the RMF steps and tasks for managing risk to information systems throughout their life cycle, including authorization and continuous monitoring.

The process of determining impact levels for information types and the system, using FIPS 199 criteria and considering harm to operations, assets, individuals, and other organizations.

A federal standard that requires categorizing information and information systems by the potential impact of losing confidentiality, integrity, or availability, using low, moderate, or high labels.

A label indicating the potential adverse impact of a confidentiality, integrity, or availability breach on organizational operations, assets, individuals, or other organizations.

The assessed severity of harm from a security event, assigned separately to confidentiality, integrity, and availability and used to derive the system security category.

A categorization rule that sets a system's overall impact level to the highest value assigned to any of its information types or security objectives.

A category of information with a common purpose and sensitivity that is evaluated for confidentiality, integrity, and availability impact during system categorization.

A federal standard that specifies minimum security requirements for information systems based on their FIPS 199 security category and directs selection of controls from a catalog.

A starting set of security controls selected for a system from a catalog based on its security category and applicable legal, regulatory, or organizational requirements.

The process of reviewing a baseline and adding, removing, or modifying controls so the chosen set fits the system's mission, environment, and risk.

A reusable package of control additions, removals, and supplemental guidance for a specific community, technology, or mission, applied on top of a baseline.

A supplemental requirement attached to a base security control that adds strength or coverage when risk and system needs justify the added protection.

A catalog of security and privacy controls and assessment procedures that organizations use to select, implement, and assess safeguards for information systems.

A security control implemented by one provider and inherited by multiple information systems, with responsibility and evidence documented outside each individual system.

A control for which some aspects are provided commonly and other aspects are implemented by the system owner, requiring coordinated responsibility and supporting evidence.

A control selected and implemented within a particular information system's boundary because it cannot be effectively provided as a shared or inherited control.

The act of deploying and configuring selected controls, then documenting how they operate and meet their stated requirements in the system environment.

An alternative safeguard applied when a required control cannot be implemented directly, providing protection equivalent to or stronger than the original requirement.

A document that defines the scope, methods, procedures, schedule, and team for assessing whether selected controls are implemented correctly and operating effectively.

A document that records assessment findings, evidence, control effectiveness determinations, and risk information to support authorization and remediation decisions.

A technique used to gather evidence about a control, commonly by examining documents or settings, interviewing people, or testing behavior and results.

Detailed instructions for collecting evidence and judging whether a specific control satisfies its requirement, including objects to examine, people to interview, or functions to test.

The degree to which an implemented control operates as intended and produces the required outcome, considering its design, implementation, and continued operation.

The testing and evaluation of controls to determine whether they are implemented correctly, operating as intended, and producing the desired security outcome.

The set of evidence and analysis an authorizing official reviews, typically including categorization, control implementation details, assessment results, and remediation plans.

A formal, documented judgment by an authorizing official that a system may operate, including accepted risk and any conditions or restrictions.

A time-limited approval that lets an information system operate after the authorizing official accepts its residual risk and any stated conditions.

A senior organizational official with the authority to accept risk and decide whether an information system may begin or continue operating.

A documented decision to tolerate a specific remaining risk, including the rationale, decision maker, and any conditions or monitoring requirements.

The risk that remains after security controls are implemented and assessed, which an authorizing official may choose to accept, mitigate, or avoid.

A management record of known security weaknesses, planned corrective actions, assigned responsibilities, resources, and target completion dates used to track remediation.

An ongoing process for observing security state, assessing controls, and responding to changes so risk decisions stay current throughout system operation.

An organization-wide strategy for continuously collecting and analyzing security information about assets, vulnerabilities, threats, and controls to support risk management decisions.

A disciplined process for identifying, controlling, and auditing changes to system components and settings so the approved security posture remains known.

A process for requesting, reviewing, approving, and recording changes before they occur, including analysis of their security and operational effects.